Edit tour

Windows Analysis Report
EBAbsk8ydv.exe

Overview

General Information

Sample name:	EBAbsk8ydv.exe renamed because original name is a hash value
Original sample name:	4fdb0465d2a66e1d810e072b8e205bf7445566a8e9a97c4cd3da0a7b4dc991a4.exe
Analysis ID:	1488510
MD5:	e546e832f5762cbf8f28b6558c012b8d
SHA1:	ad6368dbb616f9a1a56ec1d3ac9026887928ad63
SHA256:	4fdb0465d2a66e1d810e072b8e205bf7445566a8e9a97c4cd3da0a7b4dc991a4
Tags:	dssdhome-xyzexe
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to infect the boot sector

Performs DNS queries to domains with low reputation

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

EBAbsk8ydv.exe (PID: 2488 cmdline: "C:\Users\user\Desktop\EBAbsk8ydv.exe" MD5: E546E832F5762CBF8F28B6558C012B8D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: EBAbsk8ydv.exe	Virustotal: Detection: 12%			Perma Link
Source: EBAbsk8ydv.exe	ReversingLabs: Detection: 13%

Source: EBAbsk8ydv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\F1_proj_trunk\f1\src\features\qbroker\Release\qbroker64.pdb; source: EBAbsk8ydv.exe
Source:	Binary string: E:\F1_proj_trunk\f1\src\features\qbroker\Release\qbroker64.pdb source: EBAbsk8ydv.exe

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F14C0 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_wfullpath,_errno,_errno,_errno,_wfullpath,IsRootUNCName,GetDriveTypeW,free,__loctotime64_t,free,_wsopen_s,_fstat64,_close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FindClose,__wdtoxmode,GetLastError,_dosmaperr,FindClose,GetLastError,_dosmaperr,FindClose,		0_2_00007FF7FA9F14C0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9E8C4C FindFirstFileW,FindClose,		0_2_00007FF7FA9E8C4C

Networking

Performs DNS queries to domains with low reputation

Source:	DNS query: xn--ypd.dssdhome.xyz
Source:	DNS query: xn--ypd.dssdhome.xyz

Source: Joe Sandbox View

IP Address: 169.150.247.37 169.150.247.37

Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz
Source: global traffic	HTTP traffic detected: GET /11/ip.bin HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2Host: xn--ypd.dssdhome.xyz

Source: global traffic

DNS traffic detected: DNS query: xn--ypd.dssdhome.xyz

Source: EBAbsk8ydv.exe, 00000000.00000002.3938638347.00000065E12FA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://11.dssdhome.xyz/11/ip.bin
Source: EBAbsk8ydv.exe	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: EBAbsk8ydv.exe	String found in binary or memory: http://ocsp.thawte.com0
Source: EBAbsk8ydv.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: EBAbsk8ydv.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: EBAbsk8ydv.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3885206665.0000022251D29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/
Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/.2
Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/.dll
Source: EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CA8000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/11/ip.bin
Source: EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/11/ip.binfU)
Source: EBAbsk8ydv.exe, 00000000.00000003.3397293978.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499474925.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/11/ip.binsFF
Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/3
Source: EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/dll
Source: EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/l
Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/n
Source: EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz/s.dll
Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xn--ypd.dssdhome.xyz:80/11/ip.bin
Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xn--ypd.ds
Source: EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3921258964.0000022251D42000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xn--ypd.dssdhome.xyz/11/ip.bin
Source: EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D03000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251CFD000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CFD000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D04000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xn--ypd.dssdhome.xyz/11/ip.binLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedEx

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9EDD00: CreateFileW,DeviceIoControl,FindCloseChangeNotification,

0_2_00007FF7FA9EDD00

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9ED434	0_2_00007FF7FA9ED434
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9ED9A0	0_2_00007FF7FA9ED9A0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9E6FB1	0_2_00007FF7FA9E6FB1
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9D1848	0_2_00007FF7FA9D1848
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA07B2C	0_2_00007FF7FAA07B2C
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F2B78	0_2_00007FF7FA9F2B78
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F14C0	0_2_00007FF7FA9F14C0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA014E0	0_2_00007FF7FAA014E0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA02454	0_2_00007FF7FAA02454
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA0442C	0_2_00007FF7FAA0442C
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F4C2C	0_2_00007FF7FA9F4C2C
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9DEA00	0_2_00007FF7FA9DEA00
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9E29E4	0_2_00007FF7FA9E29E4
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9EE1E8	0_2_00007FF7FA9EE1E8
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9D7144	0_2_00007FF7FA9D7144
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA072C8	0_2_00007FF7FAA072C8
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9E0AAC	0_2_00007FF7FA9E0AAC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F6AAC	0_2_00007FF7FA9F6AAC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9FA278	0_2_00007FF7FA9FA278
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9D3FD4	0_2_00007FF7FA9D3FD4
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9FC7B4	0_2_00007FF7FA9FC7B4
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9FAFF0	0_2_00007FF7FA9FAFF0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA04890	0_2_00007FF7FAA04890
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F5D54	0_2_00007FF7FA9F5D54
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA08D8C	0_2_00007FF7FAA08D8C
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA00EBC	0_2_00007FF7FAA00EBC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F9EC8	0_2_00007FF7FA9F9EC8
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F4EA0	0_2_00007FF7FA9F4EA0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9FB6AC	0_2_00007FF7FA9FB6AC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F2E90	0_2_00007FF7FA9F2E90
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9E7670	0_2_00007FF7FA9E7670
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FAA0A660	0_2_00007FF7FAA0A660

Source: EBAbsk8ydv.exe

Static PE information: invalid certificate

Source: EBAbsk8ydv.exe	Binary or memory string: OriginalFilename vs EBAbsk8ydv.exe
Source: EBAbsk8ydv.exe, 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameqbroker.exe, vs EBAbsk8ydv.exe
Source: EBAbsk8ydv.exe	Binary or memory string: OriginalFilenameqbroker.exe, vs EBAbsk8ydv.exe

Source: classification engine

Classification label: mal56.troj.winEXE@1/0@2/1

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9DEFA0 GetCurrentThreadId,PostThreadMessageW,Sleep,ShellExecuteW,CoCreateInstance,CoCreateInstance,

0_2_00007FF7FA9DEFA0

Source: EBAbsk8ydv.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EBAbsk8ydv.exe	Virustotal: Detection: 12%
Source: EBAbsk8ydv.exe	ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: EBAbsk8ydv.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: EBAbsk8ydv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: EBAbsk8ydv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: EBAbsk8ydv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: EBAbsk8ydv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: EBAbsk8ydv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: EBAbsk8ydv.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: EBAbsk8ydv.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: EBAbsk8ydv.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\F1_proj_trunk\f1\src\features\qbroker\Release\qbroker64.pdb; source: EBAbsk8ydv.exe
Source:	Binary string: E:\F1_proj_trunk\f1\src\features\qbroker\Release\qbroker64.pdb source: EBAbsk8ydv.exe

Source: EBAbsk8ydv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: EBAbsk8ydv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: EBAbsk8ydv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: EBAbsk8ydv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: EBAbsk8ydv.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9ECF60 GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetAdaptersInfo,FreeLibrary,

0_2_00007FF7FA9ECF60

Source: EBAbsk8ydv.exe

Static PE information: real checksum: 0x63c9a should be: 0x61a23

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_00007FF7FA9ED434
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: CreateFileW,DeviceIoControl,isalnum,isalnum,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive%d	0_2_00007FF7FA9ED9A0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: CreateFileW,DeviceIoControl,malloc,DeviceIoControl,free,CloseHandle, \\.\PhysicalDrive%d	0_2_00007FF7FA9ED748

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_00007FF7FA9ED434
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: CreateFileW,DeviceIoControl,isalnum,isalnum,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive%d	0_2_00007FF7FA9ED9A0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: CreateFileW,DeviceIoControl,malloc,DeviceIoControl,free,CloseHandle, \\.\PhysicalDrive%d	0_2_00007FF7FA9ED748

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9F2B78 EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF7FA9F2B78

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Process information set: NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetAdaptersInfo,FreeLibrary,

0_2_00007FF7FA9ECF60

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-22256

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe TID: 420	Thread sleep time: -60000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe TID: 420	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9F14C0 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_wfullpath,_errno,_errno,_errno,_wfullpath,IsRootUNCName,GetDriveTypeW,free,__loctotime64_t,free,_wsopen_s,_fstat64,_close,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FileTimeToSystemTime,SystemTimeToTzSpecificLocalTime,__loctotime64_t,FindClose,__wdtoxmode,GetLastError,_dosmaperr,FindClose,GetLastError,_dosmaperr,FindClose,		0_2_00007FF7FA9F14C0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: 0_2_00007FF7FA9E8C4C FindFirstFileW,FindClose,		0_2_00007FF7FA9E8C4C

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9E06C4 GetSystemTimeAsFileTime,GetModuleHandleW,GetProcAddress,GetSystemInfo,GetSystemDefaultLangID,InternetOpenA,InternetSetOptionW,InternetConnectW,

0_2_00007FF7FA9E06C4

Source: EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0s

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

API call chain: ExitProcess graph end node

graph_0-22196

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9EECDC GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7FA9EECDC

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9EECDC GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF7FA9EECDC

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9ECF60 GetSystemDirectoryW,LoadLibraryW,GetProcAddress,GetAdaptersInfo,FreeLibrary,

0_2_00007FF7FA9ECF60

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FAA04D00 _lseeki64_nolock,_lseeki64_nolock,GetProcessHeap,HeapAlloc,_errno,_errno,_setmode_nolock,_write_nolock,__doserrno,_errno,_setmode_nolock,GetProcessHeap,HeapFree,_lseeki64_nolock,_get_osfhandle,SetEndOfFile,_errno,__doserrno,GetLastError,_lseeki64_nolock,

0_2_00007FF7FAA04D00

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9F87D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7FA9F87D8

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	0_2_00007FF7FAA01BD0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: __crtGetLocaleInfoEx,	0_2_00007FF7FAA013DC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	0_2_00007FF7FAA01328
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,wcschr,wcschr,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	0_2_00007FF7FAA014E0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,free,	0_2_00007FF7FA9FE4DC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	0_2_00007FF7FAA019A0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	0_2_00007FF7FA9FE944
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7FA9FE900
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_00007FF7FAA0190C
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,EnumSystemLocalesW,	0_2_00007FF7FAA01858
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,GetLocaleInfoW,	0_2_00007FF7FAA01DCC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,free,free,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,free,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00007FF7FA9F3598
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7FAA01D1C
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	0_2_00007FF7FAA00EBC
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	0_2_00007FF7FA9F4EA0
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00007FF7FA9FE648
Source: C:\Users\user\Desktop\EBAbsk8ydv.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	0_2_00007FF7FAA01E74

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9E06C4 GetSystemTimeAsFileTime,GetModuleHandleW,GetProcAddress,GetSystemInfo,GetSystemDefaultLangID,InternetOpenA,InternetSetOptionW,InternetConnectW,

0_2_00007FF7FA9E06C4

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FAA0442C _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,_getenv_helper_nolock,free,_malloc_crt,_invoke_watson,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

0_2_00007FF7FAA0442C

Source: C:\Users\user\Desktop\EBAbsk8ydv.exe

Code function: 0_2_00007FF7FA9EDF34 GetVersionExW,

0_2_00007FF7FA9EDF34

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 Bootkit	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	Boot or Logon Initialization Scripts	1 Bootkit	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EBAbsk8ydv.exe	12%	Virustotal		Browse
EBAbsk8ydv.exe	14%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://xn--ypd.dssdhome.xyz/l	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/	0%	Avira URL Cloud	safe
https://xn--ypd.ds	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/11/ip.bin	0%	Avira URL Cloud	safe
http://11.dssdhome.xyz/11/ip.bin	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/n	0%	Avira URL Cloud	safe
https://xn--ypd.dssdhome.xyz/11/ip.bin	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/11/ip.bin	0%	Virustotal		Browse
http://xn--ypd.dssdhome.xyz/3	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz:80/11/ip.bin	0%	Avira URL Cloud	safe
https://xn--ypd.dssdhome.xyz/11/ip.binLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedEx	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/11/ip.binfU)	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/dll	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/.2	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/.dll	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz/s.dll	0%	Avira URL Cloud	safe
http://xn--ypd.dssdhome.xyz:80/11/ip.bin	0%	Virustotal		Browse
http://xn--ypd.dssdhome.xyz/11/ip.binsFF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mooscc.b-cdn.net	169.150.247.37	true	false		unknown
xn--ypd.dssdhome.xyz	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://xn--ypd.dssdhome.xyz/	EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3885206665.0000022251D29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/11/ip.bin	EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CA8000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://11.dssdhome.xyz/11/ip.bin	EBAbsk8ydv.exe, 00000000.00000002.3938638347.00000065E12FA000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://xn--ypd.ds	EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	EBAbsk8ydv.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://xn--ypd.dssdhome.xyz/l	EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/n	EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	EBAbsk8ydv.exe	false	URL Reputation: safe	unknown
https://xn--ypd.dssdhome.xyz/11/ip.bin	EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3921258964.0000022251D42000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CDC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/3	EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz:80/11/ip.bin	EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D10000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://xn--ypd.dssdhome.xyz/11/ip.binLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedEx	EBAbsk8ydv.exe, 00000000.00000003.3397209493.0000022251D03000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251CFD000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CFD000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D04000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/11/ip.binfU)	EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/dll	EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/.2	EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3806545319.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/.dll	EBAbsk8ydv.exe, 00000000.00000003.3920722011.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000002.3938753625.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/s.dll	EBAbsk8ydv.exe, 00000000.00000003.3499379857.0000022251D1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xn--ypd.dssdhome.xyz/11/ip.binsFF	EBAbsk8ydv.exe, 00000000.00000003.3397293978.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp, EBAbsk8ydv.exe, 00000000.00000003.3499474925.0000022251CE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
169.150.247.37	mooscc.b-cdn.net	United States		2711	SPIRITTEL-ASUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1488510
Start date and time:	2024-08-06 06:51:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EBAbsk8ydv.exe renamed because original name is a hash value
Original Sample Name:	4fdb0465d2a66e1d810e072b8e205bf7445566a8e9a97c4cd3da0a7b4dc991a4.exe
Detection:	MAL
Classification:	mal56.troj.winEXE@1/0@2/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 13 Number of non-executed functions: 55
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
169.150.247.37	https://softworldinc.com	Get hash	malicious	Unknown	Browse	cdn.rawgit.com/michalsnik/aos/2.1.1/dist/aos.js
169.150.247.37	http://office365secure-thresholdacoustics-q5cdxz-my-sharepoint-com.b-cdn.net	Get hash	malicious	Unknown	Browse	office365secure-thresholdacoustics-q5cdxz-my-sharepoint-com.b-cdn.net/background-mailbox.jpg

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPIRITTEL-ASUS	https://mato-camp-v4.b-cdn.net/kesty	Get hash	malicious	Unknown	Browse	169.150.247.33
	https://forms.office.com/Pages/ResponsePage.aspx?id=mZB7T0Dtr0mx-Js9AsqUvjkKVGExcKpLpLje28x2_kZUOVA4UU9WT0pSQUFPSTZPUlhWTElINUNETy4u	Get hash	malicious	HTMLPhisher	Browse	169.150.247.37
	https://16784846511.cloud/	Get hash	malicious	Unknown	Browse	169.150.247.36
	jQ0zXV2d1X.elf	Get hash	malicious	Mirai	Browse	165.167.232.23
	https://ipfs.io/ipfs/QmVLJJWuJ1bT38BeLkxSKLDMhVADeV6vmCtQ5cAqW3qdoR	Get hash	malicious	HTMLPhisher	Browse	169.150.247.36
	IISz6QDXkY.elf	Get hash	malicious	Mirai	Browse	207.146.102.5
	https://markeertrafficservicebv6t3etwyghdsbn.dorik.io/	Get hash	malicious	Unknown	Browse	169.150.247.36
	https://link.storjshare.io/s/jvktcsf5ypoak5aucs6fn6noqgga/crowdstrikesupport/update.zip?download=1	Get hash	malicious	Unknown	Browse	169.150.247.39

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.219147275536416
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	EBAbsk8ydv.exe
File size:	352'608 bytes
MD5:	e546e832f5762cbf8f28b6558c012b8d
SHA1:	ad6368dbb616f9a1a56ec1d3ac9026887928ad63
SHA256:	4fdb0465d2a66e1d810e072b8e205bf7445566a8e9a97c4cd3da0a7b4dc991a4
SHA512:	f68c9286765cca89fc63020b2573ddc88cff745e5502fd5cf97c1160ce8f46a6bd08227be335d3a2022a1ac179eddddbd52d05c7a9c32332cffcc1dbd7de21c7
SSDEEP:	6144:rEdue2soURTO6e6FMCnIpXsuJr79LLKFdLEH5Z:rm2soUQR+nIhLKFd4Z
TLSH:	94747E69F2E455F8C46BC63689964642D3F27C261A7ADF4F13A0472B2F332909F2D712
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B....p...p...p..@!F..p..@!x.Jp..@!y..p....W..p....R..p...p...p..{.\|..p..."B..p...p...p..{.G..p..Rich.p.........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140020618
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5626F46B [Wed Oct 21 02:11:55 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b330d810ce52a718c58fc0a72cbb426c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	16/01/2013 19:00:00 16/02/2016 18:59:59
Subject Chain	CN=Tencent Technology(Shenzhen) Company Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Tencent Technology(Shenzhen) Company Limited, L=shenzhen, S=guangdong, C=CN
Version:	3
Thumbprint MD5:	242913A2A31BAD3BC7F08E547E0BBFAD
Thumbprint SHA-1:	2FDD445591CD2EEDBEF8B8A281896A59C08B3DC9
Thumbprint SHA-256:	16DB61B6F85E044F6DE44775EC093BEFDA52C35C4AB1424E9463C01B5E11E386
Serial:	7170BD93CF3F189AE6452B514C49340E

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F7B7918C838h
dec eax
add esp, 28h
jmp 00007F7B79184C7Bh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
mov eax, ecx
dec eax
neg ecx
dec eax
test eax, 00000007h
je 00007F7B79184E51h
nop
mov dl, byte ptr [eax]
dec eax
inc eax
test dl, dl
je 00007F7B79184EA1h
test al, 07h
jne 00007F7B79184E35h
dec ecx
mov eax, FEFEFEFFh

Rich Headers

Programming Language:

[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4da38	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x6e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x55000	0x2a54	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x54800	0x1960
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x59000	0xbf4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3c610	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x481f0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3c000	0x538	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3affc	0x3b000	043d7a8a7762ce240ee30b0e264bf052	False	0.4893198821504237	data	6.43588709572288	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3c000	0x12bca	0x12c00	b8c697b4fe8eae5f35d8658801eb1c54	False	0.3447395833333333	data	4.4036530103672185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4f000	0x5238	0x2800	752715e664679c0b2c6de2e3dfe40a72	False	0.24716796875	data	3.448216610884499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x55000	0x2a54	0x2c00	c883e64b3fad00cc2dfa25ec2d2587a5	False	0.4665305397727273	data	5.31766570768096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x58000	0x6e8	0x800	dfea87dd18bd72fb2394ad0ec611cfd5	False	0.40478515625	data	4.374395563555661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x59000	0xbf4	0xc00	e2b726280567b8e93f7147381710dc80	False	0.4895833333333333	data	5.420233678628129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x580a0	0x2dc	data	Chinese	China	0.47950819672131145
RT_MANIFEST	0x58380	0x365	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (809), with CRLF line terminators	English	United States	0.4890678941311853

Imports

DLL	Import
KERNEL32.dll	GetLastError, HeapSize, EnterCriticalSection, CreateEventW, DecodePointer, WaitForMultipleObjects, CreateWaitableTimerW, DeleteCriticalSection, GetCurrentThreadId, CloseHandle, CreateThread, RaiseException, Sleep, GetCurrentProcess, GetModuleHandleW, OpenProcess, LoadLibraryW, GetProcAddress, OpenThread, GetModuleHandleA, LocalFree, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, InitializeCriticalSection, GetProcessHeap, SetEvent, WaitForSingleObject, HeapFree, SetWaitableTimer, HeapAlloc, SetErrorMode, GetModuleFileNameW, HeapReAlloc, SetEnvironmentVariableA, FlushFileBuffers, WriteConsoleW, ReadConsoleW, SetEndOfFile, GetTimeZoneInformation, SetStdHandle, SetFilePointerEx, GetConsoleMode, GetConsoleCP, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, LoadLibraryExW, GetCurrentDirectoryW, GetFullPathNameW, PeekNamedPipe, GetFileInformationByHandle, FileTimeToLocalFileTime, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, RtlVirtualUnwind, RtlCaptureContext, FreeEnvironmentStringsW, IsDebuggerPresent, OutputDebugStringW, MultiByteToWideChar, WideCharToMultiByte, GetSystemDefaultLangID, GetSystemTimeAsFileTime, GetSystemInfo, GetVersionExW, CreateFileW, CopyFileW, DeleteFileW, GetFileSize, ReadFile, WriteFile, FindFirstFileW, FindClose, ExpandEnvironmentStringsW, GetSystemDirectoryW, FreeLibrary, DeviceIoControl, EncodePointer, GetCommandLineW, RtlPcToFileHeader, RtlLookupFunctionEntry, RtlUnwindEx, FindFirstFileExW, GetDriveTypeW, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, CreateDirectoryW, IsProcessorFeaturePresent, ExitProcess, GetModuleHandleExW, GetStdHandle, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, GetStringTypeW, GetFileType, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetEnvironmentStringsW
USER32.dll	PostThreadMessageW, PostQuitMessage, GetMessageW, DispatchMessageW
ADVAPI32.dll	RegSetValueExW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RegCreateKeyExW, RegOpenKeyExA, RegQueryValueExA
SHELL32.dll	CommandLineToArgvW, ShellExecuteW, SHGetSpecialFolderPathW
ole32.dll	CoUninitialize, StringFromGUID2, CoInitializeEx, CoRevokeClassObject, CoRegisterClassObject, CoCreateInstance, CoInitialize, CoCreateGuid, CoRegisterMessageFilter
OLEAUT32.dll	SysAllocString, SysFreeString, SysStringLen, VariantClear, VariantInit, SysAllocStringLen, VariantChangeType
SHLWAPI.dll	PathAppendW, PathFileExistsW, PathFindFileNameW
VERSION.dll	GetFileVersionInfoW, VerQueryValueW
WS2_32.dll	htonl, htons
WININET.dll	HttpSendRequestA, HttpOpenRequestW, InternetConnectW, InternetSetOptionW, InternetOpenA, InternetCloseHandle
NETAPI32.dll	Netbios, NetApiBufferFree, NetWkstaTransportEnum

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2024 06:54:20.904459000 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:20.909313917 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:20.909380913 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:20.909967899 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:20.914833069 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:21.539872885 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:21.581625938 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:31.552712917 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:31.557707071 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:31.737569094 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:31.784774065 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:41.766303062 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:41.771150112 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:41.951476097 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:42.003565073 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:51.974584103 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:54:51.979671955 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:52.161663055 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:54:52.206763029 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:02.177726030 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:02.183000088 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:02.409629107 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:02.456922054 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:12.478053093 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:12.482887983 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:12.668390036 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:12.668579102 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:12.674016953 CEST	80	49714	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:12.674063921 CEST	49714	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:23.387135029 CEST	49715	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:23.392205000 CEST	80	49715	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:23.392278910 CEST	49715	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:23.393651009 CEST	49715	80	192.168.2.6	169.150.247.37
Aug 6, 2024 06:55:23.398497105 CEST	80	49715	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:24.064744949 CEST	80	49715	169.150.247.37	192.168.2.6
Aug 6, 2024 06:55:24.113007069 CEST	49715	80	192.168.2.6	169.150.247.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 6, 2024 06:54:20.537060022 CEST	51491	53	192.168.2.6	1.1.1.1
Aug 6, 2024 06:54:20.897933960 CEST	53	51491	1.1.1.1	192.168.2.6
Aug 6, 2024 06:55:22.696399927 CEST	62519	53	192.168.2.6	1.1.1.1
Aug 6, 2024 06:55:23.307462931 CEST	53	62519	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 6, 2024 06:54:20.537060022 CEST	192.168.2.6	1.1.1.1	0xdbb	Standard query (0)	xn--ypd.dssdhome.xyz	A (IP address)	IN (0x0001)	false
Aug 6, 2024 06:55:22.696399927 CEST	192.168.2.6	1.1.1.1	0xcb1e	Standard query (0)	xn--ypd.dssdhome.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 6, 2024 06:54:20.897933960 CEST	1.1.1.1	192.168.2.6	0xdbb	No error (0)	xn--ypd.dssdhome.xyz	mooscc.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 6, 2024 06:54:20.897933960 CEST	1.1.1.1	192.168.2.6	0xdbb	No error (0)	mooscc.b-cdn.net		169.150.247.37	A (IP address)	IN (0x0001)	false
Aug 6, 2024 06:55:23.307462931 CEST	1.1.1.1	192.168.2.6	0xcb1e	No error (0)	xn--ypd.dssdhome.xyz	mooscc.b-cdn.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 6, 2024 06:55:23.307462931 CEST	1.1.1.1	192.168.2.6	0xcb1e	No error (0)	mooscc.b-cdn.net		169.150.247.37	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

xn--ypd.dssdhome.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	169.150.247.37	80	2488	C:\Users\user\Desktop\EBAbsk8ydv.exe

Timestamp	Bytes transferred	Direction	Data
Aug 6, 2024 06:54:20.909967899 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:54:21.539872885 CEST	527	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:54:21 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: 3fde225c8452d734131da18c56a37dfb Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Aug 6, 2024 06:54:31.552712917 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:54:31.737569094 CEST	527	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:54:31 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: 50f0749d292190a97d2c3125c585dc4b Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Aug 6, 2024 06:54:41.766303062 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:54:41.951476097 CEST	527	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:54:41 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: 0088e30e5e1828b1593dec1701e10a6d Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Aug 6, 2024 06:54:51.974584103 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:54:52.161663055 CEST	527	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:54:52 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: 4e024ec02e9035057e3aa1749e7262f0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Aug 6, 2024 06:55:02.177726030 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:55:02.409629107 CEST	527	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:55:02 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: 45ade02b2bd2b3a25bcf77d5ac2a58eb Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Aug 6, 2024 06:55:12.478053093 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:55:12.668390036 CEST	365	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:55:12 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: 18f4b088be584eebb7fa210a555a7390

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49715	169.150.247.37	80	2488	C:\Users\user\Desktop\EBAbsk8ydv.exe

Timestamp	Bytes transferred	Direction	Data
Aug 6, 2024 06:55:23.393651009 CEST	153	OUT	GET /11/ip.bin HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux i644 ; en-US) Gecko/20100101 Firefox/70.2 Host: xn--ypd.dssdhome.xyz
Aug 6, 2024 06:55:24.064744949 CEST	527	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 06 Aug 2024 04:55:23 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Server: BunnyCDN-DE1-1080 CDN-PullZone: 2373567 CDN-Uid: 95780366-96cb-4089-af63-a08b2db1368d CDN-RequestCountryCode: US Location: https://xn--ypd.dssdhome.xyz/11/ip.bin CDN-RequestId: ec2b719c8a490edf28af830c9f5dc6ee Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Target ID:	0
Start time:	00:52:19
Start date:	06/08/2024
Path:	C:\Users\user\Desktop\EBAbsk8ydv.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\EBAbsk8ydv.exe"
Imagebase:	0x7ff7fa9d0000
File size:	352'608 bytes
MD5 hash:	E546E832F5762CBF8F28B6558C012B8D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.4%
Total number of Nodes:	385
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF7FA9D1848 Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 227
threadwindowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00007FF7FA9D187C
CoInitializeEx.OLE32 ref: 00007FF7FA9D1889

Part of subcall function 00007FF7FA9DFDAC: InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7FA9DFE18

Part of subcall function 00007FF7FA9E06C4: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FA9E0715
Part of subcall function 00007FF7FA9E06C4: GetModuleHandleW.KERNEL32 ref: 00007FF7FA9E07FB
Part of subcall function 00007FF7FA9E06C4: GetProcAddress.KERNEL32 ref: 00007FF7FA9E080B
Part of subcall function 00007FF7FA9E06C4: GetSystemDefaultLangID.KERNEL32 ref: 00007FF7FA9E083E

GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D18D5
CoRegisterClassObject.OLE32 ref: 00007FF7FA9D190A
CoRegisterClassObject.OLE32 ref: 00007FF7FA9D192C
malloc.LIBCMT ref: 00007FF7FA9D1935

Part of subcall function 00007FF7FA9EF3A8: _FF_MSGBANNER.LIBCMT ref: 00007FF7FA9EF3D8
Part of subcall function 00007FF7FA9EF3A8: _NMSG_WRITE.LIBCMT ref: 00007FF7FA9EF3E2
Part of subcall function 00007FF7FA9EF3A8: HeapAlloc.KERNEL32(?,?,?,00007FF7FA9F33D0,?,?,?,00007FF7FA9FDBE4,?,?,?,00007FF7FA9FDAE3,?,?,?,00007FF7FA9EF4C5), ref: 00007FF7FA9EF3FD
Part of subcall function 00007FF7FA9EF3A8: _callnewh.LIBCMT ref: 00007FF7FA9EF416
Part of subcall function 00007FF7FA9EF3A8: _errno.LIBCMT ref: 00007FF7FA9EF421
Part of subcall function 00007FF7FA9EF3A8: _errno.LIBCMT ref: 00007FF7FA9EF42C

CreateEventW.KERNEL32 ref: 00007FF7FA9D1959
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D196B
CreateThread.KERNEL32 ref: 00007FF7FA9D1997
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D19A1
CommandLineToArgvW.SHELL32 ref: 00007FF7FA9D19B9
LocalFree.KERNEL32 ref: 00007FF7FA9D1A2A
GetMessageW.USER32 ref: 00007FF7FA9D1A42
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D1A5B
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D1A7E
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D1A96
DispatchMessageW.USER32 ref: 00007FF7FA9D1AA6
GetMessageW.USER32 ref: 00007FF7FA9D1AB8
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D1ACB
PostThreadMessageW.USER32 ref: 00007FF7FA9D1ADB
SetEvent.KERNEL32 ref: 00007FF7FA9D1AEA
WaitForSingleObject.KERNEL32 ref: 00007FF7FA9D1B05
CloseHandle.KERNEL32 ref: 00007FF7FA9D1B0F
CloseHandle.KERNEL32 ref: 00007FF7FA9D1B22
CoRevokeClassObject.OLE32 ref: 00007FF7FA9D1B33
CoRevokeClassObject.OLE32 ref: 00007FF7FA9D1B44
CoUninitialize.OLE32 ref: 00007FF7FA9D1B59

Strings

!!!param=(%ws), and result=%d(0x%x), xrefs: 00007FF7FA9D1A13
--pt=, xrefs: 00007FF7FA9D19D6

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Thread$Current$Object$ClassMessage$Handle$CloseCreateEventInitializeRegisterRevokeSystemTime_errno$AddressAllocArgvCommandCountCriticalDefaultDispatchErrorFileFreeHeapLangLineLocalModeModulePostProcSectionSingleSpinUninitializeWait_callnewhmalloc
String ID: !!!param=(%ws), and result=%d(0x%x)$--pt=
API String ID: 936543831-3547824706
Opcode ID: 58205efe5a3e29f5020299fe62fb87e29203e1061887d7311f45762cce80e52e
Instruction ID: 5bfa141bfe620420226d1a44574b90ff49c3b422c1bf9aa4a6447edb76713bb7
Opcode Fuzzy Hash: 58205efe5a3e29f5020299fe62fb87e29203e1061887d7311f45762cce80e52e
Instruction Fuzzy Hash: D7A13E36B08A038AFB10EF71E4549ACB3A1FF44748B904075CD6D97AD4DE3CA55AC7A0

Function 00007FF7FA9E06C4 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 139
networklibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FA9E0715
GetModuleHandleW.KERNEL32 ref: 00007FF7FA9E07FB
GetProcAddress.KERNEL32 ref: 00007FF7FA9E080B
GetSystemInfo.KERNEL32 ref: 00007FF7FA9E081E
GetSystemDefaultLangID.KERNEL32 ref: 00007FF7FA9E083E
InternetOpenA.WININET ref: 00007FF7FA9E088D
InternetSetOptionW.WININET ref: 00007FF7FA9E08B7
InternetConnectW.WININET ref: 00007FF7FA9E08ED

Strings

QQ Data Report, xrefs: 00007FF7FA9E0886
kernel32.dll, xrefs: 00007FF7FA9E07F4
qbwup.imtt.qq.com, xrefs: 00007FF7FA9E08DF
GetNativeSystemInfo, xrefs: 00007FF7FA9E0801

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: InternetSystem$Time$AddressConnectDefaultFileHandleInfoLangModuleOpenOptionProc
String ID: GetNativeSystemInfo$QQ Data Report$kernel32.dll$qbwup.imtt.qq.com
API String ID: 3082367296-404951005
Opcode ID: dfcdd1e627b552f5fcc6b089cbe0647b8e705594d37419fb9a644f721dbe48a1
Instruction ID: aad12919c150ebaf2d2d7779327c10ac48f716a486441c4c68e23a5366fe2751
Opcode Fuzzy Hash: dfcdd1e627b552f5fcc6b089cbe0647b8e705594d37419fb9a644f721dbe48a1
Instruction Fuzzy Hash: 4A618E26A08A429AFB10EF30D4847E863A0EF54758F8001B5DA2D876EADF3DD559C7B1

Function 00007FF7FA9E6FB1 Relevance: 17.7, Strings: 14, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z, xrefs: 00007FF7FA9E7031
0, xrefs: 00007FF7FA9E7051
6, xrefs: 00007FF7FA9E7079
T, xrefs: 00007FF7FA9E7114
u, xrefs: 00007FF7FA9E7069
i, xrefs: 00007FF7FA9E7061
4, xrefs: 00007FF7FA9E7081
, xrefs: 00007FF7FA9E7071
M, xrefs: 00007FF7FA9E7029
G, xrefs: 00007FF7FA9E710C
l, xrefs: 00007FF7FA9E7039
5, xrefs: 00007FF7FA9E7049
a, xrefs: 00007FF7FA9E7041
(, xrefs: 00007FF7FA9E7059

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID:
String ID: $($0$4$5$6$G$M$T$a$i$l$u$z
API String ID: 0-2079474088
Opcode ID: 7d012af2536f1f7d995bb6865e94ab2d39a3359b1312110b88a70488074df788
Instruction ID: 342e69265496549e71dd7cd37ede28e845c9a3a2316cd2d526fd3b92289ce866
Opcode Fuzzy Hash: 7d012af2536f1f7d995bb6865e94ab2d39a3359b1312110b88a70488074df788
Instruction Fuzzy Hash: 01B166766047818AE760CF61E8887AE7BB5F748B8CF448029DF495BB48DF788549CB60

Function 00007FF7FA9ED9A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA9EDFE0: _wcsftime_l.LIBCMT ref: 00007FF7FA9EE002

CreateFileW.KERNELBASE ref: 00007FF7FA9EDA3B
DeviceIoControl.KERNELBASE ref: 00007FF7FA9EDAAE
isalnum.LIBCMT ref: 00007FF7FA9EDB7A
isalnum.LIBCMT ref: 00007FF7FA9EDB87

Part of subcall function 00007FF7FA9ED294: isspace.LIBCMT ref: 00007FF7FA9ED2E5
Part of subcall function 00007FF7FA9ED294: isprint.LIBCMT ref: 00007FF7FA9ED334
Part of subcall function 00007FF7FA9ED294: isprint.LIBCMT ref: 00007FF7FA9ED366

GetLastError.KERNEL32 ref: 00007FF7FA9EDCB7
FindCloseChangeNotification.KERNELBASE ref: 00007FF7FA9EDCC0

Strings

\\.\PhysicalDrive%d, xrefs: 00007FF7FA9ED9FE

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: isalnumisprint$ChangeCloseControlCreateDeviceErrorFileFindLastNotification_wcsftime_lisspace
String ID: \\.\PhysicalDrive%d
API String ID: 3713868347-2935326385
Opcode ID: 5f22f7dda0fa0d2083e89765b6fb2e99ee3076c198469aed35988f3e453eb5fa
Instruction ID: 52b1896d6b145acc84466c836e7b8b6ad6bda569ce3fa85cdbf927045080ea5f
Opcode Fuzzy Hash: 5f22f7dda0fa0d2083e89765b6fb2e99ee3076c198469aed35988f3e453eb5fa
Instruction Fuzzy Hash: 0A91D826A0C6C254F720EB3594802EEB760FB95398FD05271DA7C87ADADF39D149C7A0

Function 00007FF7FA9ECF60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 155
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF7FA9ECFCB
LoadLibraryW.KERNELBASE(?,00000000,00000001,?,00007FF7FA9E7E7A), ref: 00007FF7FA9ED059
GetProcAddress.KERNEL32(?,00000000,00000001,?,00007FF7FA9E7E7A), ref: 00007FF7FA9ED075
GetAdaptersInfo.IPHLPAPI(?,00000000,00000001,?,00007FF7FA9E7E7A), ref: 00007FF7FA9ED09B
FreeLibrary.KERNEL32(?,00000000,00000001,?,00007FF7FA9E7E7A), ref: 00007FF7FA9ED14A

Strings

iphlpapi.dll, xrefs: 00007FF7FA9ED039
GetAdaptersInfo, xrefs: 00007FF7FA9ED06B

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Library$AdaptersAddressDirectoryFreeInfoLoadProcSystem
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 779643986-3114217049
Opcode ID: 4a27c3a1f73799821867c693db5f1ce39942eb2f893445ff2fda54d3b6687bb2
Instruction ID: 9b6e368f38211d8ee521ab2ea7c595cbd31379c8b79ed7a37015e57cefa71e33
Opcode Fuzzy Hash: 4a27c3a1f73799821867c693db5f1ce39942eb2f893445ff2fda54d3b6687bb2
Instruction Fuzzy Hash: 355138266186C199FB25EF20D5942F9B7A0FF59744F845172CA6C837C2EF38D606C361

Function 00007FF7FA9ED434 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 191
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA9EDFE0: _wcsftime_l.LIBCMT ref: 00007FF7FA9EE002

CreateFileW.KERNELBASE ref: 00007FF7FA9ED4D3
DeviceIoControl.KERNELBASE ref: 00007FF7FA9ED527
DeviceIoControl.KERNEL32 ref: 00007FF7FA9ED5F1
CloseHandle.KERNEL32 ref: 00007FF7FA9ED708

Strings

, xrefs: 00007FF7FA9ED6C1
\\.\PhysicalDrive%d, xrefs: 00007FF7FA9ED492

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ControlDevice$CloseCreateFileHandle_wcsftime_l
String ID: $\\.\PhysicalDrive%d
API String ID: 2232022054-4129297631
Opcode ID: e552fafb8f0c2b07f14bd3e18931d16ec8ff4264b4c9298c1863061f42ef912c
Instruction ID: f9e4ede590e3be1d27eb768471deec183c283f429bea0a29a14ed47c9c54ad00
Opcode Fuzzy Hash: e552fafb8f0c2b07f14bd3e18931d16ec8ff4264b4c9298c1863061f42ef912c
Instruction Fuzzy Hash: 0681F722B0C64185FF10EB61E4803EDA7A0FB95798F800175DA6D87AD6DF7CD145CBA1

Function 00007FF7FA9EDD00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA9EDFE0: _wcsftime_l.LIBCMT ref: 00007FF7FA9EE002

CreateFileW.KERNELBASE ref: 00007FF7FA9EDD9A
DeviceIoControl.KERNELBASE ref: 00007FF7FA9EDE2C
FindCloseChangeNotification.KERNELBASE ref: 00007FF7FA9EDEF5

Strings

SCSIDISK, xrefs: 00007FF7FA9EDDC8
\\.\Scsi%d:, xrefs: 00007FF7FA9EDD59

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification_wcsftime_l
String ID: SCSIDISK$\\.\Scsi%d:
API String ID: 1682414592-2176293039
Opcode ID: 577b507be059ceb8dda8a8d80dc6f0ca7d4625d406ab22ce9cbaccb78d2fb990
Instruction ID: c24dce74043ec3b892981036b79913d75bf2b170365f751524dfb1411f432794
Opcode Fuzzy Hash: 577b507be059ceb8dda8a8d80dc6f0ca7d4625d406ab22ce9cbaccb78d2fb990
Instruction Fuzzy Hash: AC51D63270864249FB20EB25E4447EAA7A0FB55798FC00171DE6C47AD6DF3CD145CBA1

Function 00007FF7FA9EDF34 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 00007FF7FA9EDF66

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 9310357b27b72605c91cda9fd868c2f1d05fda8222a43fcded9a615d6b2e3943
Instruction ID: e49a741c759b16db9d3b4a6a19039254907747b13df6c28b4016ccd9d143a937
Opcode Fuzzy Hash: 9310357b27b72605c91cda9fd868c2f1d05fda8222a43fcded9a615d6b2e3943
Instruction Fuzzy Hash: 5611C120E1C35644FF10FB126A443B5D2805F26BC4F8024B5DE2D97AD79E2CA41A86B2

Function 00007FF7FA9ECA74 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF7FA9ECAE8

Part of subcall function 00007FF7FA9DF17C: _wcsftime_l.LIBCMT ref: 00007FF7FA9DF19E

RegOpenKeyExA.KERNELBASE ref: 00007FF7FA9ECB2E
RegQueryValueExA.KERNELBASE ref: 00007FF7FA9ECB6F
RegQueryValueExA.ADVAPI32 ref: 00007FF7FA9ECBBE
RegCloseKey.ADVAPI32 ref: 00007FF7FA9ECC25
RegCloseKey.ADVAPI32 ref: 00007FF7FA9ECC30

Strings

PnpInstanceID, xrefs: 00007FF7FA9ECBAF
System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}, xrefs: 00007FF7FA9ECABF
PCI, xrefs: 00007FF7FA9ECBD1, 00007FF7FA9ECBF6
MediaSubType, xrefs: 00007FF7FA9ECB60
%s\Connection, xrefs: 00007FF7FA9ECAFE

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: CloseOpenQueryValue$_wcsftime_l
String ID: %s\Connection$MediaSubType$PCI$PnpInstanceID$System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}
API String ID: 1942821279-3769660923
Opcode ID: 1e710f77e3ee06986cbe06514addf1342d7295bd946d04cac56360bd4f484af0
Instruction ID: 7682ad934595a42390734293f2e5bee14080a59effbb02d6cdc778ce106938ea
Opcode Fuzzy Hash: 1e710f77e3ee06986cbe06514addf1342d7295bd946d04cac56360bd4f484af0
Instruction Fuzzy Hash: 6C51713261CB4296FB50DF21E48066AF3B4FB88794F901171EA9D83A99DF3CD509CB90

Function 00007FF7FA9E6BE1 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 90
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00007FF7FA9E6C98

Strings

msvc, xrefs: 00007FF7FA9E6C1B
32.d, xrefs: 00007FF7FA9E6C07
ttp., xrefs: 00007FF7FA9E6C3A
user, xrefs: 00007FF7FA9E6BFB
dll, xrefs: 00007FF7FA9E6C41
winh, xrefs: 00007FF7FA9E6C33
rt.d, xrefs: 00007FF7FA9E6C22

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: LibraryLoad
String ID: 32.d$dll$msvc$rt.d$ttp.$user$winh
API String ID: 1029625771-3273083856
Opcode ID: 73224d7bf1c59c6d7a50056a5264328afd2584649fa69412497d679d280ec81e
Instruction ID: 970a5f936a11ab37a9db6bdb66509af1bdc57440d1d51f319052110ac4b26026
Opcode Fuzzy Hash: 73224d7bf1c59c6d7a50056a5264328afd2584649fa69412497d679d280ec81e
Instruction Fuzzy Hash: F9413131E49B4286F710FF61B08929EB6A5FB95304F508074D7E94B79ADF38E82183A1

Function 00007FF7FA9E7DC8 Relevance: 4.7, APIs: 3, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7FA9ECC60: NetWkstaTransportEnum.NETAPI32 ref: 00007FF7FA9ECCB1
Part of subcall function 00007FF7FA9ECC60: swscanf.LIBCMT ref: 00007FF7FA9ECD30
Part of subcall function 00007FF7FA9ECC60: NetApiBufferFree.NETAPI32 ref: 00007FF7FA9ECD90

Part of subcall function 00007FF7FA9E8128: CreateFileW.KERNEL32 ref: 00007FF7FA9E8197
Part of subcall function 00007FF7FA9E8128: CopyFileW.KERNEL32 ref: 00007FF7FA9E81EF
Part of subcall function 00007FF7FA9E8128: DeleteFileW.KERNEL32 ref: 00007FF7FA9E8207
Part of subcall function 00007FF7FA9E8128: CreateFileW.KERNEL32 ref: 00007FF7FA9E8237
Part of subcall function 00007FF7FA9E8128: GetFileSize.KERNEL32 ref: 00007FF7FA9E826B
Part of subcall function 00007FF7FA9E8128: ReadFile.KERNEL32 ref: 00007FF7FA9E828E
Part of subcall function 00007FF7FA9E8128: CloseHandle.KERNEL32 ref: 00007FF7FA9E82A6

CoInitialize.OLE32 ref: 00007FF7FA9E8033

Part of subcall function 00007FF7FA9EF658: malloc.LIBCMT ref: 00007FF7FA9EF672

CoCreateGuid.OLE32 ref: 00007FF7FA9E8054
CoUninitialize.OLE32 ref: 00007FF7FA9E8076

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: File$Create$BufferCloseCopyDeleteEnumFreeGuidHandleInitializeReadSizeTransportUninitializeWkstamallocswscanf
String ID:
API String ID: 967320499-0
Opcode ID: f45f6e0889ba490f2accccdbf6b7aa0c194da9b90917add94f5b7e6bbfcb44cd
Instruction ID: 8d880a5c6969dd9c5f30855e88acdea84056bb7d82342611682d12eb8dd47b5c
Opcode Fuzzy Hash: f45f6e0889ba490f2accccdbf6b7aa0c194da9b90917add94f5b7e6bbfcb44cd
Instruction Fuzzy Hash: 27A19022A1C64185FB10EB61E8801EEA770FBA1748F900475EE6D876E7DF79D484C7B1

Function 00007FF7FA9E73A1 Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9E6A61), ref: 00007FF7FA9E73F7
SleepEx.KERNEL32 ref: 00007FF7FA9E74A5

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ChangeCloseFindNotificationSleep
String ID:
API String ID: 1821831730-0
Opcode ID: 17cfd8ad0c7638cb764231ca36a94797f8588443699496d39ce2ea07f32eeec3
Instruction ID: 8f3b51d3dfdbda912a92a30696180a5e1ce7b77dcdb811bbaba29d34b49274f0
Opcode Fuzzy Hash: 17cfd8ad0c7638cb764231ca36a94797f8588443699496d39ce2ea07f32eeec3
Instruction Fuzzy Hash: C3415972A046808AE710DF71E4583AD3AB2F749BDCF148139DF192BB88DF7885898B50

Function 00007FF7FA9E694C Relevance: 3.1, APIs: 2, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy_s.LIBCMT ref: 00007FF7FA9E69C8
memcpy_s.LIBCMT ref: 00007FF7FA9E69EB

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 3ba629cbf69f092d9a6a99baa789089f6e541fc72971d204d36041c70e46a210
Instruction ID: fcdb52f73e6e28c9a6fc6759398a4755f876522f8785302e86a667bdcda85a52
Opcode Fuzzy Hash: 3ba629cbf69f092d9a6a99baa789089f6e541fc72971d204d36041c70e46a210
Instruction Fuzzy Hash: AD318E32B09A4194FB20EB60E4913FCA3B0AB54B48F940275CE6D976C6CF3CD556C7A1

Non-executed Functions

Function 00007FF7FA9D3FD4 Relevance: 35.5, APIs: 7, Strings: 13, Instructions: 479memoryCOMMON

Download Yara Rule

APIs

_snwprintf_s.LIBCMT ref: 00007FF7FA9D417C
SysFreeString.OLEAUT32 ref: 00007FF7FA9D422F
SysAllocString.OLEAUT32 ref: 00007FF7FA9D423C
ShellExecuteW.SHELL32 ref: 00007FF7FA9D4289
_snwprintf_s.LIBCMT ref: 00007FF7FA9D4383
SysFreeString.OLEAUT32 ref: 00007FF7FA9D4515
_snwprintf_s.LIBCMT ref: 00007FF7FA9D45C6

Strings

success, xrefs: 00007FF7FA9D4443
getqb(failed),callIE=0x%0x, xrefs: 00007FF7FA9D45AE
%s|%s|%s|CallIE(hr=0x%0x), xrefs: 00007FF7FA9D4160
Refresh, xrefs: 00007FF7FA9D46F2
ShellExecute(failed)=%d, CallIE=0x%0x, xrefs: 00007FF7FA9D4367
Navigate, xrefs: 00007FF7FA9D402D, 00007FF7FA9D431F, 00007FF7FA9D4469
!!!CCustomInternetExplorer::Navigate::succeeded GetQQBrowserRegExePath, hShellEcecute=0x%0x, bstrParam=(%ws), xrefs: 00007FF7FA9D428F
open, xrefs: 00007FF7FA9D426B
Headers, xrefs: 00007FF7FA9D4130
PostData, xrefs: 00007FF7FA9D4137
!!!CCustomInternetExplorer::Navigate::TargetFrameName=%p, PostData =%p, Headers=%p, xrefs: 00007FF7FA9D407B
TargetFrameName, xrefs: 00007FF7FA9D4151
--force-qb-trident-mode --url=, xrefs: 00007FF7FA9D4235

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: String_snwprintf_s$Free$AllocExecuteShell
String ID: !!!CCustomInternetExplorer::Navigate::TargetFrameName=%p, PostData =%p, Headers=%p$!!!CCustomInternetExplorer::Navigate::succeeded GetQQBrowserRegExePath, hShellEcecute=0x%0x, bstrParam=(%ws)$%s|%s|%s|CallIE(hr=0x%0x)$--force-qb-trident-mode --url=$Headers$Navigate$PostData$Refresh$ShellExecute(failed)=%d, CallIE=0x%0x$TargetFrameName$getqb(failed),callIE=0x%0x$open$success
API String ID: 1409506827-3779367281
Opcode ID: 1bd3418aa18722d502f0f989c2ef448bb372b33f642515aba0af826c2920730e
Instruction ID: 254d88c21731e666e03c3912f63a4ec6fb018f26a00afb8afcc24d456e93bf94
Opcode Fuzzy Hash: 1bd3418aa18722d502f0f989c2ef448bb372b33f642515aba0af826c2920730e
Instruction Fuzzy Hash: 7C32C732A08B8295FB10EF64E4442EDB7A4FB84798F900175DAAD97AD9CF3CD185C790

Function 00007FF7FA9D7144 Relevance: 33.7, APIs: 7, Strings: 12, Instructions: 425memoryCOMMON

Download Yara Rule

APIs

_snwprintf_s.LIBCMT ref: 00007FF7FA9D72E2
SysFreeString.OLEAUT32 ref: 00007FF7FA9D7399
SysAllocString.OLEAUT32 ref: 00007FF7FA9D73A6
ShellExecuteW.SHELL32 ref: 00007FF7FA9D73F0
_snwprintf_s.LIBCMT ref: 00007FF7FA9D74AE
SysFreeString.OLEAUT32 ref: 00007FF7FA9D75D9
_snwprintf_s.LIBCMT ref: 00007FF7FA9D7685

Strings

!!!CCustomInternetExplorer::Navigate2::TargetFrameName=%p PostData=%p, Headers=%p, Url=(%ws), xrefs: 00007FF7FA9D71BE
Navigate2, xrefs: 00007FF7FA9D7197
success, xrefs: 00007FF7FA9D7543
getqb(failed),callIE=0x%0x, xrefs: 00007FF7FA9D766E
open, xrefs: 00007FF7FA9D73D4
%s|%s|%s|CallIE(hr=0x%0x), xrefs: 00007FF7FA9D72C6
Headers, xrefs: 00007FF7FA9D7296
QueryStatusWB, xrefs: 00007FF7FA9D778E
PostData, xrefs: 00007FF7FA9D729D
ShellExecute(failed)=%d, CallIE=0x%0x, xrefs: 00007FF7FA9D7493
--force-qb-trident-mode --url=, xrefs: 00007FF7FA9D739F
TargetFrameName, xrefs: 00007FF7FA9D72B7

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: String_snwprintf_s$Free$AllocExecuteShell
String ID: !!!CCustomInternetExplorer::Navigate2::TargetFrameName=%p PostData=%p, Headers=%p, Url=(%ws)$%s|%s|%s|CallIE(hr=0x%0x)$--force-qb-trident-mode --url=$Headers$Navigate2$PostData$QueryStatusWB$ShellExecute(failed)=%d, CallIE=0x%0x$TargetFrameName$getqb(failed),callIE=0x%0x$open$success
API String ID: 1409506827-1244131776
Opcode ID: 94eb9b60d4815c93928bcf632506e6fd5ac0767ceb5879db2def2a593c99b36b
Instruction ID: e95d3a855745e386c5f6f31f8aabe735fb10f220b8173566ffafd7e69097c13b
Opcode Fuzzy Hash: 94eb9b60d4815c93928bcf632506e6fd5ac0767ceb5879db2def2a593c99b36b
Instruction Fuzzy Hash: E1126232A08A8295FB10EF64E4442EDB7B0FB84758F900175EAAD97AD5DF3CD185C7A0

Function 00007FF7FA9E0AAC Relevance: 28.4, APIs: 9, Strings: 7, Instructions: 445networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA9E2964: std::_Xbad_alloc.LIBCPMT ref: 00007FF7FA9E299D

std::exception::exception.LIBCMT ref: 00007FF7FA9E0F7D
_CxxThrowException.LIBCMT ref: 00007FF7FA9E0F98
std::exception::exception.LIBCMT ref: 00007FF7FA9E0FB9
_CxxThrowException.LIBCMT ref: 00007FF7FA9E0FD4
htonl.WS2_32 ref: 00007FF7FA9E102B
HttpOpenRequestW.WININET ref: 00007FF7FA9E108C
HttpSendRequestA.WININET ref: 00007FF7FA9E10BC
InternetCloseHandle.WININET ref: 00007FF7FA9E10C9
InternetCloseHandle.WININET ref: 00007FF7FA9E10D1

Strings

crypt, xrefs: 00007FF7FA9E0DC0
POST, xrefs: 00007FF7FA9E107E
stat, xrefs: 00007FF7FA9E0D79
HTTP/1.1, xrefs: 00007FF7FA9E1074
ServantName must not be empty, xrefs: 00007FF7FA9E0F68
FuncName must not be empty, xrefs: 00007FF7FA9E0FA4
qbpcstat, xrefs: 00007FF7FA9E0D2E

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: CloseExceptionHandleHttpInternetRequestThrowstd::exception::exception$OpenSendXbad_allochtonlstd::_
String ID: FuncName must not be empty$HTTP/1.1$POST$ServantName must not be empty$crypt$qbpcstat$stat
API String ID: 254083644-2247718545
Opcode ID: de6711ad864119869007c65ce8b63b81258a5e4cc7d5ab55e84a7347c8c6c515
Instruction ID: c13dd8e6f261e071cd54a9262da8cfc5d63b23d83858686c8c586e63a9a3e640
Opcode Fuzzy Hash: de6711ad864119869007c65ce8b63b81258a5e4cc7d5ab55e84a7347c8c6c515
Instruction Fuzzy Hash: E8229032608B8189FB20EF70D8806EC7775FB54788F904076DA6D57A9ADF38D554C7A0

Function 00007FF7FA9F3598 Relevance: 21.1, APIs: 14, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

__crtGetLocaleInfoA.LIBCMT ref: 00007FF7FA9F35F1

Part of subcall function 00007FF7FA9FE648: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF7FA9FE668
Part of subcall function 00007FF7FA9FE648: __crtGetLocaleInfoA_stat.LIBCMT ref: 00007FF7FA9FE686

GetLastError.KERNEL32 ref: 00007FF7FA9F35FD
__crtGetLocaleInfoA.LIBCMT ref: 00007FF7FA9F3619
__crtGetLocaleInfoA.LIBCMT ref: 00007FF7FA9F3650
_calloc_crt.LIBCMT ref: 00007FF7FA9F362C

Part of subcall function 00007FF7FA9F3320: _calloc_impl.LIBCMT ref: 00007FF7FA9F334E

_calloc_crt.LIBCMT ref: 00007FF7FA9F3667
free.LIBCMT ref: 00007FF7FA9F367F
free.LIBCMT ref: 00007FF7FA9F36CB
__crtGetLocaleInfoEx.LIBCMT ref: 00007FF7FA9F36EE
_calloc_crt.LIBCMT ref: 00007FF7FA9F3700
__crtGetLocaleInfoEx.LIBCMT ref: 00007FF7FA9F3718
free.LIBCMT ref: 00007FF7FA9F3724
__crtGetLocaleInfoEx.LIBCMT ref: 00007FF7FA9F374F
_invoke_watson.LIBCMT ref: 00007FF7FA9F3777

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Locale$Info__crt$_calloc_crtfree$A_statErrorLastUpdateUpdate::__calloc_impl_invoke_watson
String ID:
API String ID: 377212461-0
Opcode ID: e3bf062b5020bad119278e3234153a9c97d88ad087b0860666f44413645793e8
Instruction ID: 589ed10a2bf355678eb85740cf1216c329359e7251ecfb45d6f00a2cf0d29b46
Opcode Fuzzy Hash: e3bf062b5020bad119278e3234153a9c97d88ad087b0860666f44413645793e8
Instruction Fuzzy Hash: 3651D161B1824306FF65EA22581277BD2807F98BC4F845179DE3DDBBC6DE3CE40086A0

Function 00007FF7FA9ED748 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA9EDFE0: _wcsftime_l.LIBCMT ref: 00007FF7FA9EE002

CreateFileW.KERNEL32 ref: 00007FF7FA9ED7DE
DeviceIoControl.KERNEL32 ref: 00007FF7FA9ED835
malloc.LIBCMT ref: 00007FF7FA9ED848

Part of subcall function 00007FF7FA9EF3A8: _FF_MSGBANNER.LIBCMT ref: 00007FF7FA9EF3D8
Part of subcall function 00007FF7FA9EF3A8: _NMSG_WRITE.LIBCMT ref: 00007FF7FA9EF3E2
Part of subcall function 00007FF7FA9EF3A8: HeapAlloc.KERNEL32(?,?,?,00007FF7FA9F33D0,?,?,?,00007FF7FA9FDBE4,?,?,?,00007FF7FA9FDAE3,?,?,?,00007FF7FA9EF4C5), ref: 00007FF7FA9EF3FD
Part of subcall function 00007FF7FA9EF3A8: _callnewh.LIBCMT ref: 00007FF7FA9EF416
Part of subcall function 00007FF7FA9EF3A8: _errno.LIBCMT ref: 00007FF7FA9EF421
Part of subcall function 00007FF7FA9EF3A8: _errno.LIBCMT ref: 00007FF7FA9EF42C

DeviceIoControl.KERNEL32 ref: 00007FF7FA9ED890
free.LIBCMT ref: 00007FF7FA9ED958
CloseHandle.KERNEL32 ref: 00007FF7FA9ED960

Strings

., xrefs: 00007FF7FA9ED8AB
\\.\PhysicalDrive%d, xrefs: 00007FF7FA9ED7A3

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ControlDevice_errno$AllocCloseCreateFileHandleHeap_callnewh_wcsftime_lfreemalloc
String ID: .$\\.\PhysicalDrive%d
API String ID: 3652198919-636426351
Opcode ID: 2cb9f29a0383857dff898a6d44bd58ec0e7d864761fd42d99c1947b355f38110
Instruction ID: 3641343af4817cf7774b0a7fa36cafa3f883571db05b91ce24343cff6e35bc7a
Opcode Fuzzy Hash: 2cb9f29a0383857dff898a6d44bd58ec0e7d864761fd42d99c1947b355f38110
Instruction Fuzzy Hash: C851D13270C64286FB20EB61E8947AAA3A0FB95794F800134DE6D87AD6DF3CD545CB61

Function 00007FF7FA9DEFA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103comthreadsleepCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9DEFFB
PostThreadMessageW.USER32 ref: 00007FF7FA9DF00E
Sleep.KERNEL32 ref: 00007FF7FA9DF018
ShellExecuteW.SHELL32 ref: 00007FF7FA9DF0A6
CoCreateInstance.OLE32 ref: 00007FF7FA9DF0F1
CoCreateInstance.OLE32 ref: 00007FF7FA9DF128

Strings

open, xrefs: 00007FF7FA9DF09D
-Embedding, xrefs: 00007FF7FA9DF064

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: CreateInstanceThread$CurrentExecuteMessagePostShellSleep
String ID: -Embedding$open
API String ID: 4109628772-2736633392
Opcode ID: fd2df4d1919a09f22f9c63018b7fd7111f9de143657e3ef7dbf67d501e261332
Instruction ID: 0da52f2a22dc63c2f1d45c6343732fa771f0a4b05df979adef3af1fdb48dadb3
Opcode Fuzzy Hash: fd2df4d1919a09f22f9c63018b7fd7111f9de143657e3ef7dbf67d501e261332
Instruction Fuzzy Hash: 53519431A0C64291F710EF20E8846A9E7A0FF84754FC04175D9AD97AE4DF3CE49AC7A0

Function 00007FF7FA9DEA00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 00007FF7FA9DEA67
SysAllocString.OLEAUT32 ref: 00007FF7FA9DEA74

Strings

FindBrowserByIndex, xrefs: 00007FF7FA9DEBBB
NavigateHack, xrefs: 00007FF7FA9DEAA1

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: String$AllocFree
String ID: FindBrowserByIndex$NavigateHack
API String ID: 344208780-3607754153
Opcode ID: de8f1f9ed67bc6513ebae345c0a51becab5b6116b3a1311c571633cf55c53bdc
Instruction ID: 2688c988eabf5c5749011a6853e60d2743cf4af9e10fc8bcedd5ca5b7aa6b175
Opcode Fuzzy Hash: de8f1f9ed67bc6513ebae345c0a51becab5b6116b3a1311c571633cf55c53bdc
Instruction Fuzzy Hash: 73716E32A18A4299FB10EB60D4943AC73A0FB5478CF800475EA5D87ADADF7CD195C7A0

Function 00007FF7FA9EECDC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7FA9EED3D
IsDebuggerPresent.KERNEL32 ref: 00007FF7FA9EED55
OutputDebugStringW.KERNEL32 ref: 00007FF7FA9EED66

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7FA9EED5F

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: f676bf00bd45b925f24ae54672d027915a33156fdb6a16f405138c6fe5cc32f1
Instruction ID: f44cf3206a63b6552aa79ff0b13e79f2af548cda40c6e2239929c848b49d1299
Opcode Fuzzy Hash: f676bf00bd45b925f24ae54672d027915a33156fdb6a16f405138c6fe5cc32f1
Instruction Fuzzy Hash: 1B116D32A08B42A7F704EB26D944779B2A0FF18755F804175C66D82991DF7CE0B9C7A0

Function 00007FF7FA9E29E4 Relevance: 5.2, Strings: 3, Instructions: 1477COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF7FA9E2BE7
gfffffff, xrefs: 00007FF7FA9E3538
gfffffff, xrefs: 00007FF7FA9E2B2F

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: htonl$ExceptionThrowstd::exception::exception
String ID: gfffffff$gfffffff$gfffffff
API String ID: 1194782181-2968619780
Opcode ID: 7f4e2fb3dc5b2d2fb114832c0c81eb9e0488da7db746ea189fc7acc70b9d317e
Instruction ID: 32ba44d04c370349c86e6e83213b1adc1d86f86e40778208370867b0d7198b12
Opcode Fuzzy Hash: 7f4e2fb3dc5b2d2fb114832c0c81eb9e0488da7db746ea189fc7acc70b9d317e
Instruction Fuzzy Hash: 99C2D25661C1C186EF04EB3196D11FD6762EB56BD4B806070EA6D4BB8BCF2CE802D772

Function 00007FF7FA9E8C4C Relevance: 3.0, APIs: 2, Instructions: 24fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 00007FF7FA9E8C76
FindClose.KERNEL32 ref: 00007FF7FA9E8C8B

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8a02239767a8b36154e632c7aba0e0c2fca487b9197e97b71514e1963a2b26dd
Instruction ID: 294671d2c5d8d6a1fa9fd2104c327a0fcea1ea8c7bc4145d6c7238ebeb13fd36
Opcode Fuzzy Hash: 8a02239767a8b36154e632c7aba0e0c2fca487b9197e97b71514e1963a2b26dd
Instruction Fuzzy Hash: D4F08226A0E54181FF90EB70E4993797360BF66774F904772C97D872E1DE2CA04E96B0

Function 00007FF7FA9FE900 Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,?,00007FF7FAA00EAB,?,?,00000140,00007FF7FAA0157B), ref: 00007FF7FA9FE931

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 73643b16058b4c7c9c70b5fc0a0d8582263b454781c721b842577a58b24a1dfe
Instruction ID: 81fa10730557c7a0491017eb67c2d26bd5690775a6705d6371cc3cd7e2857a5b
Opcode Fuzzy Hash: 73643b16058b4c7c9c70b5fc0a0d8582263b454781c721b842577a58b24a1dfe
Instruction Fuzzy Hash: 04E0E625E18643D6F754BB11FC81B6066D0AF59304FD040B2C42C57AE4CD6CA5AE87B5

Function 00007FF7FA9EE1E8 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37785044067b7a1469bff97e43a5488a276ebc2d2d122b53df96d93c8cdea13
Instruction ID: fb961941f885db116e4793e91d9940e1253c0d1938155503b1f365a1cf196405
Opcode Fuzzy Hash: a37785044067b7a1469bff97e43a5488a276ebc2d2d122b53df96d93c8cdea13
Instruction Fuzzy Hash: 982283B7F345204BE31DCB69EC52FA836A2B75434C749A02CEA17D3F44EA3DEA158644

Function 00007FF7FA9E7670 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a2dbce7e390b63f7df38598765106d3b12782b4211c6c1c5caf7da0a4464e1
Instruction ID: 79c4e4371cb59b3b72038e46d0884a43a838d01e6863a418b98684ddbd2360a6
Opcode Fuzzy Hash: e0a2dbce7e390b63f7df38598765106d3b12782b4211c6c1c5caf7da0a4464e1
Instruction Fuzzy Hash: 4E5123737349184BA319CE39EA16A5A3391F3D934C748E124EF46E7B45EA3DE902C381

Function 00007FF7FAA04B5C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

_validdrive.LIBCMT ref: 00007FF7FAA04B95

Part of subcall function 00007FF7FAA086B4: __doserrno.LIBCMT ref: 00007FF7FAA086CE
Part of subcall function 00007FF7FAA086B4: _errno.LIBCMT ref: 00007FF7FAA086D9
Part of subcall function 00007FF7FAA086B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FAA086E4

_errno.LIBCMT ref: 00007FF7FAA04C32
_errno.LIBCMT ref: 00007FF7FAA04BA9

Part of subcall function 00007FF7FA9F2964: _getptd_noexit.LIBCMT ref: 00007FF7FA9F2968

__doserrno.LIBCMT ref: 00007FF7FAA04B9E

Part of subcall function 00007FF7FA9F28F4: _getptd_noexit.LIBCMT ref: 00007FF7FA9F28F8

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FAA04BB4
_getdrive.LIBCMT ref: 00007FF7FAA04BBE
_errno.LIBCMT ref: 00007FF7FAA04BCE
GetFullPathNameW.KERNEL32 ref: 00007FF7FAA04C1A

Strings

:, xrefs: 00007FF7FAA04BEE
., xrefs: 00007FF7FAA04C03

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: _errno$__doserrno_getptd_noexit_invalid_parameter_noinfo$FullNamePath_getdrive_validdrive
String ID: .$:
API String ID: 3206601966-4202072812
Opcode ID: c278636a75acf6b6aa7e52600644b43fcd6dd163b020e58cd30286ffe6d5198d
Instruction ID: e482c0fc9aa4d8cf57932ac13c6d132658411a175e43fcc4c7f0e888dbe32f8a
Opcode Fuzzy Hash: c278636a75acf6b6aa7e52600644b43fcd6dd163b020e58cd30286ffe6d5198d
Instruction Fuzzy Hash: 2B317462A0C64353FB62BF719440B7DE690BF84744FC580B5DA6D872C2EE3CE84686B1

Function 00007FF7FA9D2C9C Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 338memorythreadCOMMON

Download Yara Rule

APIs

StringFromGUID2.OLE32 ref: 00007FF7FA9D2CE7
SysAllocString.OLEAUT32 ref: 00007FF7FA9D2CF1
StringFromGUID2.OLE32 ref: 00007FF7FA9D31C7
SysAllocString.OLEAUT32 ref: 00007FF7FA9D31D1
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D2D0E

Part of subcall function 00007FF7FA9D130C: _CxxThrowException.LIBCMT ref: 00007FF7FA9D1320

SysFreeString.OLEAUT32 ref: 00007FF7FA9D3200
SysFreeString.OLEAUT32 ref: 00007FF7FA9D320F

Strings

!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws) not supported, xrefs: 00007FF7FA9D31ED
!!!CreateIEWebBrowser2() in QueryInterface(%ws) got 0x%0x, xrefs: 00007FF7FA9D2E9C
!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws) not supported, m_pIEWebBrowser2=%p, xrefs: 00007FF7FA9D3036
!!!IEWebBrowser for QueryInterface(%ws) got 0x%0x, xrefs: 00007FF7FA9D2ECC
!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws) should pass(%ws), xrefs: 00007FF7FA9D2D5A
!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws), threadid=%d, xrefs: 00007FF7FA9D2D1A

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: String$AllocFreeFrom$CurrentExceptionThreadThrow
String ID: !!!CreateIEWebBrowser2() in QueryInterface(%ws) got 0x%0x$!!!IEWebBrowser for QueryInterface(%ws) got 0x%0x$!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws) not supported$!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws) not supported, m_pIEWebBrowser2=%p$!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws) should pass(%ws)$!!!enter CCustomInternetExplorer::QueryInterface::IID(%ws), threadid=%d
API String ID: 2093652262-2840267380
Opcode ID: cad24af98e3b99c65bb915084164526389ec252c12579296056ed3c6e499cd0d
Instruction ID: 22204b4a5859e0bdc5f82c200701be0a8fd111e1e0f2ce17dd560545671a39a2
Opcode Fuzzy Hash: cad24af98e3b99c65bb915084164526389ec252c12579296056ed3c6e499cd0d
Instruction Fuzzy Hash: 3A021022A08A4681FB60EF25D484679E361EF44B94FC454B5DAAD877E4CF7CE885C3B0

Function 00007FF7FA9DF4D8 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF4FB
GetLastError.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF50B
OpenProcess.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF520
GetModuleHandleW.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF548
GetProcAddress.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF558
LoadLibraryW.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF571
GetProcAddress.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF586
CloseHandle.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF5B4

Strings

GetProcessImageFileNameW, xrefs: 00007FF7FA9DF57C
K32GetProcessImageFileNameW, xrefs: 00007FF7FA9DF54E
kernel32, xrefs: 00007FF7FA9DF541
psapi.dll, xrefs: 00007FF7FA9DF56A

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: AddressHandleOpenProcProcess$CloseErrorLastLibraryLoadModule
String ID: GetProcessImageFileNameW$K32GetProcessImageFileNameW$kernel32$psapi.dll
API String ID: 1640075399-1140887699
Opcode ID: aa82de994624b4998622f923e83a535e56021346db82b491f78cc213d6dde9bb
Instruction ID: b9f3f07086169e937192ce81e8d225503b33e8e4591946a90a04012933c25270
Opcode Fuzzy Hash: aa82de994624b4998622f923e83a535e56021346db82b491f78cc213d6dde9bb
Instruction Fuzzy Hash: F7214624B0DB0351FB54EF15A944535A291AF48B90FC48478C96E837D8EF2CE45EC7B0

Function 00007FF7FA9DF3D0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68threadlibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF402
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF41E
OpenThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF44C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF45A
OpenThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF46F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF4A7

Strings

NtQueryInformationThread, xrefs: 00007FF7FA9DF414
ntdll.dll, xrefs: 00007FF7FA9DF3FB

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: HandleOpenThread$AddressCloseErrorLastModuleProc
String ID: NtQueryInformationThread$ntdll.dll
API String ID: 2925828140-2698099043
Opcode ID: b15917006222226be9306d18a042d1e7103124e091ac296d0882ca0ad3a46121
Instruction ID: 445590c471d8fcf62476f778a35a0dadc8daae9a2aa89c6a355720dab8224cc5
Opcode Fuzzy Hash: b15917006222226be9306d18a042d1e7103124e091ac296d0882ca0ad3a46121
Instruction Fuzzy Hash: 7721A731B18B0142FB40EF25A444569A3A5FF88B80FC48075D99D83798EF3CE44ACBA0

Function 00007FF7FA9DF79C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 90registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA9DF2D8: GetModuleHandleW.KERNEL32 ref: 00007FF7FA9DF318
Part of subcall function 00007FF7FA9DF2D8: GetProcAddress.KERNEL32 ref: 00007FF7FA9DF32D
Part of subcall function 00007FF7FA9DF2D8: RegCloseKey.ADVAPI32 ref: 00007FF7FA9DF39B

RegQueryValueExW.ADVAPI32 ref: 00007FF7FA9DF880
PathFileExistsW.SHLWAPI ref: 00007FF7FA9DF8E2
RegCloseKey.ADVAPI32 ref: 00007FF7FA9DF8FA

Strings

InstallDir, xrefs: 00007FF7FA9DF874
Software\Tencent\QQBrowser, xrefs: 00007FF7FA9DF7FD
Software\Wow6432Node\Tencent\QQBrowser, xrefs: 00007FF7FA9DF81A
QQBrowser.exe, xrefs: 00007FF7FA9DF8C6

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Close$AddressExistsFileHandleModulePathProcQueryValue
String ID: InstallDir$QQBrowser.exe$Software\Tencent\QQBrowser$Software\Wow6432Node\Tencent\QQBrowser
API String ID: 3970199010-1871758474
Opcode ID: a4d2b91cced5d2252ad5ecd6bf6790e37562157be7f73dccbdb02d7fce924ec1
Instruction ID: fa4731c4d7a82e3ff11c359edd81b3e9e35f5057dbc69f2f6ce5a547542113e7
Opcode Fuzzy Hash: a4d2b91cced5d2252ad5ecd6bf6790e37562157be7f73dccbdb02d7fce924ec1
Instruction Fuzzy Hash: 1C41A432A08B4191F710EF21E8451AAB364FB857A0F904275DABD937D8DF3CD445C7A0

Function 00007FF7FA9EB5F4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FA9EB615

Part of subcall function 00007FF7FAA0A1C0: _lock.LIBCMT ref: 00007FF7FAA0A1D2

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FA9EB63A
numpunct.LIBCPMT ref: 00007FF7FA9EB6BD
std::bad_exception::bad_exception.LIBCMT ref: 00007FF7FA9EB6D4
_CxxThrowException.LIBCMT ref: 00007FF7FA9EB6E5
std::_Facet_Register.LIBCPMT ref: 00007FF7FA9EB703

Strings

bad cast, xrefs: 00007FF7FA9EB6C8

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_locknumpunctstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 4068408745-3145022300
Opcode ID: b59a08d1540ec987e1887726f7663786dbea4613d7ad03c91e53d418083ca5fc
Instruction ID: 1bd7519fb481ca85b6b6adfe248597cf310be5005425b7da993a938aac7944c4
Opcode Fuzzy Hash: b59a08d1540ec987e1887726f7663786dbea4613d7ad03c91e53d418083ca5fc
Instruction Fuzzy Hash: 7E318A21A0CA0291FF11FB25E4804B9A361EB54BA4F9442B2D67D537E5DE3CE85AC7B0

Function 00007FF7FA9EAE24 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FA9EAE45

Part of subcall function 00007FF7FAA0A1C0: _lock.LIBCMT ref: 00007FF7FAA0A1D2

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FA9EAE6A
messages.LIBCPMT ref: 00007FF7FA9EAEED
std::bad_exception::bad_exception.LIBCMT ref: 00007FF7FA9EAF04
_CxxThrowException.LIBCMT ref: 00007FF7FA9EAF15
std::_Facet_Register.LIBCPMT ref: 00007FF7FA9EAF33

Strings

bad cast, xrefs: 00007FF7FA9EAEF8

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockmessagesstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 620047600-3145022300
Opcode ID: 6fa198d8182d60241d03b708863fe7a84b2709087642af159d215598ae70a9eb
Instruction ID: 0fd068b9a639144ee870885547873b6b868c6ccbe6905d15811303133e2c623b
Opcode Fuzzy Hash: 6fa198d8182d60241d03b708863fe7a84b2709087642af159d215598ae70a9eb
Instruction Fuzzy Hash: 3C315321A1DA0281FB10EB25E4904B9A361EB947A0FD442B5D67D536E6DF3CE44AC7B0

Function 00007FF7FA9EBE10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FA9EBE31

Part of subcall function 00007FF7FAA0A1C0: _lock.LIBCMT ref: 00007FF7FAA0A1D2

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7FA9EBE56
ctype.LIBCPMT ref: 00007FF7FA9EBED9
std::bad_exception::bad_exception.LIBCMT ref: 00007FF7FA9EBEF0
_CxxThrowException.LIBCMT ref: 00007FF7FA9EBF01
std::_Facet_Register.LIBCPMT ref: 00007FF7FA9EBF1F

Strings

bad cast, xrefs: 00007FF7FA9EBEE4

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockctypestd::bad_exception::bad_exception
String ID: bad cast
API String ID: 3320480354-3145022300
Opcode ID: 1e214aa9f60b7bf54ab17ca2b64ecbdf3207e7ccc1a0268482592e6b885839f2
Instruction ID: 57998e67dc2b3af8b092685e3eedbb54faeb708573f47d24c2fec85189b79d1b
Opcode Fuzzy Hash: 1e214aa9f60b7bf54ab17ca2b64ecbdf3207e7ccc1a0268482592e6b885839f2
Instruction Fuzzy Hash: 04318A21A0CB0281FB11FB25E4804B9E361EF947A0FD482B1D67D537E6DE3CE44A87A1

Function 00007FF7FA9F9637 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__DestructExceptionObject.LIBCMT ref: 00007FF7FA9F9662
RaiseException.KERNEL32 ref: 00007FF7FA9F968B
__DestructExceptionObject.LIBCMT ref: 00007FF7FA9F96EC
_getptd.LIBCMT ref: 00007FF7FA9F963F

Part of subcall function 00007FF7FA9F48AC: _getptd_noexit.LIBCMT ref: 00007FF7FA9F48B2

_getptd.LIBCMT ref: 00007FF7FA9F96F1
_getptd.LIBCMT ref: 00007FF7FA9F96FD

Strings

csm, xrefs: 00007FF7FA9F96BF

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_getptd_noexit
String ID: csm
API String ID: 2851507484-1018135373
Opcode ID: f63c31c8744fcde41ace1429d150bb829a6fb854e99d4356c7669e496792e9cb
Instruction ID: 968e8191cacf54acca11cb1a713746aca3dcf0cd37b9af7a324248ccec79b506
Opcode Fuzzy Hash: f63c31c8744fcde41ace1429d150bb829a6fb854e99d4356c7669e496792e9cb
Instruction Fuzzy Hash: 35213A3660868282EB30EB15E04026EB760FB85BA4F854275DEBD477D5DF3CE485CB50

Function 00007FF7FA9F5478 Relevance: 12.2, APIs: 8, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc_crt.LIBCMT ref: 00007FF7FA9F54A1

Part of subcall function 00007FF7FA9F33A0: malloc.LIBCMT ref: 00007FF7FA9F33CB
Part of subcall function 00007FF7FA9F33A0: Sleep.KERNEL32(?,?,?,00007FF7FA9FDBE4,?,?,?,00007FF7FA9FDAE3,?,?,?,00007FF7FA9EF4C5,?,?,?,00007FF7FA9EF5B9), ref: 00007FF7FA9F33DE

free.LIBCMT ref: 00007FF7FA9F55A2
free.LIBCMT ref: 00007FF7FA9F55BE

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: free$Sleep_malloc_crtmalloc
String ID:
API String ID: 2523592665-0
Opcode ID: ffe51e098a28f5bc81262543e1a2495965659b64c93bc8964f93e359b729555d
Instruction ID: dfd6ed434ac0b8bbf05e1c109336d45e7afd71450a147147c833022a122ac179
Opcode Fuzzy Hash: ffe51e098a28f5bc81262543e1a2495965659b64c93bc8964f93e359b729555d
Instruction Fuzzy Hash: 6261D636708B4292FB24EB12E940669B3A4FB84B94F844175DE7C87B91DF3CE465C790

Function 00007FF7FA9D15C4 Relevance: 10.7, APIs: 7, Instructions: 155threadmemorywindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D160C
PostThreadMessageW.USER32 ref: 00007FF7FA9D1620

Part of subcall function 00007FF7FA9D1348: InitializeCriticalSection.KERNEL32 ref: 00007FF7FA9D138D
Part of subcall function 00007FF7FA9D1348: EnterCriticalSection.KERNEL32 ref: 00007FF7FA9D13B5
Part of subcall function 00007FF7FA9D1348: LeaveCriticalSection.KERNEL32 ref: 00007FF7FA9D1401

CoRevokeClassObject.OLE32 ref: 00007FF7FA9D1656
CoRevokeClassObject.OLE32 ref: 00007FF7FA9D1667
StringFromGUID2.OLE32 ref: 00007FF7FA9D167E
SysAllocString.OLEAUT32 ref: 00007FF7FA9D1688
SysFreeString.OLEAUT32 ref: 00007FF7FA9D17E5

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: CriticalSectionString$ClassObjectRevokeThread$AllocCurrentEnterFreeFromInitializeLeaveMessagePost
String ID:
API String ID: 1381646855-0
Opcode ID: a029d25510344f831e2ec24893b9987acfd9a486f14a21de3c8d25aeeaf843b1
Instruction ID: a2e24e48c6002f0efb9e675c3615680ba8b8e31456f82f9745b1e150c8d0bfe0
Opcode Fuzzy Hash: a029d25510344f831e2ec24893b9987acfd9a486f14a21de3c8d25aeeaf843b1
Instruction Fuzzy Hash: D461D232A0878286F700EB61E84466DB3B4FF81754FA00175DAAD87BE5DF38E491C7A0

Function 00007FF7FA9EFBE8 Relevance: 10.6, APIs: 7, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA9EFC13
_errno.LIBCMT ref: 00007FF7FA9EFC08

Part of subcall function 00007FF7FA9F2964: _getptd_noexit.LIBCMT ref: 00007FF7FA9F2968

_errno.LIBCMT ref: 00007FF7FA9EFCB6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA9EFCC1

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 36164a5b92ab75e8b9d0270866404d9543f1fa6deae194a1da3a023a4b3b9817
Instruction ID: 83421288a6986b8a7689a7dc73a1d3e7dc09582b22483bbc794168c9ee1a6b09
Opcode Fuzzy Hash: 36164a5b92ab75e8b9d0270866404d9543f1fa6deae194a1da3a023a4b3b9817
Instruction Fuzzy Hash: A141E262E0C69781FB64FB1195801B9B6D0EB60B94FD440B7DAA8C76C6DB2CE581C3B1

Function 00007FF7FA9E8128 Relevance: 10.6, APIs: 7, Instructions: 113fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA9E8434: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF7FA9E84BF

CreateFileW.KERNEL32 ref: 00007FF7FA9E8197
CreateFileW.KERNEL32 ref: 00007FF7FA9E8237

Part of subcall function 00007FF7FA9E8C4C: FindClose.KERNEL32 ref: 00007FF7FA9E8C8B

CopyFileW.KERNEL32 ref: 00007FF7FA9E81EF
DeleteFileW.KERNEL32 ref: 00007FF7FA9E8207
GetFileSize.KERNEL32 ref: 00007FF7FA9E826B
ReadFile.KERNEL32 ref: 00007FF7FA9E828E
CloseHandle.KERNEL32 ref: 00007FF7FA9E82A6

Part of subcall function 00007FF7FA9E8C4C: FindFirstFileW.KERNEL32 ref: 00007FF7FA9E8C76

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: File$CloseCreateFind$CopyDeleteFirstFolderHandlePathReadSizeSpecial
String ID:
API String ID: 2284925675-0
Opcode ID: e2c09bcf50226816ff0f6ef4bf8d80569a357a0aade116ce0efe607448ec2109
Instruction ID: fb998ac5ab12a1d402d2ef503c92a6c1426e75c61b01c343522c65b5ea0a3dcb
Opcode Fuzzy Hash: e2c09bcf50226816ff0f6ef4bf8d80569a357a0aade116ce0efe607448ec2109
Instruction Fuzzy Hash: FE51D632B08A41DAF710EF71D4942ACA361FB54798FC08275D92D83AD9DF38D519C7A0

Function 00007FF7FA9EF76C Relevance: 10.6, APIs: 7, Instructions: 107COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA9EF792
_errno.LIBCMT ref: 00007FF7FA9EF787

Part of subcall function 00007FF7FA9F2964: _getptd_noexit.LIBCMT ref: 00007FF7FA9F2968

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF7FA9EF811
_errno.LIBCMT ref: 00007FF7FA9EF822
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FA9EF82D

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 114d716205cd9dd7d1c115ba21ab42b81c090a2b93a5ee04d70adfc3818b5fa7
Instruction ID: 30d10873438b6b54064a52a07182f2668eba7e904ff6dc57fbeba68169c60ed6
Opcode Fuzzy Hash: 114d716205cd9dd7d1c115ba21ab42b81c090a2b93a5ee04d70adfc3818b5fa7
Instruction Fuzzy Hash: 5C411922E0C69381FB64FB1194801B9B2A0EB60BA0FD44077D6FD8B6C6DE2DD951C771

Function 00007FF7FAA090A4 Relevance: 10.6, APIs: 7, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF7FAA090D8

Part of subcall function 00007FF7FA9EF6C4: _getptd.LIBCMT ref: 00007FF7FA9EF6DA
Part of subcall function 00007FF7FA9EF6C4: __updatetlocinfo.LIBCMT ref: 00007FF7FA9EF70F
Part of subcall function 00007FF7FA9EF6C4: __updatetmbcinfo.LIBCMT ref: 00007FF7FA9EF736

_errno.LIBCMT ref: 00007FF7FAA090F3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FAA090FE

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 5afd3457c7a2ea1a5f02dee57da20931110c2d528eea28ea6e04efb072b26444
Instruction ID: 43220b01de24a8b8b4a86dfdbb48492ec6ec3a17546b73b84542cb6f7f191c68
Opcode Fuzzy Hash: 5afd3457c7a2ea1a5f02dee57da20931110c2d528eea28ea6e04efb072b26444
Instruction Fuzzy Hash: 9A31B135B0874686F760AF21D484A69F7A0EB54BE0F948171EA79437C5CF38D846C7A0

Function 00007FF7FA9DF2D8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7FA9DF318
GetProcAddress.KERNEL32 ref: 00007FF7FA9DF32D
RegOpenKeyExW.ADVAPI32 ref: 00007FF7FA9DF389
RegCloseKey.ADVAPI32 ref: 00007FF7FA9DF39B

Strings

Advapi32.dll, xrefs: 00007FF7FA9DF311
RegOpenKeyTransactedW, xrefs: 00007FF7FA9DF323

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 46beea28c6eae07af4a728249fe307b16fa5c9b9b6675718f3559790d5a38139
Instruction ID: a72b2611121ef83fbee8627987dbb7f9d05d9a0c4ab4bf90e2efb498edee7f58
Opcode Fuzzy Hash: 46beea28c6eae07af4a728249fe307b16fa5c9b9b6675718f3559790d5a38139
Instruction Fuzzy Hash: FA21AC32608A8182FB64EF21E455739E2A0FB44BC8F948175DA9D876C4DF3CD495C760

Function 00007FF7FA9D142C Relevance: 10.6, APIs: 7, Instructions: 62timethreadwindowCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7FA9D1462

Part of subcall function 00007FF7FA9EF368: HeapFree.KERNEL32(?,?,00000000,00007FF7FA9F493A,?,?,?,00007FF7FA9F296D,?,?,?,?,00007FF7FA9EF446), ref: 00007FF7FA9EF37E
Part of subcall function 00007FF7FA9EF368: _errno.LIBCMT ref: 00007FF7FA9EF388
Part of subcall function 00007FF7FA9EF368: GetLastError.KERNEL32(?,?,00000000,00007FF7FA9F493A,?,?,?,00007FF7FA9F296D,?,?,?,?,00007FF7FA9EF446), ref: 00007FF7FA9EF390

CreateWaitableTimerW.KERNEL32 ref: 00007FF7FA9D148C
GetLastError.KERNEL32 ref: 00007FF7FA9D149A
SetWaitableTimer.KERNEL32 ref: 00007FF7FA9D14C7
WaitForMultipleObjects.KERNEL32 ref: 00007FF7FA9D14E1
GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D14F7
PostThreadMessageW.USER32 ref: 00007FF7FA9D150C

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ErrorLastThreadTimerWaitable$CreateCurrentFreeHeapMessageMultipleObjectsPostWait_errnofree
String ID:
API String ID: 2911511307-0
Opcode ID: 689c32a63b2e1eb818ab7082173d63fae4e2e3531b0e754b93d29fbe0c040a1d
Instruction ID: 5af0e112d5ed71a199c2a38ea97a571451ef9a74989f807d9dbdb180618c200a
Opcode Fuzzy Hash: 689c32a63b2e1eb818ab7082173d63fae4e2e3531b0e754b93d29fbe0c040a1d
Instruction Fuzzy Hash: 9221D432A18B8283F754DF24E05572AF3A0FF89754FA05234E69E42A94DF2CE084CB50

Function 00007FF7FA9EC324 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 50COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBCMT ref: 00007FF7FA9EC36D
_CxxThrowException.LIBCMT ref: 00007FF7FA9EC395
_CxxThrowException.LIBCMT ref: 00007FF7FA9EC3B2
_CxxThrowException.LIBCMT ref: 00007FF7FA9EC3CF

Strings

ios_base::eofbit set, xrefs: 00007FF7FA9EC3B8
ios_base::badbit set, xrefs: 00007FF7FA9EC37A
ios_base::failbit set, xrefs: 00007FF7FA9EC39B

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 093aac91aca3d5cb444e93d4d42d2825fe212e2d82f146a169df17e4c3784bdb
Instruction ID: c6a46a2500c752ab67bb1ff6c5b3dc723c14c150e2cb2e88dba6784c613939a9
Opcode Fuzzy Hash: 093aac91aca3d5cb444e93d4d42d2825fe212e2d82f146a169df17e4c3784bdb
Instruction Fuzzy Hash: 78119061E0C607A4FF14FB24D8814ECA364AF50308FD01075D53D969E6EE2CE94AC7E1

Function 00007FF7FA9F9734 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7FA9F9755
_getptd.LIBCMT ref: 00007FF7FA9F9763
_getptd.LIBCMT ref: 00007FF7FA9F9775

Strings

MOC, xrefs: 00007FF7FA9F9743
csm, xrefs: 00007FF7FA9F974B
RCC, xrefs: 00007FF7FA9F973B

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 5c374d830ee814f54b2f9fa3c3e92b96ec2efda21db6e13fed2e5b8fabcddbb5
Instruction ID: 22238c6bcb2ba06af371aaf0ab989ee280466f8362c385344c36e0bd42547f45
Opcode Fuzzy Hash: 5c374d830ee814f54b2f9fa3c3e92b96ec2efda21db6e13fed2e5b8fabcddbb5
Instruction Fuzzy Hash: B2F0F83990824796F755BB5081453BC62A0AF98715FD684B1C63C862C6DBAD68848AB2

Function 00007FF7FA9D2900 Relevance: 9.1, APIs: 6, Instructions: 119memoryCOMMON

Download Yara Rule

APIs

SysStringLen.OLEAUT32 ref: 00007FF7FA9D295B
SysAllocStringLen.OLEAUT32 ref: 00007FF7FA9D2995
SysStringLen.OLEAUT32 ref: 00007FF7FA9D29B0
memcpy_s.LIBCMT ref: 00007FF7FA9D29C6
memcpy_s.LIBCMT ref: 00007FF7FA9D29F7
SysFreeString.OLEAUT32 ref: 00007FF7FA9D2A1C

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: String$memcpy_s$AllocFree
String ID:
API String ID: 3865269606-0
Opcode ID: e22d06bfb5369b301686315787000ad3005f2f7fca881707cd04031463c0dc54
Instruction ID: e9aa822dfd3ee964cdb29d7ccb9bad530f4be418e96cffaf06d87f213363c06f
Opcode Fuzzy Hash: e22d06bfb5369b301686315787000ad3005f2f7fca881707cd04031463c0dc54
Instruction Fuzzy Hash: B1411835B0864381FB28FB55555C13CD290EF44B94FA442B6DABDCBBE1CE2CE4D182A1

Function 00007FF7FA9EB400 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

localeconv.LIBCMT ref: 00007FF7FA9EB426

Part of subcall function 00007FF7FA9F1C30: _getptd.LIBCMT ref: 00007FF7FA9F1C34
Part of subcall function 00007FF7FA9F1C30: __updatetlocinfo.LIBCMT ref: 00007FF7FA9F1C57

_Getcvt.LIBCPMT ref: 00007FF7FA9EB433

Part of subcall function 00007FF7FAA0A568: ___lc_codepage_func.LIBCMT ref: 00007FF7FAA0A58C
Part of subcall function 00007FF7FAA0A568: ___mb_cur_max_func.LIBCMT ref: 00007FF7FAA0A593
Part of subcall function 00007FF7FAA0A568: ___lc_locale_name_func.LIBCMT ref: 00007FF7FAA0A59B

_Getcvt.LIBCPMT ref: 00007FF7FA9EB45C

Strings

false, xrefs: 00007FF7FA9EB495
true, xrefs: 00007FF7FA9EB4BF

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Getcvt$___lc_codepage_func___lc_locale_name_func___mb_cur_max_func__updatetlocinfo_getptdlocaleconv
String ID: false$true
API String ID: 379465546-2658103896
Opcode ID: c770085aa06cf17b6387c8f837feb050c9cc296f023650f2e6eb596c1cc5e8d8
Instruction ID: ebb4a9833f2bb1f82f9cd2c90b1bd4bebd41a123c911c5012a0bb2c82f6157d8
Opcode Fuzzy Hash: c770085aa06cf17b6387c8f837feb050c9cc296f023650f2e6eb596c1cc5e8d8
Instruction Fuzzy Hash: B631C522609B8542F7129B25D64036DABA0EB64BF4F5583B5CEBC073E6DE38D856C3D0

Function 00007FF7FA9DF69C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00007FF7FA9DF6E2
PathAppendW.SHLWAPI ref: 00007FF7FA9DF6FE
GetFileVersionInfoW.VERSION ref: 00007FF7FA9DF72F
VerQueryValueW.VERSION ref: 00007FF7FA9DF758

Strings

\Internet Explorer\iexplore.exe, xrefs: 00007FF7FA9DF6F0

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Path$AppendFileFolderInfoQuerySpecialValueVersion
String ID: \Internet Explorer\iexplore.exe
API String ID: 3320195616-38705447
Opcode ID: 84e7ca486809708aacdf764988d78f65cf761cafb01ba4910b894d15dae9b407
Instruction ID: bb3d4499f83a4dea29f9369116578bc91c8fbbc3408754ab6a242da6c47d1e4e
Opcode Fuzzy Hash: 84e7ca486809708aacdf764988d78f65cf761cafb01ba4910b894d15dae9b407
Instruction Fuzzy Hash: 7A218221618A4795F720DF21E844AFAA3A0FF48748FC44075D65D875E8EF3DD249CBA0

Function 00007FF7FAA0417C Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF7FAA041A0

Part of subcall function 00007FF7FAA04080: _errno.LIBCMT ref: 00007FF7FAA04089
Part of subcall function 00007FF7FAA04080: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7FAA04094

cvtdate.LIBCMT ref: 00007FF7FAA04285
cvtdate.LIBCMT ref: 00007FF7FAA04389
_invoke_watson.LIBCMT ref: 00007FF7FAA04423

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: cvtdate$_errno_get_daylight_invalid_parameter_noinfo_invoke_watson
String ID:
API String ID: 1447642234-0
Opcode ID: a3b1e53b5f70f45bfea4914cdc108dd655034d0a9fcfc8361ab68712039ad71a
Instruction ID: 9f8afaa7256b79f6c8f936ca4b8877f5a342d079b74b7ae31c47be64e53c72e0
Opcode Fuzzy Hash: a3b1e53b5f70f45bfea4914cdc108dd655034d0a9fcfc8361ab68712039ad71a
Instruction Fuzzy Hash: 328194719182528BF374AF15E040C3AFBE0FB94740F50817AEA5952AE4DB7DE45A8FA0

Function 00007FF7FAA03430 Relevance: 7.6, APIs: 5, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF7FAA03492
_isleadbyte_l.LIBCMT ref: 00007FF7FAA034C2
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7FA9F7267), ref: 00007FF7FAA03501
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF7FA9F7267), ref: 00007FF7FAA0354F
_errno.LIBCMT ref: 00007FF7FAA03559

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 875ca83cb4141ce2e370ac5f9a9d47422609fd01dcb68c20e4be45d132a48f4f
Instruction ID: c3803b9b286b424fcf9d94cfb86e59d4c6a5635a8855ecd7305e1ec66f2cca8a
Opcode Fuzzy Hash: 875ca83cb4141ce2e370ac5f9a9d47422609fd01dcb68c20e4be45d132a48f4f
Instruction Fuzzy Hash: E941D431A08B818AF7609F25E140A39E7A1EF44B84F548175EBAD97BE5CF3CE4468760

Function 00007FF7FA9F0B78 Relevance: 7.5, APIs: 5, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7FA9F0B85

Part of subcall function 00007FF7FA9F48AC: _getptd_noexit.LIBCMT ref: 00007FF7FA9F48B2

_inconsistency.LIBCMT ref: 00007FF7FA9F0B93

Part of subcall function 00007FF7FA9F1374: DecodePointer.KERNEL32(?,?,?,?,00007FF7FA9F9D4D,?,?,?,00007FF7FA9F07DE), ref: 00007FF7FA9F137F

_getptd.LIBCMT ref: 00007FF7FA9F0B98
_inconsistency.LIBCMT ref: 00007FF7FA9F0BB4
_getptd.LIBCMT ref: 00007FF7FA9F0BC4

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_getptd_noexit
String ID:
API String ID: 3566995948-0
Opcode ID: b1ff322655b69a1476251a369cc291caccd7b7030a3ca704fc697a4b73b927dc
Instruction ID: e2be8846eadd16e7f8703567b01d6101c76f3a00396c350f1bfc60e33bd51622
Opcode Fuzzy Hash: b1ff322655b69a1476251a369cc291caccd7b7030a3ca704fc697a4b73b927dc
Instruction Fuzzy Hash: DAF0D021A185C391FF51FB51D0411FCD254AF88B95F9D41B1DA784B6CAEE68E45083A0

Function 00007FF7FA9E43C4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

htonl.WS2_32 ref: 00007FF7FA9E4482
std::exception::exception.LIBCMT ref: 00007FF7FA9E4538
_CxxThrowException.LIBCMT ref: 00007FF7FA9E4553

Part of subcall function 00007FF7FA9E4B88: _wcsftime_l.LIBCMT ref: 00007FF7FA9E4BAA

Strings

invalid string size, tag: %d, size: %u, xrefs: 00007FF7FA9E440F

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: ExceptionThrow_wcsftime_lhtonlstd::exception::exception
String ID: invalid string size, tag: %d, size: %u
API String ID: 2297430322-3143865162
Opcode ID: 1e4bbb424b589b7c4d6a9f69d28644da6729227b79945c1b82c0398d7d9d0045
Instruction ID: 2ead8d8a1ddefbbadcc31adeaf13ec619241d107ec4cb239a2ba11250077b0f5
Opcode Fuzzy Hash: 1e4bbb424b589b7c4d6a9f69d28644da6729227b79945c1b82c0398d7d9d0045
Instruction Fuzzy Hash: 8841C226B0C64299FB14EB74D0803EC67A1A755788F8014B1CE2D5BACBDE39D05AC7E1

Function 00007FF7FA9ECDC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

Netbios.NETAPI32 ref: 00007FF7FA9ECE22
Netbios.NETAPI32 ref: 00007FF7FA9ECE66
Netbios.NETAPI32 ref: 00007FF7FA9ECEBA

Strings

3, xrefs: 00007FF7FA9ECEA8

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Netbios
String ID: 3
API String ID: 544444789-1842515611
Opcode ID: fc2c6cc1660e2a1a7a068082d65f1229dadc3ebeeb12d96405019ee56709e9e2
Instruction ID: 84001feadfd4a96cbec3b792e3fe515066a41ca7215fb2249f1eb61468f6862c
Opcode Fuzzy Hash: fc2c6cc1660e2a1a7a068082d65f1229dadc3ebeeb12d96405019ee56709e9e2
Instruction Fuzzy Hash: 5D418F2660C6C199EB21DF7594403EDAB60F75A748F8441B5DBEC43B8BCB38D206CBA1

Function 00007FF7FA9ECC60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

NetWkstaTransportEnum.NETAPI32 ref: 00007FF7FA9ECCB1
swscanf.LIBCMT ref: 00007FF7FA9ECD30

Part of subcall function 00007FF7FA9F2040: vscan_fn.LIBCMT ref: 00007FF7FA9F206B

NetApiBufferFree.NETAPI32 ref: 00007FF7FA9ECD90

Strings

%2hx%2hx%2hx%2hx%2hx%2hx, xrefs: 00007FF7FA9ECD1F

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: BufferEnumFreeTransportWkstaswscanfvscan_fn
String ID: %2hx%2hx%2hx%2hx%2hx%2hx
API String ID: 2287809651-1625236832
Opcode ID: 562012ec4a8d04ffbd1ac61d7800b8f51613bfbd1697ddc3d8399b8b53b45b8e
Instruction ID: f12698c80ebbf5932afa99a89ac97e166bf6c99009a448c5d60c9e8b38972ae7
Opcode Fuzzy Hash: 562012ec4a8d04ffbd1ac61d7800b8f51613bfbd1697ddc3d8399b8b53b45b8e
Instruction Fuzzy Hash: 6C41AC23B18A4198FB40CF70E4802EC77B4FB08744B845136DEADA3B99EE38C556C3A0

Function 00007FF7FA9E8434 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00007FF7FA9E84BF

Strings

\Global.db, xrefs: 00007FF7FA9E8567
\Tencent\Desktop, xrefs: 00007FF7FA9E8547
\Tencent\DeskUpdate, xrefs: 00007FF7FA9E853E

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: FolderPathSpecial
String ID: \Global.db$\Tencent\DeskUpdate$\Tencent\Desktop
API String ID: 994120019-3757207327
Opcode ID: ef9c67a7b736c5df7e5daa3a7a868a4ff0da9a40d72e9e1e0b6a8c9ecd359c25
Instruction ID: 9ed47a7fb268cf962d552f25d3fad073266ce86600dd17177d793cfef6926403
Opcode Fuzzy Hash: ef9c67a7b736c5df7e5daa3a7a868a4ff0da9a40d72e9e1e0b6a8c9ecd359c25
Instruction Fuzzy Hash: 4631A326A1C68181FB20EF25E4907A9A360FB457A4FD05374D57D476E6DF3CE045CBA0

Function 00007FF7FA9D2530 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D255D

Part of subcall function 00007FF7FA9DF3D0: GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9D257F), ref: 00007FF7FA9DF402

Part of subcall function 00007FF7FA9DF4D8: OpenProcess.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF4FB
Part of subcall function 00007FF7FA9DF4D8: GetLastError.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF50B
Part of subcall function 00007FF7FA9DF4D8: OpenProcess.KERNEL32(?,?,?,00007FF7FA9D25AB), ref: 00007FF7FA9DF520

PathFindFileNameW.SHLWAPI ref: 00007FF7FA9D25B0
PathFindFileNameW.SHLWAPI ref: 00007FF7FA9D25DA

Strings

!!!pid=%d through (tid=%d), name=%ws(%ws), xrefs: 00007FF7FA9D25C1

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: FileFindNameOpenPathProcess$CurrentErrorHandleLastModuleThread
String ID: !!!pid=%d through (tid=%d), name=%ws(%ws)
API String ID: 4126646617-725543756
Opcode ID: d9a42e5648462b841738da11a7d38eaa4930a2defaf0a3aad7186ab1921fdfb4
Instruction ID: 480f1876f9e3aa0bc3a3d931ac8c6133ee9c30c7e0ddb442343ffcb96031f616
Opcode Fuzzy Hash: d9a42e5648462b841738da11a7d38eaa4930a2defaf0a3aad7186ab1921fdfb4
Instruction Fuzzy Hash: D9319526A1878292FB60EF21E4485ADE360FF94750FC05171EAAE836D5DF3CE585C7A0

Function 00007FF7FA9DF92C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32 ref: 00007FF7FA9DF99A
RegSetValueExW.ADVAPI32 ref: 00007FF7FA9DF9D8
RegCloseKey.ADVAPI32 ref: 00007FF7FA9DF9E6

Strings

Software\Tencent\QQBrowser\QBroker, xrefs: 00007FF7FA9DF961

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: CloseCreateValue
String ID: Software\Tencent\QQBrowser\QBroker
API String ID: 1818849710-661104360
Opcode ID: c339afa961175439d270a1f878aef2dd04e9f67a5ceaaee9c33060fd387883c7
Instruction ID: bf3bf1487ac23c4f84145713cc35aa7c7df30c112537d2aea90e314d7299c33f
Opcode Fuzzy Hash: c339afa961175439d270a1f878aef2dd04e9f67a5ceaaee9c33060fd387883c7
Instruction Fuzzy Hash: C4218332A18A8192FB50DF10F44576AF3A4FB8879CF944135D69D47A98DF7CD049CB50

Function 00007FF7FA9DF5D4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32 ref: 00007FF7FA9DF61D
PathAppendW.SHLWAPI ref: 00007FF7FA9DF633
PathFileExistsW.SHLWAPI ref: 00007FF7FA9DF63E

Strings

\Internet Explorer\iexplore.exe, xrefs: 00007FF7FA9DF627

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Path$AppendExistsFileFolderSpecial
String ID: \Internet Explorer\iexplore.exe
API String ID: 2859893649-38705447
Opcode ID: 04ff5b0c2f70b85f27fe75ce75b636d5ad538f00c212532b620ced39efe5c13e
Instruction ID: 9bd83b4b8b42885a17ceb30f8c87854cc07b7d534b4ed0ffb86d1c50805c50c0
Opcode Fuzzy Hash: 04ff5b0c2f70b85f27fe75ce75b636d5ad538f00c212532b620ced39efe5c13e
Instruction Fuzzy Hash: 2D11932160868651FF30EB21E4997BAA360FF98794FC04275D6BD879E4DF2CD249CB60

Function 00007FF7FAA0BB62 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA9F0B78: _getptd.LIBCMT ref: 00007FF7FA9F0B85
Part of subcall function 00007FF7FA9F0B78: _inconsistency.LIBCMT ref: 00007FF7FA9F0B93
Part of subcall function 00007FF7FA9F0B78: _getptd.LIBCMT ref: 00007FF7FA9F0B98
Part of subcall function 00007FF7FA9F0B78: _inconsistency.LIBCMT ref: 00007FF7FA9F0BB4

__DestructExceptionObject.LIBCMT ref: 00007FF7FAA0BBAF
_getptd.LIBCMT ref: 00007FF7FAA0BBB5
_getptd.LIBCMT ref: 00007FF7FAA0BBC8

Part of subcall function 00007FF7FA9F0C08: _getptd.LIBCMT ref: 00007FF7FA9F0C11

Strings

csm, xrefs: 00007FF7FAA0BB82

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 54738449fae25136525e3d73a4cde9389fcf728a346489a781f55c28ab9eb91b
Instruction ID: 4ceab6f41c12c3d282ca8026f41c700fb0b183cddf6bccf4d2cdb8b7cab6bf3b
Opcode Fuzzy Hash: 54738449fae25136525e3d73a4cde9389fcf728a346489a781f55c28ab9eb91b
Instruction Fuzzy Hash: FB01842290424385FB70BF31C4916BC6364EB95759F8840B1D9BD8A389DE68D4858791

Function 00007FF7FA9EF658 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF7FA9EF666
malloc.LIBCMT ref: 00007FF7FA9EF672

Part of subcall function 00007FF7FA9EF3A8: _FF_MSGBANNER.LIBCMT ref: 00007FF7FA9EF3D8
Part of subcall function 00007FF7FA9EF3A8: _NMSG_WRITE.LIBCMT ref: 00007FF7FA9EF3E2
Part of subcall function 00007FF7FA9EF3A8: HeapAlloc.KERNEL32(?,?,?,00007FF7FA9F33D0,?,?,?,00007FF7FA9FDBE4,?,?,?,00007FF7FA9FDAE3,?,?,?,00007FF7FA9EF4C5), ref: 00007FF7FA9EF3FD
Part of subcall function 00007FF7FA9EF3A8: _callnewh.LIBCMT ref: 00007FF7FA9EF416
Part of subcall function 00007FF7FA9EF3A8: _errno.LIBCMT ref: 00007FF7FA9EF421
Part of subcall function 00007FF7FA9EF3A8: _errno.LIBCMT ref: 00007FF7FA9EF42C

_CxxThrowException.LIBCMT ref: 00007FF7FA9EF6BB

Part of subcall function 00007FF7FA9F06E8: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9EECA1), ref: 00007FF7FA9F0756
Part of subcall function 00007FF7FA9F06E8: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7FA9EECA1), ref: 00007FF7FA9F0795

Strings

bad allocation, xrefs: 00007FF7FA9EF682

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: b81a1a26c0a4adbc31c3fa8f9502520f94a1c5b7c375de76df4e8ba8216c7643
Instruction ID: 5a5f642dd6ec823c37a73092104e5cbfa558fcb598c0e313bf0a12290d8a332f
Opcode Fuzzy Hash: b81a1a26c0a4adbc31c3fa8f9502520f94a1c5b7c375de76df4e8ba8216c7643
Instruction Fuzzy Hash: 71F0C211A0CB4B52FF24F710A4404B4D354AB95388FC40075D9BD477E6EE2CE249CBB1

Function 00007FF7FA9EA4B4 Relevance: 6.3, APIs: 4, Instructions: 302stringCOMMON

Download Yara Rule

APIs

strcspn.LIBCMT ref: 00007FF7FA9EA55C
localeconv.LIBCMT ref: 00007FF7FA9EA56F
strcspn.LIBCMT ref: 00007FF7FA9EA585
_Mpunct.LIBCPMT ref: 00007FF7FA9EA657

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: strcspn$Mpunctlocaleconv
String ID:
API String ID: 2882554788-0
Opcode ID: 053ecaac9354419ddf1ac585ae6d1347d06da948ae916d9b4f2870e79173457f
Instruction ID: 9e5f7dd06a28c01ae4afccdf773ffcf9b0def8b930802ca16cc50e53ea1fbd97
Opcode Fuzzy Hash: 053ecaac9354419ddf1ac585ae6d1347d06da948ae916d9b4f2870e79173457f
Instruction Fuzzy Hash: B6D18D26B1CA8589FB10DBB5C0802EC6771FB59B88F944175DE9D57B9ACF38D04AC3A0

Function 00007FF7FA9ED294 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

isspace.LIBCMT ref: 00007FF7FA9ED2E5
isprint.LIBCMT ref: 00007FF7FA9ED334
isprint.LIBCMT ref: 00007FF7FA9ED366
isspace.LIBCMT ref: 00007FF7FA9ED3C2

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: isprintisspace
String ID:
API String ID: 2609633722-0
Opcode ID: cb33ea4c5fb831a7523e1f192c435978392835876fc21bf0941de0629dea0196
Instruction ID: 72fea2de9a0e4dd5110ffb20bb6c3d666741cdaaca2c190ff1c36d1341c0fdb6
Opcode Fuzzy Hash: cb33ea4c5fb831a7523e1f192c435978392835876fc21bf0941de0629dea0196
Instruction Fuzzy Hash: 29411742A0C6D645F712EE3945D437EEE909B31B84F8860B4CFA9876D3EE2DA441C3B1

Function 00007FF7FA9E82E4 Relevance: 6.1, APIs: 4, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7FA9E8434: SHGetSpecialFolderPathW.SHELL32 ref: 00007FF7FA9E84BF

CreateFileW.KERNEL32 ref: 00007FF7FA9E8353
CreateFileW.KERNEL32 ref: 00007FF7FA9E8398
WriteFile.KERNEL32 ref: 00007FF7FA9E83DC
CloseHandle.KERNEL32 ref: 00007FF7FA9E83F4

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: File$Create$CloseFolderHandlePathSpecialWrite
String ID:
API String ID: 261467261-0
Opcode ID: 87a36924370a38567c8f29f943b8af8cacfb3f5e16a5e2e4da282d07ff7eaf9b
Instruction ID: c236a081d26c71a5ed1a643f90397fff02839f93b315a358846128a8b86a9e42
Opcode Fuzzy Hash: 87a36924370a38567c8f29f943b8af8cacfb3f5e16a5e2e4da282d07ff7eaf9b
Instruction Fuzzy Hash: A331B132708A409AF710EF75D4946ACB3A0FB587A8F808375EA6D43BD9DF38D5158760

Function 00007FF7FAA09AFC Relevance: 6.1, APIs: 4, Instructions: 62stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00007FF7FAA09B20

Part of subcall function 00007FF7FA9EF6C4: _getptd.LIBCMT ref: 00007FF7FA9EF6DA
Part of subcall function 00007FF7FA9EF6C4: __updatetlocinfo.LIBCMT ref: 00007FF7FA9EF70F
Part of subcall function 00007FF7FA9EF6C4: __updatetmbcinfo.LIBCMT ref: 00007FF7FA9EF736

_errno.LIBCMT ref: 00007FF7FAA09B2C

Part of subcall function 00007FF7FA9F2964: _getptd_noexit.LIBCMT ref: 00007FF7FA9F2968

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7FAA09B37
strchr.LIBCMT ref: 00007FF7FAA09B4D

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: 9f204ea91d6198c4a82ef353745b2060fa986f5a3426e358ba194c17e780f943
Instruction ID: dc77e67424fe625dd14d92e38513eb2a909a81580308f15b939915436e0900f1
Opcode Fuzzy Hash: 9f204ea91d6198c4a82ef353745b2060fa986f5a3426e358ba194c17e780f943
Instruction Fuzzy Hash: 0B212956A1C2A242FB606631908057DE7D0EB86BF4F98C8B1E6FE476C5CD2CD446C7B0

Function 00007FF7FA9EC69C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87registryCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,?,?,?,00007FF7FA9EC635), ref: 00007FF7FA9EC7A6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00007FF7FA9EC635), ref: 00007FF7FA9EC7BA

Part of subcall function 00007FF7FA9D238C: std::_Xbad_alloc.LIBCPMT ref: 00007FF7FA9D242D

Strings

string too long, xrefs: 00007FF7FA9EC779, 00007FF7FA9EC786

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Close$HandleXbad_allocstd::_
String ID: string too long
API String ID: 3601596506-2556327735
Opcode ID: 372d5d49983c13a36cddd18aa35a4e4ff7c67db2dcde71bf080ae64639e4d0e4
Instruction ID: dd0d2835f599822d6e14698804d5163a7dfeefcc6e4df58ae1a8c8456f7f1a55
Opcode Fuzzy Hash: 372d5d49983c13a36cddd18aa35a4e4ff7c67db2dcde71bf080ae64639e4d0e4
Instruction Fuzzy Hash: 87316F22B1DA0181FB18AF15D484238A270EB64F94FA44271CABD873D6DF39E45683F6

Function 00007FF7FA9D7860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

_snwprintf_s.LIBCMT ref: 00007FF7FA9D7901

Part of subcall function 00007FF7FA9EF8E0: _vsnprintf_s_l.LIBCMT ref: 00007FF7FA9EF8F8

Strings

cmdID=0x%0x, xrefs: 00007FF7FA9D78EE
ExecWB, xrefs: 00007FF7FA9D78A9

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: _snwprintf_s_vsnprintf_s_l
String ID: ExecWB$cmdID=0x%0x
API String ID: 2495276089-1305857435
Opcode ID: d2504834d054f49e557b6adf1fcb99767156465117bdd46e3a5108ef1bc64949
Instruction ID: 3b50ec0966b936a6227037748f3b3c68da30ebc558349ac9b2a42a559ee6fec1
Opcode Fuzzy Hash: d2504834d054f49e557b6adf1fcb99767156465117bdd46e3a5108ef1bc64949
Instruction Fuzzy Hash: 8241C532A0C78689F710EB64E4843EDA7A1FB84358F900175DAAC4AADACF7CD185C790

Function 00007FF7FA9D5C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7FA9D5D1C
PostThreadMessageW.USER32 ref: 00007FF7FA9D5D2E

Strings

Quit, xrefs: 00007FF7FA9D5C82

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: Thread$CurrentMessagePost
String ID: Quit
API String ID: 3590184027-3818420395
Opcode ID: c5d0bb174f7255261121061f4f28705b061de229dd0f39cf965b494ab33ca0ef
Instruction ID: 8b5940231a7433f929a1f4e54ed08a138ed8914348ad9df174b52dc222930add
Opcode Fuzzy Hash: c5d0bb174f7255261121061f4f28705b061de229dd0f39cf965b494ab33ca0ef
Instruction Fuzzy Hash: 81314B32A18A4199FB10EF70E4447ED73A4EB5474CF800475EA5D8BA8ADF78D195C7A0

Function 00007FF7FA9DFA0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32 ref: 00007FF7FA9DFAA8
RegCloseKey.ADVAPI32 ref: 00007FF7FA9DFAD6

Strings

Software\Tencent\QQBrowser\QBroker, xrefs: 00007FF7FA9DFA3F

Memory Dump Source

Source File: 00000000.00000002.3939090646.00007FF7FA9D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7FA9D0000, based on PE: true

Associated: 00000000.00000002.3939076939.00007FF7FA9D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939114549.00007FF7FAA0C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939130593.00007FF7FAA24000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3939157823.00007FF7FAA25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7fa9d0000_EBAbsk8ydv.jbxd

Similarity

API ID: CloseQueryValue
String ID: Software\Tencent\QQBrowser\QBroker
API String ID: 3356406503-661104360
Opcode ID: c2fdb8d571b8b3e4283bdc6ab94a3081b84b2d7644d909ec7713784ee6c357a3
Instruction ID: a3760a3c9157900dcdd5fcb8e2590a10a6472599900e9944e92e4203279d0c1d
Opcode Fuzzy Hash: c2fdb8d571b8b3e4283bdc6ab94a3081b84b2d7644d909ec7713784ee6c357a3
Instruction Fuzzy Hash: 90315632A14A1589FB10DB7098492AD73F4FB08788F844576CE6D96A88EF38D195C7A0

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EBAbsk8ydv.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Statistics

CPU Usage

Windows Analysis Report
EBAbsk8ydv.exe

Function 00007FF7FA9D1848 Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 227
threadwindowsynchronizationCOMMON

Function 00007FF7FA9E06C4 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 139
networklibraryloaderCOMMON

Function 00007FF7FA9E6FB1 Relevance: 17.7, Strings: 14, Instructions: 220
COMMON

Function 00007FF7FA9ED9A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 200
fileCOMMON

Function 00007FF7FA9ECF60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 155
libraryloaderCOMMON

Function 00007FF7FA9ED434 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 191
fileCOMMON

Function 00007FF7FA9EDD00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127
fileCOMMON

Function 00007FF7FA9EDF34 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Function 00007FF7FA9ECA74 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 113
registryCOMMON

Function 00007FF7FA9E6BE1 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 90
libraryCOMMON

Function 00007FF7FA9E7DC8 Relevance: 4.7, APIs: 3, Instructions: 230
COMMON

Function 00007FF7FA9E73A1 Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Function 00007FF7FA9E694C Relevance: 3.1, APIs: 2, Instructions: 81
COMMON