Edit tour

Windows Analysis Report
z47maaaaaaaaaaaaax.exe

Overview

General Information

Sample name:	z47maaaaaaaaaaaaax.exe
Analysis ID:	1501308
MD5:	b8786355a2023104ec8e4c05f9ad7746
SHA1:	6880c3a5c77cebc15d59dc1641bc77baac70e34a
SHA256:	e1c4ebf667038a2692ce28436dc28ed7d3c43599f8703dcadf290f45fe6c5e02
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

z47maaaaaaaaaaaaax.exe (PID: 6364 cmdline: "C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe" MD5: B8786355A2023104EC8E4C05F9AD7746)

RegSvcs.exe (PID: 4308 cmdline: "C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.claresbout.com", "Username": "g33@claresbout.com", "Password": "fahaF^V7                    "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33541:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335cb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3365d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33739:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: z47maaaaaaaaaaaaax.exe PID: 6364	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: z47maaaaaaaaaaaaax.exe PID: 6364	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 4308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 4308	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316cf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31741:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317cb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3185d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318c7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31939:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319cf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a5f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33541:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335cb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3365d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33739:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334cf:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33541:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335cb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3365d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336c7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33739:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337cf:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3385f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 208.91.198.143, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 4308, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Suricata Signatures

ET MALWARE AgentTesla Exfil Via SMTP - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	2024-08-29T18:08:53.362448+0200
SID:	2030171
Severity:	1
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	2024-08-29T18:08:53.362448+0200
SID:	2840032
Severity:	1
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla Exfil via SMTP - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	2024-08-29T18:09:01.538022+0200
SID:	2855245
Severity:	1
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.5 - Destination IP: 208.91.198.143

Timestamp:	2024-08-29T18:09:01.538022+0200
SID:	2855542
Severity:	1
Source Port:	49705
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "smtp.claresbout.com", "Username": "g33@claresbout.com", "Password": "fahaF^V7 "}

Multi AV Scanner detection for submitted file

Source: z47maaaaaaaaaaaaax.exe

ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: z47maaaaaaaaaaaaax.exe

Joe Sandbox ML: detected

Source: z47maaaaaaaaaaaaax.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: z47maaaaaaaaaaaaax.exe, 00000000.00000003.2016235423.0000000004090000.00000004.00001000.00020000.00000000.sdmp, z47maaaaaaaaaaaaax.exe, 00000000.00000003.2014386012.00000000041F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: z47maaaaaaaaaaaaax.exe, 00000000.00000003.2016235423.0000000004090000.00000004.00001000.00020000.00000000.sdmp, z47maaaaaaaaaaaaax.exe, 00000000.00000003.2014386012.00000000041F0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CF6CA9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00CF60DD
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00CF63F9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CFEB60
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CFF5FA
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFF56F FindFirstFileW,FindClose,	0_2_00CFF56F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D01B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D01B2F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D01C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D01C8A
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D01F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00D01F94

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855245 - Severity 1 - ETPRO MALWARE Agent Tesla Exfil via SMTP : 192.168.2.5:49705 -> 208.91.198.143:587
Source: Network traffic	Suricata IDS: 2855542 - Severity 1 - ETPRO MALWARE Agent Tesla CnC Exfil Activity : 192.168.2.5:49705 -> 208.91.198.143:587
Source: Network traffic	Suricata IDS: 2030171 - Severity 1 - ET MALWARE AgentTesla Exfil Via SMTP : 192.168.2.5:49705 -> 208.91.198.143:587
Source: Network traffic	Suricata IDS: 2840032 - Severity 1 - ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 : 192.168.2.5:49705 -> 208.91.198.143:587

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 208.91.198.143:587

Source: Joe Sandbox View	IP Address: 208.91.198.143 208.91.198.143
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 208.91.198.143:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D04EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00D04EB5

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: smtp.claresbout.com

Source: RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://smtp.claresbout.com
Source: RegSvcs.exe, 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: RegSvcs.exe, 00000002.00000002.3274448428.00000000062D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: z47maaaaaaaaaaaaax.exe, 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: z47maaaaaaaaaaaaax.exe, 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, gmBpn1ecBmQ.cs

.Net Code: bncc6O1dRn6

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D06B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00D06B0C

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D06D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00D06D07

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

0_2_00D06B0C

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00CF2B37

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D1F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00D1F7FF

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00CB3D19
Source: z47maaaaaaaaaaaaax.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: z47maaaaaaaaaaaaax.exe, 00000000.00000000.2004499668.0000000000D5E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ef2c2e16-a
Source: z47maaaaaaaaaaaaax.exe, 00000000.00000000.2004499668.0000000000D5E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_f64324ec-c
Source: z47maaaaaaaaaaaaax.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d26498d3-6
Source: z47maaaaaaaaaaaaax.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d92d3715-d

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF6685: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00CF6685

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CEACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00CEACC5

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00CF79D3

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CDB043	0_2_00CDB043
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CC3200	0_2_00CC3200
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CC3B70	0_2_00CC3B70
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CE410F	0_2_00CE410F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD02A4	0_2_00CD02A4
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CE038E	0_2_00CE038E
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CBE3B0	0_2_00CBE3B0
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD06D9	0_2_00CD06D9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CE467F	0_2_00CE467F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D1AACE	0_2_00D1AACE
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CE4BEF	0_2_00CE4BEF
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CDCCC1	0_2_00CDCCC1
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CBAF50	0_2_00CBAF50
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB6F07	0_2_00CB6F07
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D131BC	0_2_00D131BC
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CDD1B9	0_2_00CDD1B9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CCB11F	0_2_00CCB11F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CE724D	0_2_00CE724D
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD123A	0_2_00CD123A
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF13CA	0_2_00CF13CA
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB93F0	0_2_00CB93F0
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CCF563	0_2_00CCF563
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFB6CC	0_2_00CFB6CC
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB96C0	0_2_00CB96C0
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D1F7FF	0_2_00D1F7FF
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB77B0	0_2_00CB77B0
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CE79C9	0_2_00CE79C9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CCFA57	0_2_00CCFA57
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB9B60	0_2_00CB9B60
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB7D19	0_2_00CB7D19
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD9ED0	0_2_00CD9ED0
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CCFE6F	0_2_00CCFE6F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CB7FA3	0_2_00CB7FA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014EE3D0	2_2_014EE3D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014E4A98	2_2_014E4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014E3E80	2_2_014E3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014E41C8	2_2_014E41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014EA960	2_2_014EA960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068EA198	2_2_068EA198
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068EB9F0	2_2_068EB9F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F55A8	2_2_068F55A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F65E8	2_2_068F65E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068FB220	2_2_068FB220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F0040	2_2_068F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F3060	2_2_068F3060
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068FC180	2_2_068FC180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F7D78	2_2_068F7D78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F7698	2_2_068F7698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068FE3A0	2_2_068FE3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F2348	2_2_068F2348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F5CE7	2_2_068F5CE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_068F0007	2_2_068F0007

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: String function: 00CCEC2F appears 68 times
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: String function: 00CDF8A0 appears 35 times
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: String function: 00CD6AC0 appears 42 times

Source: z47maaaaaaaaaaaaax.exe, 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamebe1f91a0-ab1f-4bf2-860d-2e3d052545bd.exe4 vs z47maaaaaaaaaaaaax.exe
Source: z47maaaaaaaaaaaaax.exe, 00000000.00000003.2013921644.000000000431D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs z47maaaaaaaaaaaaax.exe
Source: z47maaaaaaaaaaaaax.exe, 00000000.00000003.2014234360.0000000004173000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs z47maaaaaaaaaaaaax.exe

Source: z47maaaaaaaaaaaaax.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@2/2

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CFCE7A GetLastError,FormatMessageW,

0_2_00CFCE7A

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CEAB84 AdjustTokenPrivileges,CloseHandle,		0_2_00CEAB84
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CEB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00CEB134

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CFE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00CFE1FD

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00CF6532

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D0C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_00D0C18C

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CB406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00CB406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

File created: C:\Users\user\AppData\Local\Temp\aut92F0.tmp

Jump to behavior

Source: z47maaaaaaaaaaaaax.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: z47maaaaaaaaaaaaax.exe

ReversingLabs: Detection: 23%

Source: unknown	Process created: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe "C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe"
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe"
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe"	Jump to behavior

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: z47maaaaaaaaaaaaax.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: z47maaaaaaaaaaaaax.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: z47maaaaaaaaaaaaax.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: z47maaaaaaaaaaaaax.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: z47maaaaaaaaaaaaax.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: z47maaaaaaaaaaaaax.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: z47maaaaaaaaaaaaax.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: z47maaaaaaaaaaaaax.exe, 00000000.00000003.2016235423.0000000004090000.00000004.00001000.00020000.00000000.sdmp, z47maaaaaaaaaaaaax.exe, 00000000.00000003.2014386012.00000000041F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: z47maaaaaaaaaaaaax.exe, 00000000.00000003.2016235423.0000000004090000.00000004.00001000.00020000.00000000.sdmp, z47maaaaaaaaaaaaax.exe, 00000000.00000003.2014386012.00000000041F0000.00000004.00001000.00020000.00000000.sdmp

Source: z47maaaaaaaaaaaaax.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: z47maaaaaaaaaaaaax.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: z47maaaaaaaaaaaaax.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: z47maaaaaaaaaaaaax.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: z47maaaaaaaaaaaaax.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CCE01E LoadLibraryA,GetProcAddress,

0_2_00CCE01E

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD6B05 push ecx; ret		0_2_00CD6B18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_014EA180 push eax; ret		2_2_014EA181

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D18111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00D18111
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CCEB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00CCEB42

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CD123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00CD123A

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

API/Special instruction interceptor: Address: 2363264

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window / User API: threadDelayed 3870

Jump to behavior

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Evaded block: after key decision	graph_0-95407
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Evaded block: after key decision	graph_0-94142
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Evaded block: after key decision	graph_0-94164

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-94487

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

API coverage: 3.9 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00CF6CA9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00CF60DD
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CF63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00CF63F9
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00CFEB60
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00CFF5FA
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CFF56F FindFirstFileW,FindClose,	0_2_00CFF56F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D01B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D01B2F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D01C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00D01C8A
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D01F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00D01F94

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CCDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CCDDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98563	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3272605807.0000000001286000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllQ

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	API call chain: ExitProcess graph end node			graph_0-94257
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	API call chain: ExitProcess graph end node			graph_0-93896

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D06AAF BlockInput,

0_2_00D06AAF

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CB3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00CB3D19

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CE3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00CE3920

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CCE01E LoadLibraryA,GetProcAddress,

0_2_00CCE01E

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CEA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00CEA66C

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD8189 SetUnhandledExceptionFilter,		0_2_00CD8189
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00CD81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00CD81AC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CEB106 LogonUserW,

0_2_00CEB106

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CB3D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00CB3D19

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF411C SendInput,keybd_event,

0_2_00CF411C

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF74E7 mouse_event,

0_2_00CF74E7

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe"

Jump to behavior

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

0_2_00CEA66C

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CF71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00CF71FA

Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: Shell_TrayWnd
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CD65C4 cpuid

0_2_00CD65C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D0091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_00D0091D

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00D2B340 GetUserNameW,

0_2_00D2B340

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CE1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00CE1E8E

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe

Code function: 0_2_00CCDDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00CCDDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z47maaaaaaaaaaaaax.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4308, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: WIN_81
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: WIN_XP
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: WIN_XPe
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: WIN_VISTA
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: WIN_7
Source: z47maaaaaaaaaaaaax.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z47maaaaaaaaaaaaax.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4308, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.z47maaaaaaaaaaaaax.exe.3bb0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: z47maaaaaaaaaaaaax.exe PID: 6364, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4308, type: MEMORYSTR

Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D08C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00D08C4F
Source: C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe	Code function: 0_2_00D0923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00D0923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	112 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z47maaaaaaaaaaaaax.exe	24%	ReversingLabs	Win32.Trojan.Strab
z47maaaaaaaaaaaaax.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
http://www.microsoft.c	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://api.ipify.org/t	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://smtp.claresbout.com	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
us2.smtp.mailhostbox.com	208.91.198.143	true	true	unknown
api.ipify.org	172.67.74.152	true	false	unknown
smtp.claresbout.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	z47maaaaaaaaaaaaax.exe, 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://smtp.claresbout.com	RegSvcs.exe, 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsoft.c	RegSvcs.exe, 00000002.00000002.3274448428.00000000062D8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	z47maaaaaaaaaaaaax.exe, 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/t	RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://us2.smtp.mailhostbox.com	RegSvcs.exe, 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3273236521.00000000030E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.91.198.143	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501308
Start date and time:	2024-08-29 18:08:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z47maaaaaaaaaaaaax.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 55 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: z47maaaaaaaaaaaaax.exe

Simulations

Behavior and APIs

Time	Type	Description
12:08:58	API Interceptor	20x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.91.198.143	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	giehjhgjzJ.hta	Get hash	malicious	Cobalt Strike, MassLogger RAT, Snake Keylogger	Browse
	NGL1Of0ZkJ.hta	Get hash	malicious	Cobalt Strike, AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19673.26192.exe	Get hash	malicious	AgentTesla	Browse
	Edsha_PO.xls	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Exploit.CVE-2017-0199.04.Gen.20726.10183.xlsx	Get hash	malicious	Snake Keylogger	Browse
	EG240711 EG240712.xls	Get hash	malicious	Snake Keylogger	Browse
	b2bXo6vmDm.exe	Get hash	malicious	SystemBC	Browse
172.67.74.152	zE7Ken4cFt.dll	Get hash	malicious	Quasar	Browse	api.ipify.org/
	FormPlayer.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	PandaClient.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	golang-modules.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Trojan.Win64.Agent.14415.19839.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	242764.exe	Get hash	malicious	Ficker Stealer, Rusty Stealer	Browse	api.ipify.org/?format=wef
	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
us2.smtp.mailhostbox.com	z55enyioma.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Statement of Account.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	SOA-Al Daleel -Star Electromechanical.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	RFQ for RIyadh City Water Line Diversion.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	New PO pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	SecuriteInfo.com.PDF.Phishing.7B6B.tr.8047.20915.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	SecuriteInfo.com.Win32.PWSX-gen.25647.23289.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	product_list.xls	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.225
	SecuriteInfo.com.Other.Malware-gen.12504.4949.xlsx	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	giehjhgjzJ.hta	Get hash	malicious	Cobalt Strike, MassLogger RAT, Snake Keylogger	Browse	208.91.198.143
api.ipify.org	Page1.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	DHL Page1.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	Upit za prevoz 28 08 2024 1037 Agrorit d.o.o.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	Great Wall Motor Sale Bank_Sift_Copy.Pdf.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	104.26.13.205
	Programa de Mentoring y Apoyo a la Internacionalizaci#U00f3n.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	5649237431_23-10-23-08.49.23.0107.07.exe	Get hash	malicious	GuLoader	Browse	104.26.12.205
	Hua San Particulars.doc.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	BULK HARVEST - VESSEL PARTICULARS.docx.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Catalina - Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	Quote# 241048.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	z55enyioma.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	http://linkplea.se/doar	Get hash	malicious	Unknown	Browse	103.50.160.116
	https://link.edgepilot.com/s/9af6615e/9PTSwESci0mLBHHjcB2qKA?u=https://niverapaints.com/	Get hash	malicious	Unknown	Browse	208.91.199.242
	https://berajpaints.com.pk/tag/dolor/	Get hash	malicious	Unknown	Browse	207.174.214.183
	http://pragatihandicrafts.com/	Get hash	malicious	Unknown	Browse	207.174.213.22
	QUOTE-4K798388-A-CC22.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.79.62.115
	Statement of Account.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.224
	SOA-Al Daleel -Star Electromechanical.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	208.91.199.223
	PO-00032.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
CLOUDFLARENETUS	http://premium.davidabostic.com	Get hash	malicious	Unknown	Browse	172.64.148.10
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://alkimialofts.com/on%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	HTMLPhisher	Browse	104.26.0.100
	https://decktop.us/MUYKd1	Get hash	malicious	Unknown	Browse	162.247.243.29
	sxs.exe	Get hash	malicious	Unknown	Browse	172.67.41.60
	http://www.water-filter.com	Get hash	malicious	HTMLPhisher	Browse	104.18.15.188
	https://t4w86zlc.r.sa-east-1.awstrack.me/L0/https:%2F%2Fdeverechemicals3.s3.amazonaws.com%2FDeveres3project002files.htm/1/010301919a36c887-bd0fadb9-69a9-4c66-8a65-7770fcfd1a1e-000000/4liC3XgeimVwv5ob78Q6Bl4nESk=173	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://econltractors.com	Get hash	malicious	HTMLPhisher	Browse	172.67.209.24
	https://rebrand.ly/340957	Get hash	malicious	Unknown	Browse	1.1.1.1
	0VCartoonizer_Trial.exe	Get hash	malicious	LummaC	Browse	104.21.28.66

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://decktop.us/MUYKd1	Get hash	malicious	Unknown	Browse	172.67.74.152
	Page1.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	Detailed Itinerary.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	172.67.74.152
	https://tmx.velsol.com/Reporting/Document.aspx?MasterAgreementID=i1339-005394573&ID=aQAxADMAMwA5AC0AMAAwADUAMwA5ADQANQA3ADMA.	Get hash	malicious	Unknown	Browse	172.67.74.152
	Nettably.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	DHL Page1.exe	Get hash	malicious	GuLoader	Browse	172.67.74.152
	Upit za prevoz 28 08 2024 1037 Agrorit d.o.o.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Autofill Manufacturing Sdn Bhd 28-08-2024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.74.152
	G_24370-24396_SI2_S25_8658_MPO_SMARTEX_240715.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse	172.67.74.152
	payment PAGO 2974749647839452.js	Get hash	malicious	Unknown	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe
File Type:	data
Category:	dropped
Size (bytes):	151944
Entropy (8bit):	7.906567489949864
Encrypted:	false
SSDEEP:	3072:iW9twDgcRzBxVNFiKJPe0evu/+9z2kP5w5Bqz36uo3Hh1:Tt4VxVNFiKJPe0em+9z2kPUdue/
MD5:	A16DB55DDFC5659107B6B6F39380D6E0
SHA1:	E55D4EBF93D9C930967DF98D45B14C5A3567E6AA
SHA-256:	2DEFCD3D419C64ADD6AC4BBE95418A18AA8626108A2FABEA84415648D48226EE
SHA-512:	1AC6844F86B05E339776FDB2336CF1A3F27B964A49B574F642E75E252144B2180A8EE228F4EAD4F79DAD18719A3FF665EBD62401D4984E5E0363930D3BB83B9F
Malicious:	false
Reputation:	low
Preview:	EA06.......:\|.X.V.T.~.Q...t.D.....8.X.Q+.....f......X.J........).o...,..ri..SF..b..mjU7.^....[?....(U.+d.K%..UV.P..,f...M!TY....O..5..T.tY.6.5.M...lQ....B...a&.....N....j.F..5.....J.L...J%.L.U+..P..H........cw9.U.. ..B. ._6..4...~@..E.V...v..`F..;...i....-...U..6iF..,\|6:.Be`.Mf.`.b.]..1...\...S@.........&...^.D...;.mjeJ.B?4.....Z.B.,>O=4........i....zH%...,.@.......U<.y...!P.-.P..l[.....Wr?i.n.C..v.Zv.[..Ur..F.ki..9...Bwt.t4.n...`..Y]?...f.wJ.>S@.Xg..\.O^.w...M.au.~fR.......y.....?..[}....%.g..m....../.M...l~."..&x.V...4.tX.7....i.....=.Y..?.......{....1...1.,& ....p..n....\..O@7.@..n`..\......@..p.Xs.4.......zp......7..._...[t....S...fV..?; ..3.../.U.a..x.[u..t7U.V.E....h.vgN.PkUj=V.o._......0.Wi....y.F...%.{...!.\..k...,3.,..........m8......v<>......6.=....V..i..i4...).Fk+..e1Hd25..N$R...v&.J<.D...2.U.X..o.)lRiF.r.....1......F.R.T..Kl..C.L-.d..H.S..z.Z.P.I..I....]......xO.u..*=X.S.....l.Lf..%b.i.^ ..2.5..f..v.$.Tm.+.Z.P.[....r......

C:\Users\user\AppData\Local\Temp\aut932F.tmp

Download File

Process:	C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe
File Type:	data
Category:	dropped
Size (bytes):	11278
Entropy (8bit):	7.610087574151592
Encrypted:	false
SSDEEP:	192:KU7FGNNtmHBnxsh1nf/Xzy0e5no/GE6/jKmM4UFn/Bc3IkRNRlL:PGrtmh6rnXXzyL5an6/jiFnJshBL
MD5:	BF3906BF5FEF35F438120B464F3CE0E8
SHA1:	E83F19EE5530376280969FA7AED210D52716F630
SHA-256:	84238E6680D81119FBAD92107377E2F0B7BB0213D501260B9E9A524B03356C36
SHA-512:	A9DF5F2EC5AA8AF33BA942340FECE0B1D3E00B0B3846D3DB0FF68E6C5505692F895C614BB5DCED15E0CEF73ABBD3D336F73217C4E8421286BAC21FF2F4BFF694
Malicious:	false
Reputation:	low
Preview:	EA06.....J.......d..Y%sP.".+.J........... .B.+....@...\|`......p.........8......\|.. ....3...P."......l.,.. ......@. ...........Y.....B.....C .M.....L...B.....L.....(.`..b..X.C6.!....4.....C3...n..M. ?...N."3a......... ...2......@....M..6.A.....h...!O....Y..>.0..@9...a4.......Lg.......&' ....@....p.... N....Sv.)..bj.MY........vf@.......14.p...'.....W@..(..,...E....8}V ....q.p..`........p~...M......l......d.....t.....l.s..f..........6@"0.....b.(..53.@.....bvn......s........d.....6.....#.)........1a.0..S14.L...5.$' .......3.@.....@........vd.....h.... l...... .L..C...... ........eFh......@y55. ..90.,.-3p!..@I:...-.l`.....\|........l.........c....G...7.......<.Y..g.......A.>.....2.x.,>0..L..:.....>`'....9H.....'.Y..>@&.M.Q..D.S..J\|...).6.....1b....I..O....@.O.... ,......`.... <.....X0.)... :..V&.H. .f.Q8...(<&@...$.I..z\|.Y...H}........8.H...>i.....X..~ U....a..&.\.....& 0..=......H...;<....3 ...d.y.DO.`.y...h.C..ff...LAM?@........@.4.........n>i.&ff."...lA].......I8....

C:\Users\user\AppData\Local\Temp\epistemology

Download File

Process:	C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe
File Type:	ASCII text, with very long lines (57348), with no line terminators
Category:	dropped
Size (bytes):	57348
Entropy (8bit):	2.792901473048393
Encrypted:	false
SSDEEP:	384:bwVMnetUgguwFXWLkHV6mxTtkHFnMWXh+6mi/0QtC7TlccJLCa07sdb/Y/8:sCkeHJxTtkXhQdc/7ut
MD5:	5E8E6C1F6A55B574C1066422E4AD6341
SHA1:	822B9D0A0A61E4157CEE4C46FC27AA5DED2FF2DD
SHA-256:	705E88684708017795D4AD72FB70C54AD9DDFFA90C752D727901A666CB54223A
SHA-512:	8ACB3B2F3A23A29FAF33E906AC6B9EB803CC4EF2125593E38C2BB411DB1A2273AA5DF3E02DF6201CAAAB8AA630923977EF6D343753E52B3D7EFC49DF66039FAE
Malicious:	false
Reputation:	low
Preview:	0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+0+c+2+c+d+5+5+e+b+8+0+c+3+3+2+0+b+e+c+f+5+4+b+8+0+0+0+0+0+0+0+0+c+f+5+4+7+c+7+0+b+e+c+f+d+4+9+8+8+f+d+4+b+8+8+0+4+7+0+c+5+8+0+0+0+0+0+0+c+8+5+9+f+f+f+f+a+6+0+5+8+f+5+4+d+8+4+2+4+7+0+0+0+0+0+0+0+0+c+8+d+b+3+8+8+0+c+e+3+8+c+e+b+8+5+5+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+0+0+c+0+2+c+e+5+f+5+9+5+4+a+3+f+8+1+4+2+c+4+b+8+0+1+4+2+c+7+b+8+4+1+4+2+4+7+b+8+1+5+7+5+6+5+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+0+0+8+0+2+c+a+f+5+7+b+4+2+4+2+0+8+8+c+0+4+2+c+5+b+8+8+0+4+2+4+4+b+8+4+0+4+2+4+5+b+8+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+c+0+0+4+0+2+c+d+5+5+e+b+8+0+d+7+f+c+f+5+4+b+8+f+f+f+f+f+f+6+5+9+e+4+f+d+4+9+8+1+0+1+c+3+8+4+f+d+4+b+8+c+f+5+4+9+8+0+d+5+4+3+3+8+0+8+e+1+c+c+f+5+4+b+8+0+d+d+4+9+8+a+c+3+3+8+f+5+5+3+2+f+1+a+f+1+c+8+1+2+e+1+c+c+f+5+5+b+8+8+c+3+3+4+d+5+4+3+2+f+1+8+f+1+c+9+1+0+e+1+c+c+f+5+4+b+8+a+c+3+3+8+d+5+5+3+2+f+1+a+f+1+c+a+1+2+e+1+c+c+f+

C:\Users\user\AppData\Local\Temp\translucently

Download File

Process:	C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe
File Type:	data
Category:	dropped
Size (bytes):	240128
Entropy (8bit):	6.659674349032538
Encrypted:	false
SSDEEP:	6144:jNgYBkmRUzh/1FwTITvmSE0YJEJvTANTxr6:jNgvms/wTCeZ0VJ7AS
MD5:	9A7E897A8DDE5D5EB6BEB18850FD996C
SHA1:	36C8547DF13E9DD01704D1D289EF49236EA1ED57
SHA-256:	09EDDC38B067ECB03174BCC9647F417C1EEC23A54326093E883F8328CD84DC3B
SHA-512:	A5BC212DA0C48648DCF7E452114C93D7EBFDAB0F3C98457E5D55C45F485B7FBA50098D17AEE1BAF10CEC88A8D2C0550473226DF4A9D2269609F043387BCFB4B0
Malicious:	false
Reputation:	low
Preview:	...CO4DXJZ2H..XQ.VPRN4FDuCL4DXNZ2HPDXQCVPRN4FD5CL4DXNZ2HPDXQ.VPR@+.J5.E.e.O..i.,1"c&"=)F'). -Z7:zP-p6-?c?>r.{.dX,(QjUCP.HPDXQCV..N4.E6C...>NZ2HPDXQ.VRSE5MD5.O4DPNZ2HPDF.@VPrN4F.6CL4.XNz2HPFXQGVPRN4FD1CL4DXNZ2HTDXSCVPRN4DDu.L4TXNJ2HPDHQCFPRN4FD%CL4DXNZ2HPD..@V.RN4F.6C.1DXNZ2HPDXQCVPRN4FD5.O4HXNZ2HPDXQCVPRN4FD5CL4DXNZ2HPDXQCVPRN4FD5CL4DXNZ2HPDXqCVXRN4FD5CL4DXFz2H.DXQCVPRN4FD.7)L0XNZ..SDXqCVP.M4FF5CL4DXNZ2HPDXQcVP2`F56VCL4.]NZ2.SDXWCVP.M4FD5CL4DXNZ2H.DX.m$5>!WFD9CL4D.MZ2JPDX.@VPRN4FD5CL4DX.Z2.PDXQCVPRN4FD5CL4D.MZ2HPD.QCVRRK4..7C..EXMZ2HQDXWCVPRN4FD5CL4DXNZ2HPDXQCVPRN4FD5CL4DXNZ2HPDXQCVPRS.......%pPPO.b.6.U..]..=..CuQ.5N....U....iA@.\|C.;t..;...$.^U+O....tTO)@2a?.K9.^.....g0u..2.4...v.?Er.{..b.....W:.j..0.. 9=\|/D6(Pm.U"9<3.J.EXQCV.......%L..cY=VdV ....z&>....:XNZVHPD*QCV1RN4.D5C#4DX Z2H.DXQ=VPR.4FDuCL4sXNZ.HPD5QCVtRN48D5C.IKW...!#.QCVPR{..t......m...r).=.2j.. ...nA..UZ.'.....^._..".'2g..]3NTAZVGU\o@....bN0@]L]6K\yV....s......5...a2.8XQCVPR.4F.5CL..X.Z2H.D.Q..PRN..D.C.4...Z

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.910461865352188
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	z47maaaaaaaaaaaaax.exe
File size:	1'036'800 bytes
MD5:	b8786355a2023104ec8e4c05f9ad7746
SHA1:	6880c3a5c77cebc15d59dc1641bc77baac70e34a
SHA256:	e1c4ebf667038a2692ce28436dc28ed7d3c43599f8703dcadf290f45fe6c5e02
SHA512:	ecc5a711073f17df8764ed274a56c66d6d14606d80cb3349d5d4abc606673149bc6201e3a24d5d715d6a4944e3f64b78e89ae60ad4aa16419d5d3bc87561b969
SSDEEP:	24576:Atb20pkaCqT5TBWgNQ7ar5kC3dJlQg71E6A:JVg5tQ7ar9JlQF5
TLSH:	5225CF1373DDC361C3B25273BA26B701AEBF782506A5F56B2FD4093DE920122525EA73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66D061E4 [Thu Aug 29 11:56:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007F76AC84DC5Fh
jmp 00007F76AC840C74h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F76AC840DFAh
cmp edi, eax
jc 00007F76AC84115Eh
bt dword ptr [004C0158h], 01h
jnc 00007F76AC840DF9h
rep movsb
jmp 00007F76AC84110Ch
cmp ecx, 00000080h
jc 00007F76AC840FC4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F76AC840E00h
bt dword ptr [004BA370h], 01h
jc 00007F76AC8412D0h
bt dword ptr [004C0158h], 00000000h
jnc 00007F76AC840F9Dh
test edi, 00000003h
jne 00007F76AC840FAEh
test esi, 00000003h
jne 00007F76AC840F8Dh
bt edi, 02h
jnc 00007F76AC840DFFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F76AC840E03h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F76AC840E55h
bt esi, 03h
jnc 00007F76AC840EA8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x34148	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf9000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x34148	0x34200	24b58e6860bef2c798024d323a27c9a2	False	0.8738384292565947	data	7.75827144971282	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf9000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x2b41e	data			1.0003442787642085
RT_GROUP_ICON	0xf7bd8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xf7c50	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xf7c64	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xf7c78	0x14	data	English	Great Britain	1.25
RT_VERSION	0xf7c8c	0x10c	data	English	Great Britain	0.5970149253731343
RT_MANIFEST	0xf7d98	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-29T18:08:53.362448+0200	TCP	2030171	ET MALWARE AgentTesla Exfil Via SMTP	1	49705	587	192.168.2.5	208.91.198.143
2024-08-29T18:08:53.362448+0200	TCP	2840032	ETPRO MALWARE Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	1	49705	587	192.168.2.5	208.91.198.143
2024-08-29T18:09:01.538022+0200	TCP	2855245	ETPRO MALWARE Agent Tesla Exfil via SMTP	1	49705	587	192.168.2.5	208.91.198.143
2024-08-29T18:09:01.538022+0200	TCP	2855542	ETPRO MALWARE Agent Tesla CnC Exfil Activity	1	49705	587	192.168.2.5	208.91.198.143

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 18:08:57.789252996 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:57.789287090 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:57.789377928 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:57.796823978 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:57.796833038 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.633654118 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.633755922 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:58.694463968 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:58.694479942 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.694814920 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.748151064 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:58.847050905 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:58.892496109 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.956254959 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.956310987 CEST	443	49704	172.67.74.152	192.168.2.5
Aug 29, 2024 18:08:58.956430912 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:58.969434023 CEST	49704	443	192.168.2.5	172.67.74.152
Aug 29, 2024 18:08:59.812128067 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:08:59.817861080 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:08:59.817939043 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:00.564419031 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:00.564791918 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:00.569813967 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:00.721191883 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:00.722271919 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:00.727802992 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:00.880824089 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:00.881660938 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:00.886562109 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.042793036 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.043153048 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.048162937 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.200901031 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.201080084 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.206283092 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.380441904 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.380695105 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.385767937 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.537378073 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.537950993 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.538022041 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.538072109 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.538096905 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:09:01.542953968 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.542964935 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.542994976 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.543004990 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.844449043 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:09:01.893639088 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:10:39.487880945 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:10:39.590497017 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:10:39.741425991 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:10:39.741480112 CEST	587	49705	208.91.198.143	192.168.2.5
Aug 29, 2024 18:10:39.741583109 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:10:39.741730928 CEST	49705	587	192.168.2.5	208.91.198.143
Aug 29, 2024 18:10:39.746592045 CEST	587	49705	208.91.198.143	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2024 18:08:57.768157959 CEST	59307	53	192.168.2.5	1.1.1.1
Aug 29, 2024 18:08:57.775865078 CEST	53	59307	1.1.1.1	192.168.2.5
Aug 29, 2024 18:08:59.465254068 CEST	58847	53	192.168.2.5	1.1.1.1
Aug 29, 2024 18:08:59.810713053 CEST	53	58847	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 29, 2024 18:08:57.768157959 CEST	192.168.2.5	1.1.1.1	0xd716	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:59.465254068 CEST	192.168.2.5	1.1.1.1	0xd741	Standard query (0)	smtp.claresbout.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 29, 2024 18:08:57.775865078 CEST	1.1.1.1	192.168.2.5	0xd716	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:57.775865078 CEST	1.1.1.1	192.168.2.5	0xd716	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:57.775865078 CEST	1.1.1.1	192.168.2.5	0xd716	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:59.810713053 CEST	1.1.1.1	192.168.2.5	0xd741	No error (0)	smtp.claresbout.com	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 29, 2024 18:08:59.810713053 CEST	1.1.1.1	192.168.2.5	0xd741	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:59.810713053 CEST	1.1.1.1	192.168.2.5	0xd741	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:59.810713053 CEST	1.1.1.1	192.168.2.5	0xd741	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)	false
Aug 29, 2024 18:08:59.810713053 CEST	1.1.1.1	192.168.2.5	0xd741	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.74.152	443	4308	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-29 16:08:58 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-08-29 16:08:58 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 29 Aug 2024 16:08:58 GMT Content-Type: text/plain Content-Length: 11 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8badcd8819f7430d-EWR
2024-08-29 16:08:58 UTC	11	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 33 33 Data Ascii: 8.46.123.33

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Aug 29, 2024 18:09:00.564419031 CEST	587	49705	208.91.198.143	192.168.2.5	220 us2.outbound.mailhostbox.com ESMTP Postfix
Aug 29, 2024 18:09:00.564791918 CEST	49705	587	192.168.2.5	208.91.198.143	EHLO 927537
Aug 29, 2024 18:09:00.721191883 CEST	587	49705	208.91.198.143	192.168.2.5	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Aug 29, 2024 18:09:00.722271919 CEST	49705	587	192.168.2.5	208.91.198.143	AUTH login ZzMzQGNsYXJlc2JvdXQuY29t
Aug 29, 2024 18:09:00.880824089 CEST	587	49705	208.91.198.143	192.168.2.5	334 UGFzc3dvcmQ6
Aug 29, 2024 18:09:01.042793036 CEST	587	49705	208.91.198.143	192.168.2.5	235 2.7.0 Authentication successful
Aug 29, 2024 18:09:01.043153048 CEST	49705	587	192.168.2.5	208.91.198.143	MAIL FROM:<g33@claresbout.com>
Aug 29, 2024 18:09:01.200901031 CEST	587	49705	208.91.198.143	192.168.2.5	250 2.1.0 Ok
Aug 29, 2024 18:09:01.201080084 CEST	49705	587	192.168.2.5	208.91.198.143	RCPT TO:<g33@claresbout.com>
Aug 29, 2024 18:09:01.380441904 CEST	587	49705	208.91.198.143	192.168.2.5	250 2.1.5 Ok
Aug 29, 2024 18:09:01.380695105 CEST	49705	587	192.168.2.5	208.91.198.143	DATA
Aug 29, 2024 18:09:01.537378073 CEST	587	49705	208.91.198.143	192.168.2.5	354 End data with <CR><LF>.<CR><LF>
Aug 29, 2024 18:09:01.538096905 CEST	49705	587	192.168.2.5	208.91.198.143	.
Aug 29, 2024 18:09:01.844449043 CEST	587	49705	208.91.198.143	192.168.2.5	250 2.0.0 Ok: queued as 48B17B80775
Aug 29, 2024 18:10:39.487880945 CEST	49705	587	192.168.2.5	208.91.198.143	QUIT
Aug 29, 2024 18:10:39.741425991 CEST	587	49705	208.91.198.143	192.168.2.5	221 2.0.0 Bye

Target ID:	0
Start time:	12:08:54
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe"
Imagebase:	0xcb0000
File size:	1'036'800 bytes
MD5 hash:	B8786355A2023104EC8E4C05F9AD7746
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2018793711.0000000003BB0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:08:55
Start date:	29/08/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\z47maaaaaaaaaaaaax.exe"
Imagebase:	0xcc0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3273236521.0000000003159000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3273236521.0000000003131000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3272283809.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	162

Executed Functions

Function 00CDB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e5ee56e32f117697234bfae65d2ebac8c9290c468965ca218bedc73ba0d668
Instruction ID: 59395188a5998222468f51558d098df1da765092456e2a215e46f7402f1d3b6e
Opcode Fuzzy Hash: 46e5ee56e32f117697234bfae65d2ebac8c9290c468965ca218bedc73ba0d668
Instruction Fuzzy Hash: BE325875A02229CBCB24CF15DC81AE9B7B5FB4A310F0941DAE51AE7B91D7309E81CF52

Function 00CB3D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00CB3AA3,?), ref: 00CB3D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00CB3AA3,?), ref: 00CB3D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00D71148,00D71130,?,?,?,?,00CB3AA3,?), ref: 00CB3DC8

Part of subcall function 00CB6430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00CB3DEE,00D71148,?,?,?,?,?,00CB3AA3,?), ref: 00CB6471

SetCurrentDirectoryW.KERNEL32(?,?,?,00CB3AA3,?), ref: 00CB3E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00D628F4,00000010), ref: 00D21CCE
SetCurrentDirectoryW.KERNEL32(?,00D71148,?,?,?,?,?,00CB3AA3,?), ref: 00D21D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00D4DAB4,00D71148,?,?,?,?,?,00CB3AA3,?), ref: 00D21D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00CB3AA3), ref: 00D21D90

Part of subcall function 00CB3E6E: GetSysColorBrush.USER32(0000000F), ref: 00CB3E79
Part of subcall function 00CB3E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00CB3E88
Part of subcall function 00CB3E6E: LoadIconW.USER32(00000063), ref: 00CB3E9E
Part of subcall function 00CB3E6E: LoadIconW.USER32(000000A4), ref: 00CB3EB0
Part of subcall function 00CB3E6E: LoadIconW.USER32(000000A2), ref: 00CB3EC2
Part of subcall function 00CB3E6E: RegisterClassExW.USER32(?), ref: 00CB3F30

Part of subcall function 00CB36B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00CB36E6
Part of subcall function 00CB36B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00CB3707
Part of subcall function 00CB36B8: ShowWindow.USER32(00000000,?,?,?,?,00CB3AA3,?), ref: 00CB371B
Part of subcall function 00CB36B8: ShowWindow.USER32(00000000,?,?,?,?,00CB3AA3,?), ref: 00CB3724

Part of subcall function 00CB4FFC: _memset.LIBCMT ref: 00CB5022
Part of subcall function 00CB4FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00CB50CB

Strings

runas, xrefs: 00D21D84
This is a third-party compiled AutoIt script., xrefs: 00D21CC8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-3287110873
Opcode ID: 78fdfefacac63ed2f162968fe45e213956473909471c7e95ee978f91a2ef11cd
Instruction ID: 90085482fbdac06c6ec722482120a99ebe35698ee71aa5e78c37e649bc2a6fb0
Opcode Fuzzy Hash: 78fdfefacac63ed2f162968fe45e213956473909471c7e95ee978f91a2ef11cd
Instruction Fuzzy Hash: 97512B34A043C4AECF11ABF8EC42EFE7B75AB15740F408165F915A7392EA748A49DB31

Function 00CCDDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00CCDDEC
GetCurrentProcess.KERNEL32(00000000,00D4DC38,?,?), ref: 00CCDEAC
GetNativeSystemInfo.KERNELBASE(?,00D4DC38,?,?), ref: 00CCDF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 00CCDF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 00CCDF1F
GetSystemInfo.KERNEL32(?,00D4DC38,?,?), ref: 00CCDF29
GetSystemInfo.KERNEL32(?,00D4DC38,?,?), ref: 00CCDF35

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: bcd19e45f21a045614f18e6875b49e6dfac828ca585787b8c4ad573526619baa
Instruction ID: 18d6b988da1b6a5ae871b8465a951533bdd62e03e43efcc055be98e8890d4f76
Opcode Fuzzy Hash: bcd19e45f21a045614f18e6875b49e6dfac828ca585787b8c4ad573526619baa
Instruction Fuzzy Hash: C16191B180A394DBCF15DF68D8C16EA7FB46F39304B1949EDD8469F207C624CA09CB65

Function 00CB406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00CB449E,?,?,00000000,00000001), ref: 00CB407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00CB449E,?,?,00000000,00000001), ref: 00CB4092
LoadResource.KERNEL32(?,00000000,?,?,00CB449E,?,?,00000000,00000001,?,?,?,?,?,?,00CB41FB), ref: 00D24F1A
SizeofResource.KERNEL32(?,00000000,?,?,00CB449E,?,?,00000000,00000001,?,?,?,?,?,?,00CB41FB), ref: 00D24F2F
LockResource.KERNEL32(00CB449E,?,?,00CB449E,?,?,00000000,00000001,?,?,?,?,?,?,00CB41FB,00000000), ref: 00D24F42

Strings

SCRIPT, xrefs: 00CB4088

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 660be2318024a170c97ac03356ad244e45b57aed641f7b62b1c64466bcb30506
Instruction ID: 0f48ddf8e9053c57945019e6baf8737bc49f486337ec506ecfe176943e881302
Opcode Fuzzy Hash: 660be2318024a170c97ac03356ad244e45b57aed641f7b62b1c64466bcb30506
Instruction Fuzzy Hash: D6115A74204701AFE7259B25EC48F677BBAEBC5B51F10412DFA12D62A0DB71DC008A31

Function 00CF6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00D22F49), ref: 00CF6CB9
FindFirstFileW.KERNELBASE(?,?), ref: 00CF6CCA
FindClose.KERNEL32(00000000), ref: 00CF6CDA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 55102a941467b7f7c18ec5604882a08ee8edd04e1c785b5ab6934ac5a3ed4818
Instruction ID: 32c66ce14826c9bc5a6dc8c482b600a74e51e6c59e0504d6537ca80833538435
Opcode Fuzzy Hash: 55102a941467b7f7c18ec5604882a08ee8edd04e1c785b5ab6934ac5a3ed4818
Instruction Fuzzy Hash: 7FE048318146155B82106738FC0D4F9776DDB15339F204715F5B5C12D0E770DA545AE6

Function 00CC3B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON

Download Yara Rule

Strings

@, xrefs: 00CC4176

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @
API String ID: 3728558374-2766056989
Opcode ID: 75f104ddd6884d55d15a2dc03deabec9aae89f72c72f14fd83abcdc43f46c76a
Instruction ID: 31f5a1ff812d605a396b686e1cd303d9bd579277c94f12f3799d71c3a4513ad1
Opcode Fuzzy Hash: 75f104ddd6884d55d15a2dc03deabec9aae89f72c72f14fd83abcdc43f46c76a
Instruction Fuzzy Hash: 1372AB70E042499FCB24DF94D481FAEB7B5EF48304F18C05EE91AAB291D731AE45DBA1

Function 00CC3200 Relevance: 1.0, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: d161368f49ea03ab85368f6393805375b960c4022b18ba62d9bb358bc4de9240
Instruction ID: ae9e0618d6279f2dd0daca32f7e6d4d7f2a76ac094a0aab2554f214c4a81cb94
Opcode Fuzzy Hash: d161368f49ea03ab85368f6393805375b960c4022b18ba62d9bb358bc4de9240
Instruction Fuzzy Hash: F6927B706083818FD724DF19D490F6ABBE1BF88308F14885DE99A8B362D771ED45DB62

Function 00CBE8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CBE959
timeGetTime.WINMM ref: 00CBEBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00CBED2E
TranslateMessage.USER32(?), ref: 00CBED3F
DispatchMessageW.USER32(?), ref: 00CBED4A
LockWindowUpdate.USER32(00000000), ref: 00CBED79
DestroyWindow.USER32 ref: 00CBED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00CBED9F
Sleep.KERNEL32(0000000A), ref: 00D25270
TranslateMessage.USER32(?), ref: 00D259F7
DispatchMessageW.USER32(?), ref: 00D25A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D25A19

Strings

@GUI_CTRLHANDLE, xrefs: 00D253AC
@GUI_WINHANDLE, xrefs: 00D25360
@TRAY_ID, xrefs: 00D254C9
@GUI_CTRLID, xrefs: 00D25314

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: dfbab06ae9928475c819099525dfc374ad5df17b17d389a86d6e66131423eb6a
Instruction ID: 72e2018b817bc3b473c59143651f1b9a901dfe4c9cde5352a01c8467f739c152
Opcode Fuzzy Hash: dfbab06ae9928475c819099525dfc374ad5df17b17d389a86d6e66131423eb6a
Instruction Fuzzy Hash: E062CF70508340DFEB24DF24E885FEA77E4BF54704F08496DE99A8B296DB70D848DB62

Function 00CE5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00CE5EC3
___createFile.LIBCMT ref: 00CE5F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00CE5F2D
__dosmaperr.LIBCMT ref: 00CE5F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00CE5F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00CE5F6A
__dosmaperr.LIBCMT ref: 00CE5F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00CE5F7C
__set_osfhnd.LIBCMT ref: 00CE5FAC
__lseeki64_nolock.LIBCMT ref: 00CE6016
__close_nolock.LIBCMT ref: 00CE603C
__chsize_nolock.LIBCMT ref: 00CE606C
__lseeki64_nolock.LIBCMT ref: 00CE607E
__lseeki64_nolock.LIBCMT ref: 00CE6176
__lseeki64_nolock.LIBCMT ref: 00CE618B
__close_nolock.LIBCMT ref: 00CE61EB

Part of subcall function 00CDEA9C: FindCloseChangeNotification.KERNELBASE(00000000,00D5EEF4,00000000,?,00CE6041,00D5EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00CDEAEC
Part of subcall function 00CDEA9C: GetLastError.KERNEL32(?,00CE6041,00D5EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00CDEAF6
Part of subcall function 00CDEA9C: __free_osfhnd.LIBCMT ref: 00CDEB03
Part of subcall function 00CDEA9C: __dosmaperr.LIBCMT ref: 00CDEB25

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

__lseeki64_nolock.LIBCMT ref: 00CE620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00CE6342
___createFile.LIBCMT ref: 00CE6361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00CE636E
__dosmaperr.LIBCMT ref: 00CE6375
__free_osfhnd.LIBCMT ref: 00CE6395
__invoke_watson.LIBCMT ref: 00CE63C3
__wsopen_helper.LIBCMT ref: 00CE63DD

Strings

@, xrefs: 00CE5F98

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$Close___create$Handle__close_nolock__free_osfhnd$ChangeFindNotificationType__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3388700018-2766056989
Opcode ID: 67aca663f0751f558f19b512f23fd02c3924f3a943163e079ef7614317f1e927
Instruction ID: ee122960c6fc8e74ec65c1e72d5baa98948aa9f9ff64381af31c1b2ba1349eac
Opcode Fuzzy Hash: 67aca663f0751f558f19b512f23fd02c3924f3a943163e079ef7614317f1e927
Instruction Fuzzy Hash: D32267719106869FEF259F6ACC45BBD7B21EB20368F244229E631DB2D2D3358F40DB51

Function 00CDEE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 298538bd2233f808842afc5ff840a6ff8b87c07a43e1ed57200f69c9601c17ad
Instruction ID: 89c196494680f555c27b055fb5b34bcb80f189743bf9d7166a86f81c224cc341
Opcode Fuzzy Hash: 298538bd2233f808842afc5ff840a6ff8b87c07a43e1ed57200f69c9601c17ad
Instruction Fuzzy Hash: 1E322671A04245DFDB219F58D840BAD7BB1BF45310F28416FEAA69F392D7309943CB61

Function 00CFFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00CFFA96
_wcschr.LIBCMT ref: 00CFFAA4
_wcscpy.LIBCMT ref: 00CFFABB
_wcscat.LIBCMT ref: 00CFFACA
_wcscat.LIBCMT ref: 00CFFAE8
_wcscpy.LIBCMT ref: 00CFFB09
__wsplitpath.LIBCMT ref: 00CFFBE6
_wcscpy.LIBCMT ref: 00CFFC0B
_wcscpy.LIBCMT ref: 00CFFC1D
_wcscpy.LIBCMT ref: 00CFFC32
_wcscat.LIBCMT ref: 00CFFC47
_wcscat.LIBCMT ref: 00CFFC59
_wcscat.LIBCMT ref: 00CFFC6E

Part of subcall function 00CFBFA4: _wcscmp.LIBCMT ref: 00CFC03E
Part of subcall function 00CFBFA4: __wsplitpath.LIBCMT ref: 00CFC083
Part of subcall function 00CFBFA4: _wcscpy.LIBCMT ref: 00CFC096
Part of subcall function 00CFBFA4: _wcscat.LIBCMT ref: 00CFC0A9
Part of subcall function 00CFBFA4: __wsplitpath.LIBCMT ref: 00CFC0CE
Part of subcall function 00CFBFA4: _wcscat.LIBCMT ref: 00CFC0E4
Part of subcall function 00CFBFA4: _wcscat.LIBCMT ref: 00CFC0F7

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CFFA61

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: a1e57e98c2a192e3940deaea8eb21428551c5c8335ce9eee5d853efec890036c
Instruction ID: ba5154734a68ae46838e6ee2e21d1d4ffc9d2c3bd07e9a904837dca070de1f96
Opcode Fuzzy Hash: a1e57e98c2a192e3940deaea8eb21428551c5c8335ce9eee5d853efec890036c
Instruction Fuzzy Hash: C0919072504205AFDB20EF54C851FABB3E9FF84310F04486EFA59972A1DB30EA45DB92

Function 00CB3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CB3F86
RegisterClassExW.USER32(00000030), ref: 00CB3FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CB3FC1
InitCommonControlsEx.COMCTL32(?), ref: 00CB3FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CB3FEE
LoadIconW.USER32(000000A9), ref: 00CB4004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CB4013

Strings

TaskbarCreated, xrefs: 00CB3FB6
AutoIt v3 GUI, xrefs: 00CB3FA2
+, xrefs: 00CB3F6F
0, xrefs: 00CB3F68

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 21cf059f291816d80c83859dbaf4a89db0f21ff77e9e1f7ebc6d4d5b300d58bb
Instruction ID: 343cb93fb45ccac7708713cec2f37e229890778f63e7f35040c22cdea5208302
Opcode Fuzzy Hash: 21cf059f291816d80c83859dbaf4a89db0f21ff77e9e1f7ebc6d4d5b300d58bb
Instruction Fuzzy Hash: 942195B9910319AFDB40DFA9E889BCDBBB5FB08710F00421AF515E63A0E7B54584CFA1

Function 00CFBFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CFBDB4: __time64.LIBCMT ref: 00CFBDBE

Part of subcall function 00CB4517: _fseek.LIBCMT ref: 00CB452F

__wsplitpath.LIBCMT ref: 00CFC083

Part of subcall function 00CD1DFC: __wsplitpath_helper.LIBCMT ref: 00CD1E3C

_wcscpy.LIBCMT ref: 00CFC096
_wcscat.LIBCMT ref: 00CFC0A9
__wsplitpath.LIBCMT ref: 00CFC0CE
_wcscat.LIBCMT ref: 00CFC0E4
_wcscat.LIBCMT ref: 00CFC0F7
_wcscmp.LIBCMT ref: 00CFC03E

Part of subcall function 00CFC56D: _wcscmp.LIBCMT ref: 00CFC65D
Part of subcall function 00CFC56D: _wcscmp.LIBCMT ref: 00CFC670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CFC2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CFC338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CFC34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CFC35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CFC371

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 2378138488-0
Opcode ID: 96ede4bcd9bf09be91a71d7a949ed7a02dfffaddebc972cf3636eb345d8a3344
Instruction ID: 616f8503913f78159ce313d3ccffd4475d5a501bb7c53abf5af37bd5b492e32f
Opcode Fuzzy Hash: 96ede4bcd9bf09be91a71d7a949ed7a02dfffaddebc972cf3636eb345d8a3344
Instruction Fuzzy Hash: EBC12BB1A0021DABDF15DF95CD81EEEB7BDEF49310F0080AAF609E6151DB309A449F62

Function 00CB3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00CB37B3
KillTimer.USER32(?,00000001), ref: 00CB37DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00CB3800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CB380B
CreatePopupMenu.USER32 ref: 00CB381F
PostQuitMessage.USER32(00000000), ref: 00CB382E

Strings

TaskbarCreated, xrefs: 00CB3806

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: dc269a2d414fc5fd7c9655a48ff044037edb8f06c8fcd2d611d7d4c8e8df5bf8
Instruction ID: 0d93378c85e9a83a82a8b1e03a694f098eaf1021bfaf53e96151ec8b1656cd42
Opcode Fuzzy Hash: dc269a2d414fc5fd7c9655a48ff044037edb8f06c8fcd2d611d7d4c8e8df5bf8
Instruction Fuzzy Hash: DC4126F92043DAABDB145F6CEE4ABFA3755F710300F444219F916E2291EF609E909772

Function 00CB3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00CB3E79
LoadCursorW.USER32(00000000,00007F00), ref: 00CB3E88
LoadIconW.USER32(00000063), ref: 00CB3E9E
LoadIconW.USER32(000000A4), ref: 00CB3EB0
LoadIconW.USER32(000000A2), ref: 00CB3EC2

Part of subcall function 00CB4024: LoadImageW.USER32(00CB0000,00000063,00000001,00000010,00000010,00000000), ref: 00CB4048

RegisterClassExW.USER32(?), ref: 00CB3F30

Part of subcall function 00CB3F53: GetSysColorBrush.USER32(0000000F), ref: 00CB3F86
Part of subcall function 00CB3F53: RegisterClassExW.USER32(00000030), ref: 00CB3FB0
Part of subcall function 00CB3F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00CB3FC1
Part of subcall function 00CB3F53: InitCommonControlsEx.COMCTL32(?), ref: 00CB3FDE
Part of subcall function 00CB3F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00CB3FEE
Part of subcall function 00CB3F53: LoadIconW.USER32(000000A9), ref: 00CB4004
Part of subcall function 00CB3F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00CB4013

Strings

0, xrefs: 00CB3F02
#, xrefs: 00CB3F09
AutoIt v3, xrefs: 00CB3F1F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 9ae4ba1e47041aa245bf05819b41e9f37f378cfc4622dcb11fe4616a6145c6f5
Instruction ID: f98ca442a8f031682ac83fac540b9738638e9b8af49597e5ce7b9f5e49e59170
Opcode Fuzzy Hash: 9ae4ba1e47041aa245bf05819b41e9f37f378cfc4622dcb11fe4616a6145c6f5
Instruction Fuzzy Hash: AD212FB4D00354ABCB10DFA9EC46A99BBF5EB48310F50422AE619E63A0E7754680DFB1

Function 00CB49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00CB4A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00D241DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00D2421A
RegCloseKey.ADVAPI32(?), ref: 00D24249

Strings

Software\AutoIt v3\AutoIt, xrefs: 00CB4A13
Include, xrefs: 00D241D3, 00D24212

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 8ff336dbc3279f35690513dbfb2de1b19a04c02c02322c404c0cfc1701ff40f0
Instruction ID: 4018e8134ed918323ad39e159da1a532ab13b89e1f1d1dee349ccf9d438b96f2
Opcode Fuzzy Hash: 8ff336dbc3279f35690513dbfb2de1b19a04c02c02322c404c0cfc1701ff40f0
Instruction Fuzzy Hash: FD113D71600219BFEB08EBA4DD86DEF7BADEF15744F004059B506E6191EB70AE05EB60

Function 00CB36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00CB36E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00CB3707
ShowWindow.USER32(00000000,?,?,?,?,00CB3AA3,?), ref: 00CB371B
ShowWindow.USER32(00000000,?,?,?,?,00CB3AA3,?), ref: 00CB3724

Strings

edit, xrefs: 00CB3701
AutoIt v3, xrefs: 00CB36DE, 00CB36E3, 00CB36E4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: ae36b25be98b6e706eeb909030ef6b5f0c748a05c189975a1c830e11d70f941f
Instruction ID: 20bf847ceafbb81378f291996d4684e36cf59499592342879582073c01259a55
Opcode Fuzzy Hash: ae36b25be98b6e706eeb909030ef6b5f0c748a05c189975a1c830e11d70f941f
Instruction Fuzzy Hash: 4EF0DA795403D07AE731676BAC0AE673E7EE7C6F60F00011EBA09E23A0D56108D9DAB1

Function 00CB51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00CB522F
_wcscpy.LIBCMT ref: 00CB5283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00CB5293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00D23CB0

Strings

Line: , xrefs: 00D23CD9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 4516e2ea702d091967a6fbb94223acce9922ad9e90deaca50a0bd1d0c83f790c
Instruction ID: 813170314cdcb11d9e7d133bf956819316259d85b5d0775a430cca5b3e528219
Opcode Fuzzy Hash: 4516e2ea702d091967a6fbb94223acce9922ad9e90deaca50a0bd1d0c83f790c
Instruction Fuzzy Hash: 3531D3755083406FD325EB64EC42FDF77D8AF44300F00461EF59992191EB74A648DBA7

Function 00CB4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB41A9: LoadLibraryExW.KERNELBASE(00000001,00000000,00000002,?,?,?,?,00CB39FE,?,00000001), ref: 00CB41DB

_free.LIBCMT ref: 00D236B7
_free.LIBCMT ref: 00D236FE

Part of subcall function 00CBC833: __wsplitpath.LIBCMT ref: 00CBC93E
Part of subcall function 00CBC833: _wcscpy.LIBCMT ref: 00CBC953
Part of subcall function 00CBC833: _wcscat.LIBCMT ref: 00CBC968
Part of subcall function 00CBC833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00CBC978

Strings

Bad directive syntax error, xrefs: 00D236E4
>>>AUTOIT SCRIPT<<<, xrefs: 00D23491

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: a6bedb35070d622a2ecba9980e1d58640af4a0b5aef0d464e6b7d31b24a41341
Instruction ID: 6e11019da20b2c680c9544dd8fc4ef1f200136cbc260efea2167267e80b07caa
Opcode Fuzzy Hash: a6bedb35070d622a2ecba9980e1d58640af4a0b5aef0d464e6b7d31b24a41341
Instruction Fuzzy Hash: 7C919171910229AFCF04EFA4DC919EEB7B4FF18314F04442AF916AB291DB34DA05DB60

Function 00CB4A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB5374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00D71148,?,00CB61FF,?,00000000,00000001,00000000), ref: 00CB5392

Part of subcall function 00CB49FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00CB4A1D

_wcscat.LIBCMT ref: 00D22D80
_wcscat.LIBCMT ref: 00D22DB5

Strings

\Include\, xrefs: 00CB4B0A
\, xrefs: 00D22DA2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: \$\Include\
API String ID: 3592542968-2640467822
Opcode ID: cffb32fbc153dee314845beda3eecdaa276cabfb9ea4b5e96974aebf07cbc7be
Instruction ID: 0448dc6e10aa430f27bd86b84edebe471a32fc1631211083dc16b0bc9d69d7f4
Opcode Fuzzy Hash: cffb32fbc153dee314845beda3eecdaa276cabfb9ea4b5e96974aebf07cbc7be
Instruction Fuzzy Hash: 435130724043809BC714EF59E9829AAB7F4FE99310F80452EFA49D3361FB309648DB72

Function 00CD34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 00CD34FE

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00CD3539
__wopenfile.LIBCMT ref: 00CD3549

Strings

<G, xrefs: 00CD34CD, 00CD34F0, 00CD34FC

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 8cb966b47155364ea47ec54206e1aca9e5aaaf5715bf49e221825351df152dbe
Instruction ID: 0623a7517e45c8ea4a39c6cc47eff176c97d3560ef2d021d913edf0ef459b575
Opcode Fuzzy Hash: 8cb966b47155364ea47ec54206e1aca9e5aaaf5715bf49e221825351df152dbe
Instruction Fuzzy Hash: 22110A71A002069FDB12BF759C4266E3AA4AF45750B158527E615DB381FB34CB01B7B2

Function 00CCD298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00CCD28B,SwapMouseButtons,00000004,?), ref: 00CCD2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00CCD28B,SwapMouseButtons,00000004,?,?,?,?,00CCC865), ref: 00CCD2DD
RegCloseKey.KERNELBASE(00000000,?,?,00CCD28B,SwapMouseButtons,00000004,?,?,?,?,00CCC865), ref: 00CCD2FF

Strings

Control Panel\Mouse, xrefs: 00CCD2BA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 838c17714a5c5f0c402221c3785d278876f86400387b12c73100b0bbf47b6f5a
Instruction ID: bd2043093cf8f65b6062f09406923ece7758e63a5e4e45abe62764347da65a88
Opcode Fuzzy Hash: 838c17714a5c5f0c402221c3785d278876f86400387b12c73100b0bbf47b6f5a
Instruction Fuzzy Hash: 891139B5611218BFDB208FA8DC84EAF7BB8EF44784F144469E806D7220E731AE419B61

Function 00CD365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD36B7
_memcpy_s.LIBCMT ref: 00CD3729
__filbuf.LIBCMT ref: 00CD37AA
_memset.LIBCMT ref: 00CD37EE

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 7d60133a7a365bd017ed6c9b9812aad79251c6c14bca70c9996c5f681f8249aa
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: A151C2B0A00685ABCB249F69898466E77A1BF40320F24872BFA35963D0D770DF51DB52

Function 00CB40E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D23725
GetOpenFileNameW.COMDLG32 ref: 00D2376F

Part of subcall function 00CB660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CB53B1,?,?,00CB61FF,?,00000000,00000001,00000000), ref: 00CB662F

Part of subcall function 00CB40A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CB40C6

Strings

X, xrefs: 00D2373E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 78c887430f55ce7e13f58faa67f30bd4f9120667da2e07cd4005c0cbb2dbf5d4
Instruction ID: 3f4ecf61794d73483717fb78da56aa6369f6e850ea7f45f53744e48f72a384c2
Opcode Fuzzy Hash: 78c887430f55ce7e13f58faa67f30bd4f9120667da2e07cd4005c0cbb2dbf5d4
Instruction Fuzzy Hash: F421D571A10298ABCF05DF98D845BEEBBFD9F49304F00401AE505E7381DBB89A899F65

Function 00CFC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00CFC72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00CFC746

Strings

aut, xrefs: 00CFC740

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 655425c51e81a7dc0d2fe3df4b6d5902a18d3a9c7408a9e3fd82acd8b96d5988
Instruction ID: 071aacb00c690856cf35f4fb4806826b99cdbb67e1989fadf8f04aec9fd1b1b4
Opcode Fuzzy Hash: 655425c51e81a7dc0d2fe3df4b6d5902a18d3a9c7408a9e3fd82acd8b96d5988
Instruction Fuzzy Hash: ECD05E7550030EABDB10ABA0EC0EF8B776C9704704F0001A17650E91B1DAB0E6998F68

Function 00D0F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d2e631b4a545df2d2b5333f1b4f147e6a5ff32682a9799cb14b7d017bbc106
Instruction ID: 98e06eb74a30d712d99eed10baf1538ae517a5cabffaca19688967b0f80e2f8e
Opcode Fuzzy Hash: a1d2e631b4a545df2d2b5333f1b4f147e6a5ff32682a9799cb14b7d017bbc106
Instruction Fuzzy Hash: A4F159716083019FC720DF24C481B6AB7E5FF88314F24892EF9999B292DB70E945CF92

Function 00CB4FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB5022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00CB50CB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: ebed82720f811ded251fa2d40054712f7af0fa13bcaf951afa6eabbb06f6f43b
Instruction ID: f4cf523282340c45613151efbe5c757dc4d86dc0cb8505fbe51278cfb95b9e85
Opcode Fuzzy Hash: ebed82720f811ded251fa2d40054712f7af0fa13bcaf951afa6eabbb06f6f43b
Instruction Fuzzy Hash: 25314CB55047018FD761EF28E8457DBBBE4FB49308F00092EE69EC6351E7716A84CBA2

Function 00CD395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00CD3973

Part of subcall function 00CD81C2: __NMSG_WRITE.LIBCMT ref: 00CD81E9
Part of subcall function 00CD81C2: __NMSG_WRITE.LIBCMT ref: 00CD81F3

__NMSG_WRITE.LIBCMT ref: 00CD397A

Part of subcall function 00CD821F: GetModuleFileNameW.KERNEL32(00000000,00D70312,00000104,00000000,00000001,00000000), ref: 00CD82B1
Part of subcall function 00CD821F: ___crtMessageBoxW.LIBCMT ref: 00CD835F

Part of subcall function 00CD1145: ___crtCorExitProcess.LIBCMT ref: 00CD114B
Part of subcall function 00CD1145: ExitProcess.KERNEL32 ref: 00CD1154

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

RtlAllocateHeap.NTDLL(01610000,00000000,00000001,00000001,00000000,?,?,00CCF507,?,0000000E), ref: 00CD399F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 4dcd107729a330fce6a5b318a4599a60176a0d506bfc48a1f5660dcf310a47fc
Instruction ID: 9970feba52601b04529518fa86ac6e1b20fd9836edbe65d20d1b0138c8820642
Opcode Fuzzy Hash: 4dcd107729a330fce6a5b318a4599a60176a0d506bfc48a1f5660dcf310a47fc
Instruction Fuzzy Hash: 5201B935345341AAE6113B25EC66A2E73489BC1760F25012BFB15D73C1EFF0DE409671

Function 00CFC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00CFC385,?,?,?,?,?,00000004), ref: 00CFC6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00CFC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00CFC708
CloseHandle.KERNEL32(00000000,?,00CFC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CFC70F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: a16885f68d2436fab89b3fe20379fa5cbecc69c8f56d771aa8016c1dffbe06fb
Instruction ID: ff5599a79d4f017405e3c1302f2fdef472393b66f0ace820fb116f3814432fcd
Opcode Fuzzy Hash: a16885f68d2436fab89b3fe20379fa5cbecc69c8f56d771aa8016c1dffbe06fb
Instruction Fuzzy Hash: 24E08632240318BBD7212B54BC09FCA7B19AB05760F104110FB25A91E097B12A119BA9

Function 00CFBB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00CFBB72

Part of subcall function 00CD1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00CD7A85), ref: 00CD1CB1
Part of subcall function 00CD1C9D: GetLastError.KERNEL32(00000000,?,00CD7A85), ref: 00CD1CC3

_free.LIBCMT ref: 00CFBB83
_free.LIBCMT ref: 00CFBB95

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8aabdc7c5b8b24ec3e6cd746ab92beece9ca5442ccfa872a0ae046f14ec4a344
Instruction ID: e7c1b8efe96466f91c4a5f98f20ededbacd87063c04f3d31d87e0e4d4b1fc436
Opcode Fuzzy Hash: 8aabdc7c5b8b24ec3e6cd746ab92beece9ca5442ccfa872a0ae046f14ec4a344
Instruction Fuzzy Hash: 03E02BA130070153CA306538EE44EB313CC0F44312718080FBB3AE3242DF20FC4094B4

Function 00CB2322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00CB22A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00CB24F1), ref: 00CB2303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00CB25A1
CoInitialize.OLE32(00000000), ref: 00CB2618
CloseHandle.KERNEL32(00000000), ref: 00D2503A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: fa13064c7d068fc424374f1b358692e34452df743a85fcecb497e891016f13d5
Instruction ID: e212e1acb81de6117576d56b5a8db8961c603c4aba926011f1c219158ce19044
Opcode Fuzzy Hash: fa13064c7d068fc424374f1b358692e34452df743a85fcecb497e891016f13d5
Instruction Fuzzy Hash: D471BDBC9113818BC704EF6EA892599BBA5BB99344B80436ED50DDB772FB304484DF39

Function 00CFBBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00CFBC18

Strings

EA06, xrefs: 00CFBC46

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 093fd6cab2d736a3ab2b49815be26858c09ac3a790125d6ea2598660ff30ffc4
Instruction ID: 22f37aaa7a267a95d02f438ccbccfb29ce411f3e18cf12fd94a76dba480a7dbe
Opcode Fuzzy Hash: 093fd6cab2d736a3ab2b49815be26858c09ac3a790125d6ea2598660ff30ffc4
Instruction Fuzzy Hash: 7C01F5729042587EDB68C7A8CC16FFEBBF89B05301F00415FF292D2281E5B4A7089B60

Function 00CFFE7E Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00CFFEDD
GetLastError.KERNEL32(00000002,00000000), ref: 00CFFF96

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLast__wsplitpath
String ID:
API String ID: 2679896820-0
Opcode ID: b4e89bda3ea8252229d292454760712192818eccb3178f7cd51194b69e253d91
Instruction ID: c2c23c0b0dea71f5b61163204044e3a92429c7b7e3ec6974865231117fb92c14
Opcode Fuzzy Hash: b4e89bda3ea8252229d292454760712192818eccb3178f7cd51194b69e253d91
Instruction Fuzzy Hash: C85171312043059FC758EF64C491BAAB3E5EF49310F04856DFA6A8B2D2DB30E946DB52

Function 00CB3A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00CB3A73

Part of subcall function 00CD1405: __lock.LIBCMT ref: 00CD140B

Part of subcall function 00CB3ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00CB3AF3
Part of subcall function 00CB3ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00CB3B08

Part of subcall function 00CB3D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00CB3AA3,?), ref: 00CB3D45
Part of subcall function 00CB3D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00CB3AA3,?), ref: 00CB3D57
Part of subcall function 00CB3D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00D71148,00D71130,?,?,?,?,00CB3AA3,?), ref: 00CB3DC8
Part of subcall function 00CB3D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00CB3AA3,?), ref: 00CB3E48

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00CB3AB3

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: 68c75a7e2dbbdc123d79d9cfa11e3a0d3d460676d43041d64af69802e3ad0808
Instruction ID: ff7f530a71042aad983ab0f567e488f4792d906530726039f827b4ae6fae0982
Opcode Fuzzy Hash: 68c75a7e2dbbdc123d79d9cfa11e3a0d3d460676d43041d64af69802e3ad0808
Instruction Fuzzy Hash: 5211C0715043809FC300EF69EC0591ABBE8FB94350F008A1FF989C33A1EB709584CBA2

Function 00CB47FF Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00CB4582,?,?,?,?,00CB2E1A), ref: 00CB482D
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00CB4582,?,?,?,?,00CB2E1A), ref: 00D24089

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e9cda31b49f65a5a39beef44335a745300c2af6e34486ac4cb54a4cdd38d1167
Instruction ID: 88fcb8bdf7f9a6767a24a1babe889f943469bc4bef17ec77bc1047ef700053eb
Opcode Fuzzy Hash: e9cda31b49f65a5a39beef44335a745300c2af6e34486ac4cb54a4cdd38d1167
Instruction Fuzzy Hash: 5B019270148358BEF7240E24DD8AFA63ADEEB1176CF108318FAE59A1E1C6B25D45CB60

Function 00CDE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00CDEA29
__close_nolock.LIBCMT ref: 00CDEA42

Part of subcall function 00CD7BDA: __getptd_noexit.LIBCMT ref: 00CD7BDA

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: 6339d7c147877259f8970d562fccd065ba0ca29bc816dde818315d0a394ba363
Instruction ID: d669bd6f3a90d65e6db148b382521e2a8bfc4c0d0dc86244564882a95ad9ddd2
Opcode Fuzzy Hash: 6339d7c147877259f8970d562fccd065ba0ca29bc816dde818315d0a394ba363
Instruction Fuzzy Hash: B311A0728056119FD312BB6488413583E606F81335F2A4347E6385F3E3DBB48D40FAA5

Function 00CCF4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00CD395C: __FF_MSGBANNER.LIBCMT ref: 00CD3973
Part of subcall function 00CD395C: __NMSG_WRITE.LIBCMT ref: 00CD397A
Part of subcall function 00CD395C: RtlAllocateHeap.NTDLL(01610000,00000000,00000001,00000001,00000000,?,?,00CCF507,?,0000000E), ref: 00CD399F

std::exception::exception.LIBCMT ref: 00CCF51E
__CxxThrowException@8.LIBCMT ref: 00CCF533

Part of subcall function 00CD6805: RaiseException.KERNEL32(?,?,0000000E,00D66A30,?,?,?,00CCF538,0000000E,00D66A30,?,00000001), ref: 00CD6856

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 784406f1067309fb754c93932a19ba50e879b7f664f7a83b933436763e904bab
Instruction ID: f003efdf0566e5c3232e23a5c81e29011e2f27dc4bff2e250e296fca65b066dc
Opcode Fuzzy Hash: 784406f1067309fb754c93932a19ba50e879b7f664f7a83b933436763e904bab
Instruction Fuzzy Hash: 70F0AF3110421EA7DB05FF98ED01EDE77AAAF00354F60442EFA19E2281DBB0D746A6B5

Function 00CD3839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD3868
__lock_file.LIBCMT ref: 00CD3889

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: a1df3fbac1b9e4d4cc97f4f0f1da6c6a84a996d21856ff01e3e65108cf157589
Instruction ID: e2da0fe647d1f9b1e82c5bb7a4f591acae1f8977ab62fd44a5b59cb8d5abc4ca
Opcode Fuzzy Hash: a1df3fbac1b9e4d4cc97f4f0f1da6c6a84a996d21856ff01e3e65108cf157589
Instruction Fuzzy Hash: 48014471800249FBCF22AFA59C0559EBB61BF80760F15421BFA24563A1D7718B61FB92

Function 00CD35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

__lock_file.LIBCMT ref: 00CD3629

Part of subcall function 00CD4E1C: __lock.LIBCMT ref: 00CD4E3F

__fclose_nolock.LIBCMT ref: 00CD3634

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 41ee454130c33e58d7cd5f80c0731337f69ff1e9453f90aed8b154a29d7ec4cc
Instruction ID: 3b0d81957419b89df84a5d24031074e4200cadd0937f19290458983bbb86650f
Opcode Fuzzy Hash: 41ee454130c33e58d7cd5f80c0731337f69ff1e9453f90aed8b154a29d7ec4cc
Instruction Fuzzy Hash: 90F09671801644AAD7117B65880675E76A06F41734F25811BF664AB3C1C77CC702BA56

Function 00CBC1DE Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00000000,?,?,00CCE581,00000010,?,00000010,?,00000000), ref: 00CBC1F4
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00000000,?,?,00CCE581,00000010,?,00000010,?,00000000), ref: 00CBC224

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 31efcc8312e4eac44f8aa89e29a7c65ba6a35cbfa620bce133eaace26861c70d
Instruction ID: 800bfdbc9994dc4a751f9824a753869547b7aa3d081a08ebe2a2e93786aaaec8
Opcode Fuzzy Hash: 31efcc8312e4eac44f8aa89e29a7c65ba6a35cbfa620bce133eaace26861c70d
Instruction Fuzzy Hash: F3018671200204BFEB156B65DC86FBB7B5DEF95760F108129FA05CE1D0DA71E94096B1

Function 00CD2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00CD2A0B

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 6af612914d2be79ce9f7bf946ad4d31c69f7cd0c7f5e199e85fda340fb791d2b
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: 1E41C8307007069FDB288E69C89056EB7A6EF64360B24852FE659C7344D770DE41AB50

Function 00CB46CE Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00CB4774

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 193810976a0ad1d8bc146ea55312f9f1a43137dc8d0dda318d7bd2695e82634d
Instruction ID: 16fd8ea250e62bc3a73ea382ad019a7924a1831fdfbc4abfc1f4aa08ed02b717
Opcode Fuzzy Hash: 193810976a0ad1d8bc146ea55312f9f1a43137dc8d0dda318d7bd2695e82634d
Instruction Fuzzy Hash: 82315E31A14615AFCB08CF6DD484AADB7B5FF49310F158629E829A7701DB70BDA0CB90

Function 00D29A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00D29A80

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4b5247439353b97c6454c036e056d0f1bc2601aa38442fedf7ffa408c0af1b2f
Instruction ID: 89e89140ec1adf98e9fff701fcb32eff14c15042f37ab997d57e5a3f4fb9dae0
Opcode Fuzzy Hash: 4b5247439353b97c6454c036e056d0f1bc2601aa38442fedf7ffa408c0af1b2f
Instruction Fuzzy Hash: 8C414A70508651CFDB24DF19C484F1ABBE1BF45308F2989ACE99A4B362C372E846DF52

Function 00CDED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 4d87b248fb76d7444d66ecdac230c2345944d14e00dfa53683402d8d6b4337eb
Instruction ID: 8e5b766d350817cda87b153af966e355f2e9238745bcc82baf043a8b7882400a
Opcode Fuzzy Hash: 4d87b248fb76d7444d66ecdac230c2345944d14e00dfa53683402d8d6b4337eb
Instruction Fuzzy Hash: 12215B728146409FD7127FA888453593A626F82736F260743E6754F3E2EBB48940AAA1

Function 00CB41A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB4214: FreeLibrary.KERNEL32(00000000,?), ref: 00CB4247

LoadLibraryExW.KERNELBASE(00000001,00000000,00000002,?,?,?,?,00CB39FE,?,00000001), ref: 00CB41DB

Part of subcall function 00CB4291: FreeLibrary.KERNEL32(00000000), ref: 00CB42C4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: 2d0f6fd72d2b92ea66330594b1b9fa01a975445890544b7628537d32c42388da
Instruction ID: 413b439d284c117da0e4f6460545001fb77a359a2ff4d4d191e1f63f935e4cdc
Opcode Fuzzy Hash: 2d0f6fd72d2b92ea66330594b1b9fa01a975445890544b7628537d32c42388da
Instruction Fuzzy Hash: 9C11E331648316BADF18BB70DD06FEE77A99F40700F108429F996A61C2DB70DE04BB62

Function 00D29B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00D29B51

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 86fd9af094d27756e800d3a0d20878133be52f923c205802b56a9fe4f2f834be
Instruction ID: 565e41a957a6a3cdc8bb50343bd93ff8d6a98966ac2bb913518fd9aa62a44cd7
Opcode Fuzzy Hash: 86fd9af094d27756e800d3a0d20878133be52f923c205802b56a9fe4f2f834be
Instruction Fuzzy Hash: D5212470508601CFDB24DF69C444F1ABBF1BF84304F24896CEAAA8B262C731E846DF52

Function 00CDAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00CDAFC0

Part of subcall function 00CD7BDA: __getptd_noexit.LIBCMT ref: 00CD7BDA

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 9450d38db0ba21b32f87af7bc7e2d5c3d9de387603b6c335d7b1ece2a3a7d0a8
Instruction ID: 77f16cba97e11df1030ba95404e272980dd7b716ac574b5b19b68c3ad85f99cd
Opcode Fuzzy Hash: 9450d38db0ba21b32f87af7bc7e2d5c3d9de387603b6c335d7b1ece2a3a7d0a8
Instruction Fuzzy Hash: 2511B2B2804600DFD7127FA4884575A7A609F81331F1A4387E7754F3E2E7B59D40ABA1

Function 00CBC2E0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00010000,00000000,00000000,00000000,00D4DC00,00000000,?,00CB464E,00D4DC00,00010000,00000000,00000000,00000000,00000000), ref: 00CBC337

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 44c8049343225a60b84514c2d34758adb9f40d3945588964218bf5fa8002d220
Instruction ID: 060b36254a4c0a23964684d450421a26ffa75c579cb85bc9e2cd43188f689fcf
Opcode Fuzzy Hash: 44c8049343225a60b84514c2d34758adb9f40d3945588964218bf5fa8002d220
Instruction Fuzzy Hash: C9115731200B419FD720CF4AC880FAAB7E9AF44754F54C41EE5AA8BA60C7B1ED44CB60

Function 00CB39DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 650b71de3c9a30fbac77a3276d03968b028a674fcee853f14ed520da4f0fcb35
Instruction ID: 904e85980879d1289604238cf3b593da33e4efdfa3f8f42ad1faba842e44d61c
Opcode Fuzzy Hash: 650b71de3c9a30fbac77a3276d03968b028a674fcee853f14ed520da4f0fcb35
Instruction Fuzzy Hash: 6B01493150410DBFCF05EFA5C9918FEBB78EF20344F148025F566971A6EA309A49EF61

Function 00CD2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00CD2AED

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 2d170f49d8b2120072c3c1197559853dbf561d4e543f23b69219fb281b1f7501
Instruction ID: 3f7a9463a92fdb95b8c2aec126a746730a0109df45fc1194550b4295a5176c21
Opcode Fuzzy Hash: 2d170f49d8b2120072c3c1197559853dbf561d4e543f23b69219fb281b1f7501
Instruction Fuzzy Hash: CFF06D31A00205EBDF21AF698C0679F3AA5BF50320F158517F6289A391D7B8CA52FB51

Function 00CB4252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00CB39FE,?,00000001), ref: 00CB4286

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 8deb6a227066f2b718faf9100d2859b537d99b53b12b305b4131dc52f7a85d0b
Instruction ID: 95c2918255cafa855ca439c0c90ea6569cc0e883a3f35c24f73f8a11441b517a
Opcode Fuzzy Hash: 8deb6a227066f2b718faf9100d2859b537d99b53b12b305b4131dc52f7a85d0b
Instruction Fuzzy Hash: E7F03971509702CFCB389F65E890896BBE5BF143257248A3EF1E682612C7729940EF52

Function 00CB40A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00CB40C6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: c2dea4fcffe63fd684cd87fd40116ad2929c5add4fd9b2b921ca16c6823eebeb
Instruction ID: 1aadbe09c2053a965f3423ed6dc95f9197f2f287d8c0e1c0f35b9e4ffa0e9b74
Opcode Fuzzy Hash: c2dea4fcffe63fd684cd87fd40116ad2929c5add4fd9b2b921ca16c6823eebeb
Instruction Fuzzy Hash: 4DE0CD375003245BC711A654DC46FEA779DDF88690F090175F905D7344DA649981A690

Function 00CFBCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00CFBD16

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: 9dfd385e403eee4441b5ca52cda542dbfc8062746dd30fe181214ea14fcc869a
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: 9BE092B1104B449BD7788A24D800BF373E0EB05305F00081DF2AA83245EB627C41865A

Function 00CB4798 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00D240EA,00000000,00000000,00000000), ref: 00CB47A9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f3f44545d9feecf7c8212c310aec738bcb4c9b800d1c6f649d655c52051730a1
Instruction ID: f8e58601c0e221ccfcd9f93fff1e33c2dd9d2603f7fce1b06d8d49fcb2d41640
Opcode Fuzzy Hash: f3f44545d9feecf7c8212c310aec738bcb4c9b800d1c6f649d655c52051730a1
Instruction Fuzzy Hash: CAD0C974640308BFEB00CB90DC46F9A7BBDEB04718F200194F600A62D0D2F2BE408B65

Function 00CCED18 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00CCEDC7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: ff94341334c8fdc16cf664164d8daa9f7fc298d717af0e677f6624b1a760e0a2
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: F031D6B5A00105DBD718DF59C480E69FBB6FF4A340B6486A9E41ACB356DB31EEC1CB90

Non-executed Functions

Function 00D1F7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00D1F87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D1F8DC
GetWindowLongW.USER32(?,000000F0), ref: 00D1F919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D1F940
SendMessageW.USER32 ref: 00D1F966
_wcsncpy.LIBCMT ref: 00D1F9D2
GetKeyState.USER32(00000011), ref: 00D1F9F3
GetKeyState.USER32(00000009), ref: 00D1FA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D1FA16
GetKeyState.USER32(00000010), ref: 00D1FA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D1FA4F
SendMessageW.USER32 ref: 00D1FA72
SendMessageW.USER32(?,00001030,?,00D1E059), ref: 00D1FB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00D1FB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D1FB96
SetCapture.USER32(?), ref: 00D1FB9F
ClientToScreen.USER32(?,?), ref: 00D1FC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D1FC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00D1FC29
ReleaseCapture.USER32 ref: 00D1FC34
GetCursorPos.USER32(?), ref: 00D1FC69
ScreenToClient.USER32(?,?), ref: 00D1FC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D1FCD8
SendMessageW.USER32 ref: 00D1FD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D1FD41
SendMessageW.USER32 ref: 00D1FD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D1FD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D1FD8F
GetCursorPos.USER32(?), ref: 00D1FDB0
ScreenToClient.USER32(?,?), ref: 00D1FDBD
GetParent.USER32(?), ref: 00D1FDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D1FE3F
SendMessageW.USER32 ref: 00D1FE6F
ClientToScreen.USER32(?,?), ref: 00D1FEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D1FEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D1FF19
SendMessageW.USER32 ref: 00D1FF3C
ClientToScreen.USER32(?,?), ref: 00D1FF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D1FFB6
GetWindowLongW.USER32(?,000000F0), ref: 00D2004B

Strings

F, xrefs: 00D1FF42
@GUI_DRAGID, xrefs: 00D1FBCC

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: fbb890361a897a6c571279b2f36d7d599c97eac918f580325afa19e2d4e89e43
Instruction ID: cd06ebbe44f62b2a10456b62222e70fa253ca6a041ebba91321e992fa6c83823
Opcode Fuzzy Hash: fbb890361a897a6c571279b2f36d7d599c97eac918f580325afa19e2d4e89e43
Instruction Fuzzy Hash: 2032CEB4604344EFDB10CF68E884BAABBA5FF49354F080629F599C72A1DB30DC95DB61

Function 00D1AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00D1B1CD

Strings

%d/%02d/%02d, xrefs: 00D1AEFC

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: d5d8a37a407c21000b68cf5794ebcc6e4fa17960c8379457cf34ef7ebb8f1381
Instruction ID: e83957e7dbbb653bcb7b72b345b24ce9c87d26e07da6dd929c3d5165731df09a
Opcode Fuzzy Hash: d5d8a37a407c21000b68cf5794ebcc6e4fa17960c8379457cf34ef7ebb8f1381
Instruction Fuzzy Hash: 04129E71600308BBEB259F68EC49FEA7BB9EF45720F14411AF919DA2D1DB70C981CB61

Function 00CCEB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 00CCEB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D23AEA
IsIconic.USER32(000000FF), ref: 00D23AF3
ShowWindow.USER32(000000FF,00000009), ref: 00D23B00
SetForegroundWindow.USER32(000000FF), ref: 00D23B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D23B20
GetCurrentThreadId.KERNEL32 ref: 00D23B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00D23B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00D23B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00D23B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00D23B54
SetForegroundWindow.USER32(000000FF), ref: 00D23B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D23B6C
keybd_event.USER32(00000012,00000000), ref: 00D23B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D23B81
keybd_event.USER32(00000012,00000000), ref: 00D23B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D23B8F
keybd_event.USER32(00000012,00000000), ref: 00D23B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D23B9E
keybd_event.USER32(00000012,00000000), ref: 00D23BA3
SetForegroundWindow.USER32(000000FF), ref: 00D23BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00D23BCD

Strings

Shell_TrayWnd, xrefs: 00D23AE5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 4980d00cc79679eecf25d09bf54e19177d9a37c415c4007a26f28670b4d4077b
Instruction ID: 521e63a387db72cbd2bad8b70739a8ba6d4deca3e1123b4774a5b6c4036106b0
Opcode Fuzzy Hash: 4980d00cc79679eecf25d09bf54e19177d9a37c415c4007a26f28670b4d4077b
Instruction Fuzzy Hash: 2A316371A403287BEB205F75AC4AF7F7E6DEB44B54F104025FA05EA2D0D6B59D10AEB0

Function 00CEACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00CEB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CEB180
Part of subcall function 00CEB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CEB1AD
Part of subcall function 00CEB134: GetLastError.KERNEL32 ref: 00CEB1BA

_memset.LIBCMT ref: 00CEAD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00CEAD5A
CloseHandle.KERNEL32(?), ref: 00CEAD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00CEAD82
GetProcessWindowStation.USER32 ref: 00CEAD9B
SetProcessWindowStation.USER32(00000000), ref: 00CEADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00CEADBF

Part of subcall function 00CEAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CEACC0), ref: 00CEAB99
Part of subcall function 00CEAB84: CloseHandle.KERNEL32(?,?,00CEACC0), ref: 00CEABAB

Strings

winsta0, xrefs: 00CEAD7D
, xrefs: 00CEAD17
default, xrefs: 00CEADBA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: e212714974db7c33c9fdd75f16f5e578e4cbccac1969a87281f1c6e5a5d20853
Instruction ID: 3a6f507296e07dfcffd15838f679d8f39fdd036c1831409ccf390ac9495136f4
Opcode Fuzzy Hash: e212714974db7c33c9fdd75f16f5e578e4cbccac1969a87281f1c6e5a5d20853
Instruction Fuzzy Hash: D3819AB1800289AFDF11DFA5DC4AAEEBBB9FF08304F144119F924A7261D731AE54DB61

Function 00CF60DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CF5FA6,?), ref: 00CF6ED8

Part of subcall function 00CF6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CF5FA6,?), ref: 00CF6EF1

Part of subcall function 00CF725E: __wsplitpath.LIBCMT ref: 00CF727B
Part of subcall function 00CF725E: __wsplitpath.LIBCMT ref: 00CF728E

Part of subcall function 00CF72CB: GetFileAttributesW.KERNEL32(?,00CF6019), ref: 00CF72CC

_wcscat.LIBCMT ref: 00CF6149
_wcscat.LIBCMT ref: 00CF6167
__wsplitpath.LIBCMT ref: 00CF618E
FindFirstFileW.KERNEL32(?,?), ref: 00CF61A4
_wcscpy.LIBCMT ref: 00CF6209
_wcscat.LIBCMT ref: 00CF621C
_wcscat.LIBCMT ref: 00CF622F
lstrcmpiW.KERNEL32(?,?), ref: 00CF625D
DeleteFileW.KERNEL32(?), ref: 00CF626E
MoveFileW.KERNEL32(?,?), ref: 00CF6289
MoveFileW.KERNEL32(?,?), ref: 00CF6298
CopyFileW.KERNEL32(?,?,00000000), ref: 00CF62AD
DeleteFileW.KERNEL32(?), ref: 00CF62BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CF62E1
FindClose.KERNEL32(00000000), ref: 00CF62FD
FindClose.KERNEL32(00000000), ref: 00CF630B

Strings

\*.*, xrefs: 00CF6138, 00CF6147, 00CF6165

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*
API String ID: 1917200108-1173974218
Opcode ID: 384ff45bfcfb71a59a36d37337f516b0cace37b4affc65352cc6bbf4a580b6a1
Instruction ID: 6eed2251128ac8b31cf74e500c63c5d800f397e26ae88062f7870753f146fddf
Opcode Fuzzy Hash: 384ff45bfcfb71a59a36d37337f516b0cace37b4affc65352cc6bbf4a580b6a1
Instruction Fuzzy Hash: 0151207290821C6ACB21EBA5DC44EEF77BCAF05300F0901E6E695E3141DF3697499FA5

Function 00D06B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00D4DC00), ref: 00D06B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 00D06B44
GetClipboardData.USER32(0000000D), ref: 00D06B4C
CloseClipboard.USER32 ref: 00D06B58
GlobalLock.KERNEL32(00000000), ref: 00D06B74
CloseClipboard.USER32 ref: 00D06B7E
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00D06B93
IsClipboardFormatAvailable.USER32(00000001), ref: 00D06BA0
GetClipboardData.USER32(00000001), ref: 00D06BA8
GlobalLock.KERNEL32(00000000), ref: 00D06BB5
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00D06BE9
CloseClipboard.USER32 ref: 00D06CF6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 458df7db0473cd356d7ffb80805f6428a86bbe125eca62da0ad2c37f54735bdc
Instruction ID: b484697fb914c65f4103ff35c74e68e6853cb4ed920efe9518b13ef9f54cd7ca
Opcode Fuzzy Hash: 458df7db0473cd356d7ffb80805f6428a86bbe125eca62da0ad2c37f54735bdc
Instruction Fuzzy Hash: A9518E71200305ABD300AF65ED86FAF77A9EF94B01F044029F6AAD62E1DF70D9059A76

Function 00CFF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CFF62B
FindClose.KERNEL32(00000000), ref: 00CFF67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CFF6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CFF6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CFF6E2
__swprintf.LIBCMT ref: 00CFF72E
__swprintf.LIBCMT ref: 00CFF767
__swprintf.LIBCMT ref: 00CFF7BB

Part of subcall function 00CD172B: __woutput_l.LIBCMT ref: 00CD1784

__swprintf.LIBCMT ref: 00CFF809
__swprintf.LIBCMT ref: 00CFF858
__swprintf.LIBCMT ref: 00CFF8A7
__swprintf.LIBCMT ref: 00CFF8F6

Strings

%02d, xrefs: 00CFF7B0, 00CFF7B9, 00CFF807, 00CFF856, 00CFF8A5, 00CFF8F4
%4d%02d%02d%02d%02d%02d, xrefs: 00CFF728
%4d, xrefs: 00CFF761

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: dfe26c70ae3015c5c5618fd41d153bf10f7ed66fc2f2f8a54ccfda278bb43c12
Instruction ID: 2c76f5b73275c22324f4b7dbae3c8fd1940306070a0a5947c37d0d479fe679dc
Opcode Fuzzy Hash: dfe26c70ae3015c5c5618fd41d153bf10f7ed66fc2f2f8a54ccfda278bb43c12
Instruction Fuzzy Hash: 17A101B2508344ABC350EBA5C885DAFB7ECEF98704F44092EF695C3151EB34DA49DB62

Function 00D01B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00D01B50
_wcscmp.LIBCMT ref: 00D01B65
_wcscmp.LIBCMT ref: 00D01B7C
GetFileAttributesW.KERNEL32(?), ref: 00D01B8E
SetFileAttributesW.KERNEL32(?,?), ref: 00D01BA8
FindNextFileW.KERNEL32(00000000,?), ref: 00D01BC0
FindClose.KERNEL32(00000000), ref: 00D01BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 00D01BE7
_wcscmp.LIBCMT ref: 00D01C0E
_wcscmp.LIBCMT ref: 00D01C25
SetCurrentDirectoryW.KERNEL32(?), ref: 00D01C37
SetCurrentDirectoryW.KERNEL32(00D639FC), ref: 00D01C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D01C5F
FindClose.KERNEL32(00000000), ref: 00D01C6C
FindClose.KERNEL32(00000000), ref: 00D01C7C

Strings

*.*, xrefs: 00D01BE2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 216e1b2524334502c21c4ef1ac8cbf0e4deaf325120c729d79615ce13e9c4363
Instruction ID: 1b7d0bbdc996d7b129d11f09981750ec9dd87f31a6c833d3432ea106b6c81ffa
Opcode Fuzzy Hash: 216e1b2524334502c21c4ef1ac8cbf0e4deaf325120c729d79615ce13e9c4363
Instruction Fuzzy Hash: 7F3193366403196FDF10ABB0EC49BDE77AD9F06320F184156E919E31D0EB74DA858E78

Function 00D01C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00D01CAB
_wcscmp.LIBCMT ref: 00D01CC0
_wcscmp.LIBCMT ref: 00D01CD7

Part of subcall function 00CF6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00CF6BEF

FindNextFileW.KERNEL32(00000000,?), ref: 00D01D06
FindClose.KERNEL32(00000000), ref: 00D01D11
FindFirstFileW.KERNEL32(*.*,?), ref: 00D01D2D
_wcscmp.LIBCMT ref: 00D01D54
_wcscmp.LIBCMT ref: 00D01D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 00D01D7D
SetCurrentDirectoryW.KERNEL32(00D639FC), ref: 00D01D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D01DA5
FindClose.KERNEL32(00000000), ref: 00D01DB2
FindClose.KERNEL32(00000000), ref: 00D01DC2

Strings

*.*, xrefs: 00D01D28

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: f8260ea890dd6eece638504b4a86ff0009e16db1f7bd01fb43e1eb809d7a388f
Instruction ID: 2b6ee73d3cd007bdef45707131d7a602c13ec8f366b7fd0b8657aa8bc60ef071
Opcode Fuzzy Hash: f8260ea890dd6eece638504b4a86ff0009e16db1f7bd01fb43e1eb809d7a388f
Instruction Fuzzy Hash: 2C31F23690461ABFDF10ABA0EC49BDE77AD9F05320F180556E909E31D0DB70DA458E74

Function 00CB7D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB7DBD

Strings

\, xrefs: 00D2F95B
], xrefs: 00CB7D9F
[, xrefs: 00CB7E14
^, xrefs: 00CB7D96
Q\E, xrefs: 00CB86D6
\b(?<=\w), xrefs: 00D2F877
\, xrefs: 00CB7D89
\, xrefs: 00CB7E1D
[:>:]], xrefs: 00CB7D37
[:<:]], xrefs: 00CB7D1D
\b(?=\w), xrefs: 00D2F85E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _memset
String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
API String ID: 2102423945-2023335898
Opcode ID: 941a9d9dd6cceac98ab38ce6139815e204e7b63f2c9f747e54f77cc8d7804daf
Instruction ID: 02468c0d0c5650a1a0a9dedea0ce9cf602fc91f0602e05f141eadea2f7c8992f
Opcode Fuzzy Hash: 941a9d9dd6cceac98ab38ce6139815e204e7b63f2c9f747e54f77cc8d7804daf
Instruction Fuzzy Hash: 2682B071D04229CFCF24CF98C8806EDBBB1FF94314F298669D855AB251E7309E85DBA0

Function 00D0091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D009DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D009EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D009FB
__wsplitpath.LIBCMT ref: 00D00A59
_wcscat.LIBCMT ref: 00D00A71
_wcscat.LIBCMT ref: 00D00A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D00A98
SetCurrentDirectoryW.KERNEL32(?), ref: 00D00AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 00D00ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 00D00AFF
_wcscpy.LIBCMT ref: 00D00B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00D00B4A

Strings

*.*, xrefs: 00D00B05

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 401f0bbde7c12d83024f3d744bc3656ae0d2144ff313d4b6469ec4a522bca328
Instruction ID: 8a77a0b72f758ccc5c8fc27d3bf549a4dea7bd9bc8dbdba7c5b70f124b783cf6
Opcode Fuzzy Hash: 401f0bbde7c12d83024f3d744bc3656ae0d2144ff313d4b6469ec4a522bca328
Instruction Fuzzy Hash: FB614872504345AFD710EF64D844AAEB7E9FF89310F08491AF989C7251DB31E945CFA2

Function 00CEA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00CEABD7
Part of subcall function 00CEABBB: GetLastError.KERNEL32(?,00CEA69F,?,?,?), ref: 00CEABE1
Part of subcall function 00CEABBB: GetProcessHeap.KERNEL32(00000008,?,?,00CEA69F,?,?,?), ref: 00CEABF0
Part of subcall function 00CEABBB: HeapAlloc.KERNEL32(00000000,?,00CEA69F,?,?,?), ref: 00CEABF7
Part of subcall function 00CEABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00CEAC0E

Part of subcall function 00CEAC56: GetProcessHeap.KERNEL32(00000008,00CEA6B5,00000000,00000000,?,00CEA6B5,?), ref: 00CEAC62
Part of subcall function 00CEAC56: HeapAlloc.KERNEL32(00000000,?,00CEA6B5,?), ref: 00CEAC69
Part of subcall function 00CEAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CEA6B5,?), ref: 00CEAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CEA6D0
_memset.LIBCMT ref: 00CEA6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CEA704
GetLengthSid.ADVAPI32(?), ref: 00CEA715
GetAce.ADVAPI32(?,00000000,?), ref: 00CEA752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CEA76E
GetLengthSid.ADVAPI32(?), ref: 00CEA78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CEA79A
HeapAlloc.KERNEL32(00000000), ref: 00CEA7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CEA7C2
CopySid.ADVAPI32(00000000), ref: 00CEA7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CEA7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CEA820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CEA834

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 8118c2cd31e58f182003e00cbcc780a6c666cae340bfa490f4418c81736e8c2d
Instruction ID: c9b6f47a40365531e4cde75b811b55905cb7412bc3ce4e09e8526617c9c62e4c
Opcode Fuzzy Hash: 8118c2cd31e58f182003e00cbcc780a6c666cae340bfa490f4418c81736e8c2d
Instruction Fuzzy Hash: 0C513C71900249AFDF14DFA6DC45AEEBBB9FF04700F148129F921EA290D735AE05DB61

Function 00CB6F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UTF16), xrefs: 00D32C56
LIMIT_MATCH=, xrefs: 00D32CF2
LIMIT_RECURSION=, xrefs: 00D32D7E
CR), xrefs: 00D32E09
BSR_UNICODE), xrefs: 00D32EBA
ANYCRLF), xrefs: 00D32E7D
UTF), xrefs: 00D32C7C
CRLF), xrefs: 00D32E43
ANY), xrefs: 00D32E60
NO_START_OPT), xrefs: 00D32CD1
UCP), xrefs: 00D32C8F
LF), xrefs: 00D32E26
BSR_ANYCRLF), xrefs: 00D32EA0
NO_AUTO_POSSESS), xrefs: 00D32CB0

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 4f42078e44b05772c01393bb7b44d3160edd2212aa8e2af7709e77bf3be6c48b
Instruction ID: 4750925e08f844d1b30f9427dd5a519a706c1eb44b25b79c8bf89f43cb1dd555
Opcode Fuzzy Hash: 4f42078e44b05772c01393bb7b44d3160edd2212aa8e2af7709e77bf3be6c48b
Instruction Fuzzy Hash: 6E725C71E042199BDB24CF99D8817FEB7B5BF48310F14816AE855EB280DB749A81DFA0

Function 00CF63F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CF5FA6,?), ref: 00CF6ED8

Part of subcall function 00CF72CB: GetFileAttributesW.KERNEL32(?,00CF6019), ref: 00CF72CC

_wcscat.LIBCMT ref: 00CF6441
__wsplitpath.LIBCMT ref: 00CF645F
FindFirstFileW.KERNEL32(?,?), ref: 00CF6474
_wcscpy.LIBCMT ref: 00CF64A3
_wcscat.LIBCMT ref: 00CF64B8
_wcscat.LIBCMT ref: 00CF64CA
DeleteFileW.KERNEL32(?), ref: 00CF64DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CF64EB
FindClose.KERNEL32(00000000), ref: 00CF6506

Strings

\*.*, xrefs: 00CF643B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: a982885dede479bdad838067a4cec5be90d7cdedb74520acb62c1a0b9e932586
Instruction ID: a0d2fc6dc0f0f6af5a5658115fa001b9b4fd4bb6330c1b919da89acdb40bb23b
Opcode Fuzzy Hash: a982885dede479bdad838067a4cec5be90d7cdedb74520acb62c1a0b9e932586
Instruction Fuzzy Hash: 693164B2408388AAC721EBA48885AEB77DCAF95310F44491EF6D9C3241EA35D60D9767

Function 00D131BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D13C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D12BB5,?,?), ref: 00D13C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D1328E

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00D1332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00D133C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00D13604
RegCloseKey.ADVAPI32(00000000), ref: 00D13611

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: d06c64169126d35b36cd9a16b1f9f069f9cc155c3d08d5d15418e9ce5e2b4a52
Instruction ID: de70537b7f897356363fb8f21e3b6c6c014149433fa6a79c81f2361e54e37eee
Opcode Fuzzy Hash: d06c64169126d35b36cd9a16b1f9f069f9cc155c3d08d5d15418e9ce5e2b4a52
Instruction Fuzzy Hash: AEE16C31604200AFCB14DF28D995EAABBE9EF88710F04846DF54AD7261DB30ED45DB62

Function 00CF2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CF2B5F
GetAsyncKeyState.USER32(000000A0), ref: 00CF2BE0
GetKeyState.USER32(000000A0), ref: 00CF2BFB
GetAsyncKeyState.USER32(000000A1), ref: 00CF2C15
GetKeyState.USER32(000000A1), ref: 00CF2C2A
GetAsyncKeyState.USER32(00000011), ref: 00CF2C42
GetKeyState.USER32(00000011), ref: 00CF2C54
GetAsyncKeyState.USER32(00000012), ref: 00CF2C6C
GetKeyState.USER32(00000012), ref: 00CF2C7E
GetAsyncKeyState.USER32(0000005B), ref: 00CF2C96
GetKeyState.USER32(0000005B), ref: 00CF2CA8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c3dcac66d936aff30d9688b88b729839994885761f0bc9f062e346815674d699
Instruction ID: 8a77d4acf150fad45f3b39ad1d5e58a93305e92db06fe32e1b8ed42b4633f851
Opcode Fuzzy Hash: c3dcac66d936aff30d9688b88b729839994885761f0bc9f062e346815674d699
Instruction Fuzzy Hash: 4041B7346047CD6EFFB59B6488047B9BEA1AF12344F044059DBD6572C1DB949BC4CBA3

Function 00D06D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D06D2E
EmptyClipboard.USER32 ref: 00D06D34
GlobalAlloc.KERNEL32(00000002,?), ref: 00D06D49
CloseClipboard.USER32 ref: 00D06DE8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 7d7cbb104f3bba75fa58e0151484ff0543542624037dcb01c51deb36802d007b
Instruction ID: 08f17f87221c89af9606b0c7cef0a3f0bdb5daaed5ddddbf4a1bc2e2b14f9d2a
Opcode Fuzzy Hash: 7d7cbb104f3bba75fa58e0151484ff0543542624037dcb01c51deb36802d007b
Instruction Fuzzy Hash: BF218B35300214AFDB01AF68EC4AB2EB7A9EF04710F04801AF91ADB3A1DB74E8119F75

Function 00D0C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00CE9ABF: CLSIDFromProgID.OLE32 ref: 00CE9ADC
Part of subcall function 00CE9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00CE9AF7
Part of subcall function 00CE9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00CE9B05
Part of subcall function 00CE9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00CE9B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00D0C235
_memset.LIBCMT ref: 00D0C242
_memset.LIBCMT ref: 00D0C360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00D0C38C
CoTaskMemFree.OLE32(?), ref: 00D0C397

Strings

NULL Pointer assignment, xrefs: 00D0C3E5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 46ebf08e9d64db46f44a11b7157646c39530f2e14c3c570c73ea6a6b2a42c860
Instruction ID: 0fc45b53b3ebecfe2171d574641b901219186a6746874f8c3a48b9e984a2c667
Opcode Fuzzy Hash: 46ebf08e9d64db46f44a11b7157646c39530f2e14c3c570c73ea6a6b2a42c860
Instruction Fuzzy Hash: FD913C71D10218ABDB10DF94DC95FDEBBB9EF08710F20811AF519A7281EB70AA45DFA0

Function 00CF79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CEB180
Part of subcall function 00CEB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CEB1AD
Part of subcall function 00CEB134: GetLastError.KERNEL32 ref: 00CEB1BA

ExitWindowsEx.USER32(?,00000000), ref: 00CF7A0F

Strings

, xrefs: 00CF79FD
@, xrefs: 00CF7A02
SeShutdownPrivilege, xrefs: 00CF79DD

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 5f91b2cea4a85370793d25c4f2d219c6d97f3ccdf212dfb5efc463753bb11feb
Instruction ID: 1f7d739ff52eb176aa3b6ef5d5b42820405283012e7a0331fc0ec4248b51e791
Opcode Fuzzy Hash: 5f91b2cea4a85370793d25c4f2d219c6d97f3ccdf212dfb5efc463753bb11feb
Instruction Fuzzy Hash: 7D01F7716583196BF7A817749C4AFBF3258DB00740F262624FB13E20D2E5A15F10A5B2

Function 00D08C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00D08CA8
WSAGetLastError.WSOCK32(00000000), ref: 00D08CB7
bind.WSOCK32(00000000,?,00000010), ref: 00D08CD3
listen.WSOCK32(00000000,00000005), ref: 00D08CE2
WSAGetLastError.WSOCK32(00000000), ref: 00D08CFC
closesocket.WSOCK32(00000000,00000000), ref: 00D08D10

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 7ff9b489cc864c511302091508ab6c6409a5e82ad75fe3212a1baf2439da1076
Instruction ID: e41b230196b7a19873fa1ce1d6bce9b570f1aa836b070b234d70ef1c920e96a5
Opcode Fuzzy Hash: 7ff9b489cc864c511302091508ab6c6409a5e82ad75fe3212a1baf2439da1076
Instruction Fuzzy Hash: F721A071600204AFDB10AF68D985B6EB7A9EF48320F148158F95BA73D2CB30AD41AB71

Function 00CF6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CF6554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00CF6564
Process32NextW.KERNEL32(00000000,0000022C), ref: 00CF6583
__wsplitpath.LIBCMT ref: 00CF65A7
_wcscat.LIBCMT ref: 00CF65BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CF65F9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: a363c0a276b9f3ee025eeab8fa1aa259e03983ef1b316439bba2a788ccfcb0e1
Instruction ID: 6ad1a310f36b4fa8038e47c8845c39bd63ec743375cb9ec18aa2e94fa0300bc1
Opcode Fuzzy Hash: a363c0a276b9f3ee025eeab8fa1aa259e03983ef1b316439bba2a788ccfcb0e1
Instruction Fuzzy Hash: 2321627190021CABDB10ABA4DC89BEEBBBDAB49300F5004A5F605E7241EB719F85DF61

Function 00D0923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D0A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D0A84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00D09296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 00D092B9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: d69932e70335da9a895e1d0bd35e9f0e3972f1eb828703c1ff48b88d38d4aaaf
Instruction ID: dae39515b6cb8f48efb8d4ad9698d3198208596197f1008d4e42ddedda4d5f57
Opcode Fuzzy Hash: d69932e70335da9a895e1d0bd35e9f0e3972f1eb828703c1ff48b88d38d4aaaf
Instruction Fuzzy Hash: 8B41C270600204AFDB10AB68C892F7EB7EDEF44724F14444CF95AAB3D2DB749D019BA1

Function 00CFEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CFEB8A
_wcscmp.LIBCMT ref: 00CFEBBA
_wcscmp.LIBCMT ref: 00CFEBCF
FindNextFileW.KERNEL32(00000000,?), ref: 00CFEBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00CFEC0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: dd0e8ef01e6d4b50e8bc1969ac2eb82511ac54fda4c1ba450841a458a26282c0
Instruction ID: 0f2893b51ecdfc6aea22119e0287e3666214ad581732496366a305539d0a13e9
Opcode Fuzzy Hash: dd0e8ef01e6d4b50e8bc1969ac2eb82511ac54fda4c1ba450841a458a26282c0
Instruction Fuzzy Hash: E541AC356043059FC708DF28C491EAAB3E5FF49324F10455EFA6A8B3A1DB31A945CF92

Function 00D18111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00D18160
IsWindowEnabled.USER32 ref: 00D1816E
GetForegroundWindow.USER32(?,?,00000001), ref: 00D1817B
IsIconic.USER32 ref: 00D18189
IsZoomed.USER32 ref: 00D18197

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: ee1db7f7231cb0a44c237adaaf41056c94a784a34ddd23ff933c03fc667b83a8
Instruction ID: 8cbe34c8d7fa0e4dd05aaf984d7b082a6eaeac4e2a7230e4a4fad1def20ba072
Opcode Fuzzy Hash: ee1db7f7231cb0a44c237adaaf41056c94a784a34ddd23ff933c03fc667b83a8
Instruction Fuzzy Hash: C51190327007147BE7219F26EC45EAEBB99EF55760B080429F84AD7241CF30D9829AB4

Function 00CB9B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00CB9E95
VUUU, xrefs: 00CB9EA7
VUUU, xrefs: 00CB9ED4
VUUU, xrefs: 00D3BE14
ERCP, xrefs: 00CB9C32

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: d809c196f23160f0b6cb0b232bf551567dd4993b163ad5e08c5bd97202c64403
Instruction ID: ded2d56fb224f0fb4fb8bd6bd8ae3ba36a091e31f07b7fc8b0b72d8b49fa16bb
Opcode Fuzzy Hash: d809c196f23160f0b6cb0b232bf551567dd4993b163ad5e08c5bd97202c64403
Instruction Fuzzy Hash: 98926C71E0021ACBDF24CF59C8807FDB7B1FB54314F18819AE95AAB280D7759E81DBA1

Function 00CCE01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CCE014,75920AE0,00CCDEF1,00D4DC38,?,?), ref: 00CCE02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00CCE03E

Strings

GetNativeSystemInfo, xrefs: 00CCE038
kernel32.dll, xrefs: 00CCE027

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 6b351c8240273bc002eeae8d36772d2de0b9fb7053265073066e9b5e3b15c712
Instruction ID: c8ff1a6faa68d670c4168ac4a798a30a454297dc11aa7efa2d424f520ddeeaa8
Opcode Fuzzy Hash: 6b351c8240273bc002eeae8d36772d2de0b9fb7053265073066e9b5e3b15c712
Instruction Fuzzy Hash: AFD0C770500B129FD7315F65FC08B6276E5AB05711F18442EF495D2650D7B4D9848EB0

Function 00CF13CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00CF13DC

Strings

|, xrefs: 00CF140C
(, xrefs: 00CF1422

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 63150c5063b398727bc1ff72916f09fc3e2ba3c7b012865e5c7176865a7b49f1
Instruction ID: aa6cfe2324810de731516380d09fb8a623addcb78a002d900d1ac1324b744a27
Opcode Fuzzy Hash: 63150c5063b398727bc1ff72916f09fc3e2ba3c7b012865e5c7176865a7b49f1
Instruction Fuzzy Hash: 7D321575A00605DFC768CF69C480A6AB7F0FF48320B15C56EE9AADB3A1D770EA41CB45

Function 00CCB11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 00CCB22F

Part of subcall function 00CCB55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00CCB5A5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: 27d7ef932704fa759642b7b4915c602058cfc05a43b6d1e801557873eeea0e14
Instruction ID: 1c60acb341ccfbb0f2626d28300e730178ac06f23f49bff7d13436d982c3bc57
Opcode Fuzzy Hash: 27d7ef932704fa759642b7b4915c602058cfc05a43b6d1e801557873eeea0e14
Instruction Fuzzy Hash: 8FA16AB0114115BADB28ABABEC8BFBF7A5CEB51348F18411DF406D2591DF24DD01E672

Function 00D04EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000), ref: 00D04FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00D04FD2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: c9a3151a9e23ff6bd5963758b76f73da2d8ea1f4a10b4f41cbefd1a68be57169
Instruction ID: d142b8298cf30afc7aa94f769810c070c34017c39102abf674c2ddeefe6c585f
Opcode Fuzzy Hash: c9a3151a9e23ff6bd5963758b76f73da2d8ea1f4a10b4f41cbefd1a68be57169
Instruction Fuzzy Hash: 6641C5B160420ABFEB209E94DC81FBF77ACEF40764F14402EF709A61C0DA719E419AB0

Function 00CFE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CFE20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00CFE267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00CFE2B4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 553a0dce661cc0cbfba89905532751c11384a05968c1a74678ecbfdd06aa8945
Instruction ID: 659ef54a10fbd870239c594eea55cf9c9445fca1e0a0ae8b1a7c338f97d898af
Opcode Fuzzy Hash: 553a0dce661cc0cbfba89905532751c11384a05968c1a74678ecbfdd06aa8945
Instruction Fuzzy Hash: 3F213C35A00218EFDB00EFA5D885EAEFBB9FF48314F0484AAE905E7351DB319915DB64

Function 00CEB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CCF4EA: std::exception::exception.LIBCMT ref: 00CCF51E
Part of subcall function 00CCF4EA: __CxxThrowException@8.LIBCMT ref: 00CCF533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CEB180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CEB1AD
GetLastError.KERNEL32 ref: 00CEB1BA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 64072cf85b2325f7a770c3054c076732888a072254a477b9c62d7df3193a2717
Instruction ID: c05781772de003fce2ee47b9d0ed8dc62be53e6df0533047be10228845015b16
Opcode Fuzzy Hash: 64072cf85b2325f7a770c3054c076732888a072254a477b9c62d7df3193a2717
Instruction Fuzzy Hash: 55119EB2504305AFE728EF65ECC5D6BB7BEFB45720B20852EE45697240DB70FC428A60

Function 00CF6685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CF66AF
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00CF66EC
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CF66F5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 685131e921904ea3adffe3ffa65e539c4ac2263e40f2102a2c4ac6e73ae5e8d4
Instruction ID: 0c0c7370dfc591aec8376ee3c8d6cc53e652d28993c9bda67450582eb6f64249
Opcode Fuzzy Hash: 685131e921904ea3adffe3ffa65e539c4ac2263e40f2102a2c4ac6e73ae5e8d4
Instruction Fuzzy Hash: A91182B1900228BEE7109BA8DC45FBF77ACEB04714F004556FA11E7290D3749E048BA5

Function 00CF71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00CF7223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00CF723A
FreeSid.ADVAPI32(?), ref: 00CF724A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7baaf036dcf5a6e56f5d68a266c0d8e505b84254d2f46bb7f47c6d33593885db
Instruction ID: 023cdad809668a3ad57f91e96c3038b770ce84a05593401d88ff413c7509a49b
Opcode Fuzzy Hash: 7baaf036dcf5a6e56f5d68a266c0d8e505b84254d2f46bb7f47c6d33593885db
Instruction Fuzzy Hash: 25F01275914309FFDF04DFF4DD8AAEDBBB9EF08601F104469A602E2191E27056448B10

Function 00CFF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CFF599
FindClose.KERNEL32(00000000), ref: 00CFF5C9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1a9f2680e9273698f860b750f94233cee4f0f2fbd93e7114fbd5eb6e94703e3e
Instruction ID: de26643336e0086f1efbfd2ccab5d6c9f07d6afa4aee351d8f0a0e4c684f6550
Opcode Fuzzy Hash: 1a9f2680e9273698f860b750f94233cee4f0f2fbd93e7114fbd5eb6e94703e3e
Instruction Fuzzy Hash: 6411AD326042049FD700EF28D845A2EB3E9FF84324F008A1EF9A9DB391CB30A9018B95

Function 00CFCE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00D0BE6A,?,?,00000000,?), ref: 00CFCEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00D0BE6A,?,?,00000000,?), ref: 00CFCEB9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a05586427b8d479ec4ce9f5b114e60de034d0e39342476e6b7093c6ae01924dd
Instruction ID: f82fc93499f656149d32cddd75f99e0a6e8d43b5f28b2579ba208d811a8bc71a
Opcode Fuzzy Hash: a05586427b8d479ec4ce9f5b114e60de034d0e39342476e6b7093c6ae01924dd
Instruction Fuzzy Hash: DBF0823510032DEBDB10ABA4DC89FFA776DBF09351F004165F915D6181D630DA50DBA1

Function 00CF411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00CF4153
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00CF4166

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 7350c0f1905785001d4f0ea4c022bad07e8e410e102aa56706aba53b3503916d
Instruction ID: ad4a318c595d825221bc930dcc29a8a7d060ea706446b1fdaaa1da7936471ddb
Opcode Fuzzy Hash: 7350c0f1905785001d4f0ea4c022bad07e8e410e102aa56706aba53b3503916d
Instruction Fuzzy Hash: E2F0677080038DAFDB058FA0C805BBEBBB0EF00305F00800AF966A6292D77986129FA0

Function 00CEAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CEACC0), ref: 00CEAB99
CloseHandle.KERNEL32(?,?,00CEACC0), ref: 00CEABAB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 6018f1c3e0492c3186faddf1c7f0092a0e12fafdf08e5d6a3b76bc992ea34b30
Instruction ID: d12c4a688e3979d00a7ed32150ea609cc7fde4ea49eea32ac8dbd5b86ddb8615
Opcode Fuzzy Hash: 6018f1c3e0492c3186faddf1c7f0092a0e12fafdf08e5d6a3b76bc992ea34b30
Instruction Fuzzy Hash: F4E0E671004610AFE7262F55FC05EB777EAEF04320710842DF55AC1470D7626D91DB50

Function 00CD81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00CD6DB3,-0000031A,?,?,00000001), ref: 00CD81B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00CD81BA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 842e092d701ea4f4a80b753a04bb1d7d556e172cf89f276b5580519bee196ab4
Instruction ID: bfc6cb9d907f66ab12127fe4c22adaa83e5cc0c984d24705e2fcb7fb7e2a08e8
Opcode Fuzzy Hash: 842e092d701ea4f4a80b753a04bb1d7d556e172cf89f276b5580519bee196ab4
Instruction Fuzzy Hash: 94B09231044708ABDB002BE1FC09B987F6AEB08652F104010F60D852618B7258208EA2

Function 00CB77B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CB7921

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 6c3d6629495aa788fd0a950eba507e9e68cc546f791053337ad5c55c4f22a592
Instruction ID: 418f969c44591745619a28937bd1cf6d006c2a7721be53a31ffbf4346ea25494
Opcode Fuzzy Hash: 6c3d6629495aa788fd0a950eba507e9e68cc546f791053337ad5c55c4f22a592
Instruction Fuzzy Hash: 6FA22875A04219CFDB24CF59C4806EDBBB1FF98314F2582A9E859AB390D7349E81DB90

Function 00CDD1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3da464e72593b65e76e94a583372b0f03cc8e2ae2cb7ce7cb9f8bcfc49b599
Instruction ID: f170800888d268221d8ce19c69f2c1d9b780f1509d6bd504ef8e8d67fc756da9
Opcode Fuzzy Hash: 2b3da464e72593b65e76e94a583372b0f03cc8e2ae2cb7ce7cb9f8bcfc49b599
Instruction Fuzzy Hash: 11322521D28F014ED7235A34DC22335A298AFB73D4F55D727F82AB5BAAEF29C5834110

Function 00CB96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 5775d361db65b9bbe5a3da0536eada1d2c032a480e5d4c236d7e7349c94b507a
Instruction ID: 68740ea173976d80a6d1a34a005a7dd5b80bf4b75ccb304b5b1d62fe053ff2c3
Opcode Fuzzy Hash: 5775d361db65b9bbe5a3da0536eada1d2c032a480e5d4c236d7e7349c94b507a
Instruction Fuzzy Hash: 062285716083109BD724DF24C890BAFB7E4EF88314F14491DFA9A9B2A1DB71ED44DB92

Function 00CE038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4583aaa2109bd37e7575102f39e96e6c389f4df3315f03f01bf8ab5b74fa4a
Instruction ID: a361e8599561e7a560f4f5412a3c855e60ea34859f26110d64efe53def503a7c
Opcode Fuzzy Hash: da4583aaa2109bd37e7575102f39e96e6c389f4df3315f03f01bf8ab5b74fa4a
Instruction Fuzzy Hash: 9CB10324D2AF414ED3239A399831336B75C6FBB2D5F91D71BFC1AB4E66EB2185834180

Function 00CFB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00CFB6DF

Part of subcall function 00CD344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00CFBDC3,00000000,?,?,?,?,00CFBF70,00000000,?), ref: 00CD3453
Part of subcall function 00CD344A: __aulldiv.LIBCMT ref: 00CD3473

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: b7f4dc7bc667f866021234f8bb8cd3be2aa8ba2281680aede3e6c5ed0ca54592
Instruction ID: 88402f60ced8260282d746d5d5d1f5fc144bd6ab8d24ac119659fbd7b8ab6f4c
Opcode Fuzzy Hash: b7f4dc7bc667f866021234f8bb8cd3be2aa8ba2281680aede3e6c5ed0ca54592
Instruction Fuzzy Hash: 4D2175726346108BC729CF28C481A52B7E1EB95310B248E6DE5E5CB2C0DB74BE45DB64

Function 00D06AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00D06ACA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: e75dac12fe9ba2aba838c0b30d031bff5521e3da629e7a1eee02e85527656b7d
Instruction ID: add9fd97034cacfea934cd8dfae94c93e7e59c591370bfee99fb9bb6ff317d03
Opcode Fuzzy Hash: e75dac12fe9ba2aba838c0b30d031bff5521e3da629e7a1eee02e85527656b7d
Instruction Fuzzy Hash: 8FE012353002046FD700EB69D405E96B7EDAF64761F048416E94AD7291DAB0E8449BA0

Function 00CF74E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00CF750A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 63576d90a621d2068e9a37316af80b373428f520d343ffa69483b4c432bc5c90
Instruction ID: ac21bb21006e9992e68f460f3c7cdb7a52e1543aad55b0a0b7439f3b3dda46bd
Opcode Fuzzy Hash: 63576d90a621d2068e9a37316af80b373428f520d343ffa69483b4c432bc5c90
Instruction Fuzzy Hash: AFD09EA516C60E79EC9A47249C1FFB71D09F301781FD447497713DA1C0A8D45E05B833

Function 00CEB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00CEAD3E), ref: 00CEB124

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: ec768391a6d0cbfbf0b8c088986fe4129513c80c19ef8c425d076c8e18d5a6cf
Instruction ID: 933de81744f7eccd814226396f5b02d0d9682c7d5e7c9ebed260f7b6adce346a
Opcode Fuzzy Hash: ec768391a6d0cbfbf0b8c088986fe4129513c80c19ef8c425d076c8e18d5a6cf
Instruction Fuzzy Hash: D3D05E320A460EAEDF024FA4EC02EAE3F6AEB04B00F408110FA11C50A0C771D531AF60

Function 00D2B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00D2B352

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: bf1cf6bf2654ae724f94ee13a8d0617a39e165a0e1bad985321c514b781f7051
Instruction ID: 9704aedae6ccf34cd12ad4b47da8d7e5b364f8f0b9807ab09cf77e978e38ef4a
Opcode Fuzzy Hash: bf1cf6bf2654ae724f94ee13a8d0617a39e165a0e1bad985321c514b781f7051
Instruction Fuzzy Hash: B7C04CB5400119DFC755DBC4D9449EEB7BDAB04705F104091A145F1110D7709B459F72

Function 00CD8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00CD818F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 855dcab3cc4dd3e06ecf40f8ce1c461a5ccf41ea40c125095a94c83f75f5d95c
Instruction ID: 3559b666fe8f2a8e08a71b0376d86c97414e1e486441be903ff681da91a23236
Opcode Fuzzy Hash: 855dcab3cc4dd3e06ecf40f8ce1c461a5ccf41ea40c125095a94c83f75f5d95c
Instruction Fuzzy Hash: E7A0113000030CAB8F002B82FC088883F2EEA002A0B200020F80C802208B22A8208AA2

Function 00CBE3B0 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f17c22d15085591a9824a79cb26fb193d09c9177e4f4768649b5151ca0ee31a4
Instruction ID: a3f0bbe4e64e2bb1e6b615f06a7e96eb31d3fbb9c19bfd95c911eae68eee838d
Opcode Fuzzy Hash: f17c22d15085591a9824a79cb26fb193d09c9177e4f4768649b5151ca0ee31a4
Instruction Fuzzy Hash: C922BC70A04219CFDB24DF58C480BEEB7B1FF18704F188169E95AAB351E731AE85DB91

Function 00CB93F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc95869169f779b1bde84ad677218ae0cdff574eb2288c524e96fbb5537c507
Instruction ID: 307bbf9fd170bb472c44ba3e7c3dab4db69ccd4d8b3d28ac53e1a8e0e9ac704f
Opcode Fuzzy Hash: ecc95869169f779b1bde84ad677218ae0cdff574eb2288c524e96fbb5537c507
Instruction Fuzzy Hash: DE128C70A00219AFDF14DFA9D981AEEB7F5FF58304F108529E806E7250EB35AE11DB60

Function 00CBAF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 030e3bbfab62e3a521919dcece7cf3738fc83450f4cf0f49ed1bde8fde042ebe
Instruction ID: 07b37bc4fe6df61b308348e174a682e747ee70922772743d24810c05ee7b562e
Opcode Fuzzy Hash: 030e3bbfab62e3a521919dcece7cf3738fc83450f4cf0f49ed1bde8fde042ebe
Instruction Fuzzy Hash: B802A1B0A00209EBCF14DF68D991ABEB7B5EF48300F148069F806DB255EB75DE11DBA1

Function 00CD02A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 9bcdde48f20139a206028a2063bc1f6fc85736c1ce2bffd4144fe0df234d6f18
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 6AC196322051970ADF2D473EC474A3EFBA15A917B172A076ED8B3CB5D5EF20CA25D620

Function 00CD06D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 7c9669aea70b730e3590347051e8927833049fdaa649dd9b2682fe271ec6fd8d
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 1DC1B53220519709DF6D463EC43463EBBA15EA2BB172A076ED4B3CF5D5EF20DA24D620

Function 00CCFA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 8b86f6bed077b802c61f6d7332551eb1f0fc1b6a98e6dca6335b9928f57cd5c4
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: F5C197322050970ADF2D473AC474A3EFBA25AA1BB131A177DD4B3CB5D5EF10CA66D620

Function 00D0A2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D0A2FE
DeleteObject.GDI32(00000000), ref: 00D0A310
DestroyWindow.USER32 ref: 00D0A31E
GetDesktopWindow.USER32 ref: 00D0A338
GetWindowRect.USER32(00000000), ref: 00D0A33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00D0A480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00D0A490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A4D8
GetClientRect.USER32(00000000,?), ref: 00D0A4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D0A51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A55E
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A576
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A586
GlobalFree.KERNEL32(00000000), ref: 00D0A591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00D3D9BC,00000000), ref: 00D0A5B9
GlobalFree.KERNEL32(00000000), ref: 00D0A5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00D0A5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00D0A60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D0A81D

Strings

static, xrefs: 00D0A518, 00D0A66F
AutoIt v3, xrefs: 00D0A4D0
DISPLAY, xrefs: 00D0A680
, xrefs: 00D0A7A3

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 23ba2020377a22943178312b4419df24134764dfd6e1899b23ea086c7c4e5cd5
Instruction ID: 4066576219ed1340edbbf46624c89bca59af49c771b2ddb8972ef2123aa256c4
Opcode Fuzzy Hash: 23ba2020377a22943178312b4419df24134764dfd6e1899b23ea086c7c4e5cd5
Instruction Fuzzy Hash: B8024775900218AFDB14DFA8DD89EAE7BB9EB48310F048158F919EB2A0D770AD41CF71

Function 00D1D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00D1D2DB
GetSysColorBrush.USER32(0000000F), ref: 00D1D30C
GetSysColor.USER32(0000000F), ref: 00D1D318
SetBkColor.GDI32(?,000000FF), ref: 00D1D332
SelectObject.GDI32(?,00000000), ref: 00D1D341
InflateRect.USER32(?,000000FF,000000FF), ref: 00D1D36C
GetSysColor.USER32(00000010), ref: 00D1D374
CreateSolidBrush.GDI32(00000000), ref: 00D1D37B
FrameRect.USER32(?,?,00000000), ref: 00D1D38A
DeleteObject.GDI32(00000000), ref: 00D1D391
InflateRect.USER32(?,000000FE,000000FE), ref: 00D1D3DC
FillRect.USER32(?,?,00000000), ref: 00D1D40E
GetWindowLongW.USER32(?,000000F0), ref: 00D1D439

Part of subcall function 00D1D575: GetSysColor.USER32(00000012), ref: 00D1D5AE
Part of subcall function 00D1D575: SetTextColor.GDI32(?,?), ref: 00D1D5B2
Part of subcall function 00D1D575: GetSysColorBrush.USER32(0000000F), ref: 00D1D5C8
Part of subcall function 00D1D575: GetSysColor.USER32(0000000F), ref: 00D1D5D3
Part of subcall function 00D1D575: GetSysColor.USER32(00000011), ref: 00D1D5F0
Part of subcall function 00D1D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D1D5FE
Part of subcall function 00D1D575: SelectObject.GDI32(?,00000000), ref: 00D1D60F
Part of subcall function 00D1D575: SetBkColor.GDI32(?,00000000), ref: 00D1D618
Part of subcall function 00D1D575: SelectObject.GDI32(?,?), ref: 00D1D625
Part of subcall function 00D1D575: InflateRect.USER32(?,000000FF,000000FF), ref: 00D1D644
Part of subcall function 00D1D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D1D65B
Part of subcall function 00D1D575: GetWindowLongW.USER32(00000000,000000F0), ref: 00D1D670
Part of subcall function 00D1D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D1D698

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: af0de1597d2a55f815976f6de9d6aed7cfe4ece26ff74d736342813093b3b459
Instruction ID: fa2596e71fe9b51256f88180b71e869b971d5e48d56020a7b481aee8af519175
Opcode Fuzzy Hash: af0de1597d2a55f815976f6de9d6aed7cfe4ece26ff74d736342813093b3b459
Instruction Fuzzy Hash: 24915072408301BFDB109F64EC48AAB7BAAFB85325F144A19F562D62E0DB71D944CF62

Function 00CCB8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00CCB98B
DeleteObject.GDI32(00000000), ref: 00CCB9CD
DeleteObject.GDI32(00000000), ref: 00CCB9D8
DestroyIcon.USER32(00000000), ref: 00CCB9E3
DestroyWindow.USER32(00000000), ref: 00CCB9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 00D2D2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00D2D2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00D2D711

Part of subcall function 00CCB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00CCB759,?,00000000,?,?,?,?,00CCB72B,00000000,?), ref: 00CCBA58

SendMessageW.USER32 ref: 00D2D758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D2D76F
ImageList_Destroy.COMCTL32(00000000), ref: 00D2D785
ImageList_Destroy.COMCTL32(00000000), ref: 00D2D790

Strings

0, xrefs: 00D2D5A5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: aff18f6aa5ce4ddc83e669504943f46aa33e65d719ce1b85b7909eb184f04544
Instruction ID: 69dd45231b6935c44f05121ea2f5240b3825a70d9e286090d0b6ab9bff65194e
Opcode Fuzzy Hash: aff18f6aa5ce4ddc83e669504943f46aa33e65d719ce1b85b7909eb184f04544
Instruction Fuzzy Hash: CC128B30604221DFDB24DF64E885BA9B7B2FF55308F18456DE999CB262C731EC42DBA1

Function 00CFDBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CFDBD6
GetDriveTypeW.KERNEL32(?,00D4DC54,?,\\.\,00D4DC00), ref: 00CFDCC3
SetErrorMode.KERNEL32(00000000,00D4DC54,?,\\.\,00D4DC00), ref: 00CFDE29

Strings

FileBackedVirtual, xrefs: 00CFDDF5
Virtual, xrefs: 00CFDDEE
SATA, xrefs: 00CFDDD9
Unknown, xrefs: 00CFDCE3, 00CFDD8C
USB, xrefs: 00CFDDBD
MMC, xrefs: 00CFDDE7
CDROM, xrefs: 00CFDCF7
SSD, xrefs: 00CFDD50
SAS, xrefs: 00CFDDD2
ATA, xrefs: 00CFDDA1
ATAPI, xrefs: 00CFDD9A
SSA, xrefs: 00CFDDAF
RAID, xrefs: 00CFDDC4
Fixed, xrefs: 00CFDD0B
PhysicalDrive, xrefs: 00CFDC67
Fibre, xrefs: 00CFDDB6
RAMDisk, xrefs: 00CFDCED
SCSI, xrefs: 00CFDD93
Network, xrefs: 00CFDD01
Removable, xrefs: 00CFDD15
iSCSI, xrefs: 00CFDDCB
\\.\, xrefs: 00CFDC2B
1394, xrefs: 00CFDDA8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 35279fe1e9d63d624a880eedf76b97c7b549ea9380ec22b3b88c8416ac5294db
Instruction ID: a8c8bf263faf8e6bce5189f4c34e56950367af1297e427a16eee12d92c8a4566
Opcode Fuzzy Hash: 35279fe1e9d63d624a880eedf76b97c7b549ea9380ec22b3b88c8416ac5294db
Instruction Fuzzy Hash: C451D63024830AEFC394EF15C881979B7A2FBA4704F244919F217D7291DB70DA49EB63

Function 00CBCC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CBCC68
__wcsnicmp.LIBCMT ref: 00CBCC80
__wcsnicmp.LIBCMT ref: 00CBCC98
__wcsnicmp.LIBCMT ref: 00CBCCB0
__wcsnicmp.LIBCMT ref: 00CBCCC8
__wcsnicmp.LIBCMT ref: 00CBCCE0
__wcsnicmp.LIBCMT ref: 00CBCCF8
__wcsnicmp.LIBCMT ref: 00CBCD0C
__wcsnicmp.LIBCMT ref: 00CBCD4D
__wcsnicmp.LIBCMT ref: 00CBCD61
__wcsnicmp.LIBCMT ref: 00CBCD75
__wcsnicmp.LIBCMT ref: 00CBCD89

Strings

#notrayicon, xrefs: 00CBCC7A
#comments-start, xrefs: 00CBCCF2, 00CBCD47
Bad directive syntax error, xrefs: 00D22ECB
#ce, xrefs: 00CBCD83
#OnAutoItStartRegister, xrefs: 00CBCCAA
#include-once, xrefs: 00CBCCC2
#include, xrefs: 00CBCCDA
Unterminated group of comments, xrefs: 00D22FB4
#comments-end, xrefs: 00CBCD6F
#cs, xrefs: 00CBCD06, 00CBCD5B
#requireadmin, xrefs: 00CBCC92
#pragma compile, xrefs: 00CBCC62
Cannot parse #include, xrefs: 00D22FA1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: e359b436e550c4006d9145dd6129c318a7dd37a3ba378f5c55f42f8e6883ac14
Instruction ID: fce7df451be4fe73d09b352ca21b3a5a2dfb52feea2e0cf27338440054bc0ea4
Opcode Fuzzy Hash: e359b436e550c4006d9145dd6129c318a7dd37a3ba378f5c55f42f8e6883ac14
Instruction Fuzzy Hash: 4181F830640215BBDB25AF65DCC2FFF3769AF24704F084029FA05AB1C2EB60DA45E2B1

Function 00D1C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 00D1C788
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00D1C83E
SendMessageW.USER32(?,00001102,00000002,?), ref: 00D1C859
SendMessageW.USER32(?,000000F1,?,00000000), ref: 00D1CB15

Strings

0, xrefs: 00D1C89C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 299bd348c4770164746d17c582e14fce2566de3c9c04d61038e10f82b4347272
Instruction ID: 760c74058184be3fec041c307eeaa23bbbf16edf19dceefee46d5402cefe2351
Opcode Fuzzy Hash: 299bd348c4770164746d17c582e14fce2566de3c9c04d61038e10f82b4347272
Instruction Fuzzy Hash: 97F1C070298301BBD7218F24E886BEABBE5FF45754F081619F598D62A1CB74C880CFB1

Function 00D1638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00D4DC00), ref: 00D16449

Strings

SETCURRENTSELECTION, xrefs: 00D165D6
UNCHECK, xrefs: 00D166A1
CHECK, xrefs: 00D1668B
DELSTRING, xrefs: 00D16569
TABLEFT, xrefs: 00D164A7
SENDCOMMANDID, xrefs: 00D167CA
ISCHECKED, xrefs: 00D16659
HIDEDROPDOWN, xrefs: 00D16520
GETLINECOUNT, xrefs: 00D166E4
GETSELECTED, xrefs: 00D166C1
TABRIGHT, xrefs: 00D164BD
FINDSTRING, xrefs: 00D16596
GETCURRENTLINE, xrefs: 00D16704
EDITPASTE, xrefs: 00D1675B
GETLINE, xrefs: 00D1678B
GETCURRENTCOL, xrefs: 00D16724
ISENABLED, xrefs: 00D1648C
ADDSTRING, xrefs: 00D16536
CURRENTTAB, xrefs: 00D164DD
SELECTSTRING, xrefs: 00D16626
GETCURRENTSELECTION, xrefs: 00D16603
SHOWDROPDOWN, xrefs: 00D16500
ISVISIBLE, xrefs: 00D16455

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: b62f0111fc3f74b9deff74261cc6d131801dc48517c5aced0b207573e9dd9d91
Instruction ID: ffdf9adef2e5e0c2a14d56fbd27cae009b8534f149c483747a8ae07ab48b0eb3
Opcode Fuzzy Hash: b62f0111fc3f74b9deff74261cc6d131801dc48517c5aced0b207573e9dd9d91
Instruction Fuzzy Hash: F5C17030204245ABCB04EF10D551EEE77A6AF95344F14485DF8965B3E2DF30ED8ADBA2

Function 00D1D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00D1D5AE
SetTextColor.GDI32(?,?), ref: 00D1D5B2
GetSysColorBrush.USER32(0000000F), ref: 00D1D5C8
GetSysColor.USER32(0000000F), ref: 00D1D5D3
CreateSolidBrush.GDI32(?), ref: 00D1D5D8
GetSysColor.USER32(00000011), ref: 00D1D5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D1D5FE
SelectObject.GDI32(?,00000000), ref: 00D1D60F
SetBkColor.GDI32(?,00000000), ref: 00D1D618
SelectObject.GDI32(?,?), ref: 00D1D625
InflateRect.USER32(?,000000FF,000000FF), ref: 00D1D644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D1D65B
GetWindowLongW.USER32(00000000,000000F0), ref: 00D1D670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D1D698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00D1D6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 00D1D6DD
DrawFocusRect.USER32(?,?), ref: 00D1D6E8
GetSysColor.USER32(00000011), ref: 00D1D6F6
SetTextColor.GDI32(?,00000000), ref: 00D1D6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00D1D712
SelectObject.GDI32(?,00D1D2A5), ref: 00D1D729
DeleteObject.GDI32(?), ref: 00D1D734
SelectObject.GDI32(?,?), ref: 00D1D73A
DeleteObject.GDI32(?), ref: 00D1D73F
SetTextColor.GDI32(?,?), ref: 00D1D745
SetBkColor.GDI32(?,?), ref: 00D1D74F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 9850dca5ee111c62e4bab5dec08d0690dcaeb78abb106d476ea2730ff00c2146
Instruction ID: 63e4b062cdb55dbaadc30e9551659a8a75a678377d3a7456de216111c351ffc3
Opcode Fuzzy Hash: 9850dca5ee111c62e4bab5dec08d0690dcaeb78abb106d476ea2730ff00c2146
Instruction Fuzzy Hash: CB512B71900218BFDF109FA8EC48EEEBB7AEB09324F204515F915EB2A1D7759A40DF60

Function 00D1B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00D1B7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D1B7C1
CharNextW.USER32(0000014E), ref: 00D1B7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00D1B831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00D1B847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D1B858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00D1B875
SetWindowTextW.USER32(?,0000014E), ref: 00D1B8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00D1B8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D1B90E
_memset.LIBCMT ref: 00D1B933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00D1B97C
_memset.LIBCMT ref: 00D1B9DB
SendMessageW.USER32 ref: 00D1BA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 00D1BA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 00D1BB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 00D1BB2C
GetMenuItemInfoW.USER32(?), ref: 00D1BB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D1BBA3
DrawMenuBar.USER32(?), ref: 00D1BBB2
SetWindowTextW.USER32(?,0000014E), ref: 00D1BBDA

Strings

0, xrefs: 00D1BB4F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 979286bdf5f3979c49c39e57b47ae9a2479553d9e8bc5b73fbb7d6134a17a83c
Instruction ID: fbbe0ee00cd29aa6861bc4414c56968680c143349a2e8acc7978d5972fa36087
Opcode Fuzzy Hash: 979286bdf5f3979c49c39e57b47ae9a2479553d9e8bc5b73fbb7d6134a17a83c
Instruction Fuzzy Hash: F3E1A075900218BBDF109F65EC85EEE7B78FF05720F14815AF959AA290DB708A81DF70

Function 00D1764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D1778A
GetDesktopWindow.USER32 ref: 00D1779F
GetWindowRect.USER32(00000000), ref: 00D177A6
GetWindowLongW.USER32(?,000000F0), ref: 00D17808
DestroyWindow.USER32(?), ref: 00D17834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D1785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D1787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00D178A1
SendMessageW.USER32(?,00000421,?,?), ref: 00D178B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00D178C9
IsWindowVisible.USER32(?), ref: 00D178E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00D17904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00D17918
GetWindowRect.USER32(?,?), ref: 00D17930
MonitorFromPoint.USER32(?,?,00000002), ref: 00D17956
GetMonitorInfoW.USER32 ref: 00D17970
CopyRect.USER32(?,?), ref: 00D17987
SendMessageW.USER32(?,00000412,00000000), ref: 00D179F2

Strings

tooltips_class32, xrefs: 00D17856
(, xrefs: 00D17965
0, xrefs: 00D17735

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 4f56bd09299b9092606c498c605e2558e9fbc725d654deaaed3f1af923b021cb
Instruction ID: 8e93ca14cb11d91229e872d8b6500581446e588f71d91ad27472b710d8798939
Opcode Fuzzy Hash: 4f56bd09299b9092606c498c605e2558e9fbc725d654deaaed3f1af923b021cb
Instruction Fuzzy Hash: FBB18D71608340AFD704DF64D949BAABBF5FF88310F04891DF5999B2A1DB70E844CBA2

Function 00CF6CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00CF6CFB
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00CF6D21
_wcscpy.LIBCMT ref: 00CF6D4F
_wcscmp.LIBCMT ref: 00CF6D5A
_wcscat.LIBCMT ref: 00CF6D70
_wcsstr.LIBCMT ref: 00CF6D7B
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00CF6D97
_wcscat.LIBCMT ref: 00CF6DE0
_wcscat.LIBCMT ref: 00CF6DE7
_wcsncpy.LIBCMT ref: 00CF6E12

Strings

04090000, xrefs: 00CF6DCD
StringFileInfo\, xrefs: 00CF6D6A
DefaultLangCodepage, xrefs: 00CF6DFA
%u.%u.%u.%u, xrefs: 00CF6E75
\VarFileInfo\Translation, xrefs: 00CF6D8F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: da5f85b4e5b91b1555c2ae0cc37257e4743d3419a0e1251fbccfe374ed2d9a12
Instruction ID: 2bd178ba0d01de74e1b64b4ccedd7512f1e7651b1082905d37686d1c8d57b0e5
Opcode Fuzzy Hash: da5f85b4e5b91b1555c2ae0cc37257e4743d3419a0e1251fbccfe374ed2d9a12
Instruction Fuzzy Hash: DD41D672A04214BFE704AB74DC47EBF77BDDF55710F14002AFA01A6282EB74DA05A6B2

Function 00CCA856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CCA939
GetSystemMetrics.USER32(00000007), ref: 00CCA941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00CCA96C
GetSystemMetrics.USER32(00000008), ref: 00CCA974
GetSystemMetrics.USER32(00000004), ref: 00CCA999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00CCA9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00CCA9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00CCA9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00CCAA0D
GetClientRect.USER32(00000000,000000FF), ref: 00CCAA2B
GetStockObject.GDI32(00000011), ref: 00CCAA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CCAA52

Part of subcall function 00CCB63C: GetCursorPos.USER32(000000FF), ref: 00CCB64F
Part of subcall function 00CCB63C: ScreenToClient.USER32(00000000,000000FF), ref: 00CCB66C
Part of subcall function 00CCB63C: GetAsyncKeyState.USER32(00000001), ref: 00CCB691
Part of subcall function 00CCB63C: GetAsyncKeyState.USER32(00000002), ref: 00CCB69F

SetTimer.USER32(00000000,00000000,00000028,00CCAB87), ref: 00CCAA79

Strings

AutoIt v3 GUI, xrefs: 00CCA9F1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 1884bcc6f6ad101e3d69455f803991168ab528d527f349ae1b72bdb7421248a0
Instruction ID: fc91bb1d270b2f4e612dbf75efad3c4d721940c81c1bb8c90fffc73dd022d927
Opcode Fuzzy Hash: 1884bcc6f6ad101e3d69455f803991168ab528d527f349ae1b72bdb7421248a0
Instruction Fuzzy Hash: 64B18B75A0021AAFDB14DFA8DC4AFAE7BB5FB18318F114219FA15E6290DB30D841CF61

Function 00CB2EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00CB2F7A
IsWindow.USER32(?), ref: 00D222FD

Strings

REGEXPTITLE, xrefs: 00D220F8
LAST, xrefs: 00D220B6
REGEXPCLASS, xrefs: 00D22149
ACTIVE, xrefs: 00D220CC
INSTANCE, xrefs: 00D2223C
HANDLE, xrefs: 00D220E2
CLASS, xrefs: 00D22128
TITLE, xrefs: 00D22292
ALL, xrefs: 00D22264

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 62970417-1919597938
Opcode ID: 75c37d9683b5465681812157fa86c29d93f17138efbf8a945dc3eb1ca5d7a042
Instruction ID: dd6bf2a2c4b2a5cbc8e33b4c5c615c9c7aff79161f4b66d0ad3f14c874b07e5b
Opcode Fuzzy Hash: 75c37d9683b5465681812157fa86c29d93f17138efbf8a945dc3eb1ca5d7a042
Instruction Fuzzy Hash: 5FD1F730104742EBCB04EF50D881AFABBB5FF64348F044A1DF496576A1DB31E99ADBA1

Function 00D13639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D13735
RegCreateKeyExW.ADVAPI32(?,?,00000000,00D4DC00,00000000,?,00000000,?,?), ref: 00D137A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00D137EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00D13874
RegCloseKey.ADVAPI32(?), ref: 00D13B94
RegCloseKey.ADVAPI32(00000000), ref: 00D13BA1

Strings

REG_SZ, xrefs: 00D138B2
REG_BINARY, xrefs: 00D13B2F
REG_DWORD, xrefs: 00D13A65
REG_QWORD, xrefs: 00D13AE2
REG_EXPAND_SZ, xrefs: 00D13811
REG_MULTI_SZ, xrefs: 00D1395C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 64e4e821e935122fcf11bef57741ded9a5b9237d14c0a601d15115cfc2fad124
Instruction ID: 20e6af30a33852678bd8756dfa76cc5d6d887ae472ce8505f28ccf9fe953cbea
Opcode Fuzzy Hash: 64e4e821e935122fcf11bef57741ded9a5b9237d14c0a601d15115cfc2fad124
Instruction Fuzzy Hash: 2C026B75204601AFCB14EF28D991E6AB7E5FF88720F04845DF98A9B3A1DB30ED41DB91

Function 00D16BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D16C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00D16D16

Strings

GETSUBITEMCOUNT, xrefs: 00D16CA1
FINDITEM, xrefs: 00D16E81
SELECTCLEAR, xrefs: 00D16D8D
SELECTALL, xrefs: 00D16D75
SELECTINVERT, xrefs: 00D16DDE
GETTEXT, xrefs: 00D16CBF
SELECT, xrefs: 00D16DA8
GETSELECTED, xrefs: 00D16E3C
VIEWCHANGE, xrefs: 00D16ECD
DESELECT, xrefs: 00D16DFC
GETITEMCOUNT, xrefs: 00D16C84
GETSELECTEDCOUNT, xrefs: 00D16CF9
ISSELECTED, xrefs: 00D16D21

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 3a1eac37d0ee07bca3fb3af072b005d91a4ca3b40edad0ef7215609d25512a14
Instruction ID: 0b8075ee82567b6f5f46c27b29c296f96317b5f78bbeff075bbe4b091d05bac7
Opcode Fuzzy Hash: 3a1eac37d0ee07bca3fb3af072b005d91a4ca3b40edad0ef7215609d25512a14
Instruction Fuzzy Hash: FEA17F30204341ABCB14EF24D952AAAB3A5BF45314F14896DF8965B3D2DF31EC46DB61

Function 00CECF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CECF91
__swprintf.LIBCMT ref: 00CED032
_wcscmp.LIBCMT ref: 00CED045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00CED09A
_wcscmp.LIBCMT ref: 00CED0D6
GetClassNameW.USER32(?,?,00000400), ref: 00CED10D
GetDlgCtrlID.USER32(?), ref: 00CED15F
GetWindowRect.USER32(?,?), ref: 00CED195
GetParent.USER32(?), ref: 00CED1B3
ScreenToClient.USER32(00000000), ref: 00CED1BA
GetClassNameW.USER32(?,?,00000100), ref: 00CED234
_wcscmp.LIBCMT ref: 00CED248
GetWindowTextW.USER32(?,?,00000400), ref: 00CED26E
_wcscmp.LIBCMT ref: 00CED282

Strings

%s%u, xrefs: 00CED02C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: 12307723658a055f06910c48fc6a68f6879a2ed021eb58cc4828395fed01c8d6
Instruction ID: 4d17f41c79a07edbe13b4f862087c033bdc366271f6261602e651bcb4d785388
Opcode Fuzzy Hash: 12307723658a055f06910c48fc6a68f6879a2ed021eb58cc4828395fed01c8d6
Instruction Fuzzy Hash: 03A1F471604346AFD714DF65D884FAAB7A8FF44350F00851AFAAAD3190DB30EE46CBA1

Function 00CED8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00CED8EB
_wcscmp.LIBCMT ref: 00CED8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00CED924
CharUpperBuffW.USER32(?,00000000), ref: 00CED941
_wcscmp.LIBCMT ref: 00CED95F
_wcsstr.LIBCMT ref: 00CED970
GetClassNameW.USER32(00000018,?,00000400), ref: 00CED9A8
_wcscmp.LIBCMT ref: 00CED9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00CED9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 00CEDA28
_wcscmp.LIBCMT ref: 00CEDA38
GetClassNameW.USER32(00000010,?,00000400), ref: 00CEDA60
GetWindowRect.USER32(00000004,?), ref: 00CEDAC9

Strings

@, xrefs: 00CED8C6
ThumbnailClass, xrefs: 00CED9B3, 00CEDA33

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: e2da68fcf28b1aa92ade4be834e3a826ab03d6ece8ef46ae877a361b9e4aac53
Instruction ID: 31fc28c958944334d878d91998e08e46442008584913c00d77ad7fb50de1e688
Opcode Fuzzy Hash: e2da68fcf28b1aa92ade4be834e3a826ab03d6ece8ef46ae877a361b9e4aac53
Instruction Fuzzy Hash: 1981C5310083859FDB01DF11D885FAA7BE8FF84314F04846AFD9A9A096EB34DE45DBA1

Function 00CED6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CED753

Strings

REGEXP=, xrefs: 00CED768
[LAST, xrefs: 00CED800
[REGEXPTITLE:, xrefs: 00CED77B
LAST, xrefs: 00CED718
[CLASS:, xrefs: 00CED7A3
[HANDLE:, xrefs: 00CED75F
ACTIVE, xrefs: 00CED72E
CLASSNAME=, xrefs: 00CED790
HANDLE=, xrefs: 00CED74C
[ALL, xrefs: 00CED7F9
[ACTIVE, xrefs: 00CED740
ALL, xrefs: 00CED7E7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 5946e2f659b8b18e43bfb26854c5d45c273c6ae1ddb0669afb47686bda5933b8
Instruction ID: 7e0556417a8c04816007f6e929225e02312f54fab2c024a0afff1a8658051fe9
Opcode Fuzzy Hash: 5946e2f659b8b18e43bfb26854c5d45c273c6ae1ddb0669afb47686bda5933b8
Instruction Fuzzy Hash: F7318D31A44685ABEB24FB55DD83FEEB3759F20754F20002AF452B10D9EB61AF08E661

Function 00CEEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00CEEAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00CEEAC2
SetWindowTextW.USER32(?,?), ref: 00CEEAD9
GetDlgItem.USER32(?,000003EA), ref: 00CEEAEE
SetWindowTextW.USER32(00000000,?), ref: 00CEEAF4
GetDlgItem.USER32(?,000003E9), ref: 00CEEB04
SetWindowTextW.USER32(00000000,?), ref: 00CEEB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00CEEB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00CEEB45
GetWindowRect.USER32(?,?), ref: 00CEEB4E
SetWindowTextW.USER32(?,?), ref: 00CEEBB9
GetDesktopWindow.USER32 ref: 00CEEBBF
GetWindowRect.USER32(00000000), ref: 00CEEBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00CEEC12
GetClientRect.USER32(?,?), ref: 00CEEC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00CEEC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00CEEC6F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 7836f85bc1b075c8488abc3ee1d1ad30ef39a9c426562dd97fb09b01043799d1
Instruction ID: 2c1a481c1e9aca76cfd8eef71cad4a2036669964e1f046b9db3501d5a53b7334
Opcode Fuzzy Hash: 7836f85bc1b075c8488abc3ee1d1ad30ef39a9c426562dd97fb09b01043799d1
Instruction Fuzzy Hash: 44517A71900709AFDB209FA9DD8AF6EBBF5FF04744F004928E696A26A0C774A944CF10

Function 00D079B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00D079C6
LoadCursorW.USER32(00000000,00007F00), ref: 00D079D1
LoadCursorW.USER32(00000000,00007F03), ref: 00D079DC
LoadCursorW.USER32(00000000,00007F8B), ref: 00D079E7
LoadCursorW.USER32(00000000,00007F01), ref: 00D079F2
LoadCursorW.USER32(00000000,00007F81), ref: 00D079FD
LoadCursorW.USER32(00000000,00007F88), ref: 00D07A08
LoadCursorW.USER32(00000000,00007F80), ref: 00D07A13
LoadCursorW.USER32(00000000,00007F86), ref: 00D07A1E
LoadCursorW.USER32(00000000,00007F83), ref: 00D07A29
LoadCursorW.USER32(00000000,00007F85), ref: 00D07A34
LoadCursorW.USER32(00000000,00007F82), ref: 00D07A3F
LoadCursorW.USER32(00000000,00007F84), ref: 00D07A4A
LoadCursorW.USER32(00000000,00007F04), ref: 00D07A55
LoadCursorW.USER32(00000000,00007F02), ref: 00D07A60
LoadCursorW.USER32(00000000,00007F89), ref: 00D07A6B
GetCursorInfo.USER32(?), ref: 00D07A7B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 6fac0beaf698dd02b84e838e267afd80699493fb71918cce34e15665159bb778
Instruction ID: 560f0d77e26df2f0cdb6c7958acc80eb8722801d5a042ac937f9098de0136697
Opcode Fuzzy Hash: 6fac0beaf698dd02b84e838e267afd80699493fb71918cce34e15665159bb778
Instruction Fuzzy Hash: 343129B0E083196ADB109FB68C8995FBFE8FF04750F50452AE50DE7280DA78A5008FA1

Function 00CBC833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 00CCE968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00CBC8B7,?,00002000,?,?,00000000,?,00CB419E,?,?,?,00D4DC00), ref: 00CCE984

Part of subcall function 00CB660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CB53B1,?,?,00CB61FF,?,00000000,00000001,00000000), ref: 00CB662F

__wsplitpath.LIBCMT ref: 00CBC93E

Part of subcall function 00CD1DFC: __wsplitpath_helper.LIBCMT ref: 00CD1E3C

_wcscpy.LIBCMT ref: 00CBC953
_wcscat.LIBCMT ref: 00CBC968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00CBC978
SetCurrentDirectoryW.KERNEL32(?), ref: 00CBCABE

Part of subcall function 00CBB337: _wcscpy.LIBCMT ref: 00CBB36F

Strings

Bad directive syntax error, xrefs: 00D23429
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00D23098
Error opening the file, xrefs: 00D230B4, 00D2313D
>>>AUTOIT SCRIPT<<<, xrefs: 00D2311B
AU3!, xrefs: 00CBC90C
EA06, xrefs: 00D230C9
Unterminated string, xrefs: 00D23470

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: 435c3afae8823631c4e53b6d63ccc89d5de393da106076768acc3295ed2acf40
Instruction ID: 784170906bb4564b63398a4d9cfa19cebcf57aab25bfedd513d20d04fb7cb26b
Opcode Fuzzy Hash: 435c3afae8823631c4e53b6d63ccc89d5de393da106076768acc3295ed2acf40
Instruction Fuzzy Hash: 7D128E715083419FC724EF24C881AAFBBE5BF99304F04491EF59993262DB30DA49EB63

Function 00D1CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D1CEFB
DestroyWindow.USER32(00000000,?), ref: 00D1CF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00D1CFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00D1D016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D1D025
DestroyWindow.USER32(?), ref: 00D1D042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00CB0000,00000000), ref: 00D1D075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D1D094
GetDesktopWindow.USER32 ref: 00D1D0A9
GetWindowRect.USER32(00000000), ref: 00D1D0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D1D0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00D1D0DA

Part of subcall function 00CCB526: GetWindowLongW.USER32(?,000000EB), ref: 00CCB537

Strings

tooltips_class32, xrefs: 00D1CFED, 00D1D06E
0, xrefs: 00D1CF1B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 8264ef90d715d5f6aafb06973023ddb64f8581fba6afc68022998f6946065146
Instruction ID: de613f872c8eed46a283c44911fd9cf18786c5055bf8b20183becac93373cef5
Opcode Fuzzy Hash: 8264ef90d715d5f6aafb06973023ddb64f8581fba6afc68022998f6946065146
Instruction Fuzzy Hash: 5E71AE74150305AFD720CF28DC85FAA77E6EB88744F08461DF985873A1DB74E982DB22

Function 00D1F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

DragQueryPoint.SHELL32(?,?), ref: 00D1F37A

Part of subcall function 00D1D7DE: ClientToScreen.USER32(?,?), ref: 00D1D807
Part of subcall function 00D1D7DE: GetWindowRect.USER32(?,?), ref: 00D1D87D
Part of subcall function 00D1D7DE: PtInRect.USER32(?,?,00D1ED5A), ref: 00D1D88D

SendMessageW.USER32(?,000000B0,?,?), ref: 00D1F3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D1F3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D1F411
_wcscat.LIBCMT ref: 00D1F441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D1F458
SendMessageW.USER32(?,000000B0,?,?), ref: 00D1F471
SendMessageW.USER32(?,000000B1,?,?), ref: 00D1F488
SendMessageW.USER32(?,000000B1,?,?), ref: 00D1F4AA
DragFinish.SHELL32(?), ref: 00D1F4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D1F59C

Strings

@GUI_DROPID, xrefs: 00D1F4D1
@GUI_DRAGID, xrefs: 00D1F510
@GUI_DRAGFILE, xrefs: 00D1F54B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 7b7caba44e5725bd35409f712cb5984cee31a7cc894bd963ca0cec3c0e052d31
Instruction ID: 08a94396d334108a20a8a0d6d86df8ec540b8b5e1265beb28c1d4989527d60b3
Opcode Fuzzy Hash: 7b7caba44e5725bd35409f712cb5984cee31a7cc894bd963ca0cec3c0e052d31
Instruction Fuzzy Hash: A3613971108305AFC301DF64DC86E9FBBF9EB89710F004A1EF595922A1DB709A59DB62

Function 00CFAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00CFAB3D
VariantCopy.OLEAUT32(?,?), ref: 00CFAB46
VariantClear.OLEAUT32(?), ref: 00CFAB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00CFAC40
__swprintf.LIBCMT ref: 00CFAC70
VarR8FromDec.OLEAUT32(?,?), ref: 00CFAC9C
VariantInit.OLEAUT32(?), ref: 00CFAD4D
SysFreeString.OLEAUT32(00000016), ref: 00CFADDF
VariantClear.OLEAUT32(?), ref: 00CFAE35
VariantClear.OLEAUT32(?), ref: 00CFAE44
VariantInit.OLEAUT32(00000000), ref: 00CFAE80

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00CFAC6A
Default, xrefs: 00CFACFD

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: d3a5905aa73642621da5f8df15c8f53a4d253a9d006fa9fcc33144d8543a3a59
Instruction ID: b927c46bf717c5ff1f44d467ed37d2a343292912af1be47aece58f4219b30d64
Opcode Fuzzy Hash: d3a5905aa73642621da5f8df15c8f53a4d253a9d006fa9fcc33144d8543a3a59
Instruction Fuzzy Hash: B7D104B1604209DBCB549F66D884BBEF7B6FF04700F148099E6199B290DB70ED50EBA3

Function 00D1716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D171FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D17247

Strings

SELECT, xrefs: 00D173E0
EXISTS, xrefs: 00D172B0
EXPAND, xrefs: 00D172E1
COLLAPSE, xrefs: 00D1728D
GETSELECTED, xrefs: 00D1733F
UNCHECK, xrefs: 00D1740B
CHECK, xrefs: 00D17267
GETITEMCOUNT, xrefs: 00D17311
GETTOTALCOUNT, xrefs: 00D1722A
ISCHECKED, xrefs: 00D173B2
GETTEXT, xrefs: 00D17382

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 45b7b096434fb97e03d4ea71c8d9c796df76a17ddab61721857f7e1185bcde35
Instruction ID: 5ace8f86349a91be089a0b675d3d5fbb52d1996858ee2bcac26c6926b710808f
Opcode Fuzzy Hash: 45b7b096434fb97e03d4ea71c8d9c796df76a17ddab61721857f7e1185bcde35
Instruction Fuzzy Hash: A5916074208701ABCB04EF10D491AAEB7A1BF95310F04485DF9965B3A3DF30ED4AEBA1

Function 00D1E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00D1E5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00D1BEAF), ref: 00D1E607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D1E647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D1E68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00D1E6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,00D1BEAF), ref: 00D1E6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D1E6DF
DestroyIcon.USER32(?,?,?,?,?,00D1BEAF), ref: 00D1E6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00D1E70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00D1E717

Part of subcall function 00CD0FA7: __wcsicmp_l.LIBCMT ref: 00CD1030

Strings

.icl, xrefs: 00D1E521
.dll, xrefs: 00D1E564
.exe, xrefs: 00D1E541

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 0c05f980d1b51f8afc8328781fe04848a385105ed47127cf07a0e2be9abc3a14
Instruction ID: c42f8f8d64208867b05e2b1188cf0e1c13eeaee15ba5f89ac6d4a07d9fb186b7
Opcode Fuzzy Hash: 0c05f980d1b51f8afc8328781fe04848a385105ed47127cf07a0e2be9abc3a14
Instruction Fuzzy Hash: 0261BF71540215BAEB24DF68EC46FFE7BA9BB18724F204505F915D61D0EB70E980DBB0

Function 00CFD219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

CharLowerBuffW.USER32(?,?), ref: 00CFD292
GetDriveTypeW.KERNEL32 ref: 00CFD2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CFD327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CFD35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CFD38C

Strings

set cd door , xrefs: 00CFD32D
closed, xrefs: 00CFD2A6, 00CFD2AF
close cd wait, xrefs: 00CFD377
close, xrefs: 00CFD298
open, xrefs: 00CFD2B9
wait, xrefs: 00CFD349
type cdaudio alias cd wait, xrefs: 00CFD30A
open , xrefs: 00CFD2EE

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: 0c7d7e1e4ca5baac6bc9109896ce6e37c9bbb5128cb285298e745fbe3c352caa
Instruction ID: c7cf90ea1d069ec8ace414755fd4e6a668a63b67daea12658c6893d6695d89c3
Opcode Fuzzy Hash: 0c7d7e1e4ca5baac6bc9109896ce6e37c9bbb5128cb285298e745fbe3c352caa
Instruction Fuzzy Hash: D2512B711043059FC700EF14C9819AEB7F9EF98758F10485DF996A72A1DB31EE09DB92

Function 00CF26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00D23973,00000016,0000138C,00000016,?,00000016,00D4DDB4,00000000,?), ref: 00CF26F1
LoadStringW.USER32(00000000,?,00D23973,00000016), ref: 00CF26FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00D23973,00000016,0000138C,00000016,?,00000016,00D4DDB4,00000000,?,00000016), ref: 00CF271C
LoadStringW.USER32(00000000,?,00D23973,00000016), ref: 00CF271F
__swprintf.LIBCMT ref: 00CF276F
__swprintf.LIBCMT ref: 00CF2780
_wprintf.LIBCMT ref: 00CF2829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CF2840

Strings

Line %d (File "%s"):, xrefs: 00CF2769
%s (%d) : ==> %s: %s %s, xrefs: 00CF2824
^ ERROR, xrefs: 00CF27D5
Line %d:, xrefs: 00CF277A
Error: , xrefs: 00CF27F7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: 78ba685d7b2be4707fe1a3b716c2737fedd46135adb7642be14c6565066cf0ba
Instruction ID: 93d8b98e56389238cc13bc8ecac13d3d80b52f8d7dac5dadec35fe6b3ccdd0a7
Opcode Fuzzy Hash: 78ba685d7b2be4707fe1a3b716c2737fedd46135adb7642be14c6565066cf0ba
Instruction Fuzzy Hash: 5B414E72800219BBCB14FBE4DD86EEFB778AF15340F500065F602B2192EA706F59EB61

Function 00CFD0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00CFD0D8
__swprintf.LIBCMT ref: 00CFD0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CFD137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00CFD15C
_memset.LIBCMT ref: 00CFD17B
_wcsncpy.LIBCMT ref: 00CFD1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00CFD1EC
CloseHandle.KERNEL32(00000000), ref: 00CFD1F7
RemoveDirectoryW.KERNEL32(?), ref: 00CFD200
CloseHandle.KERNEL32(00000000), ref: 00CFD20A

Strings

:, xrefs: 00CFD11B
\, xrefs: 00CFD110
\??\%s, xrefs: 00CFD0F4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 67a480a1c1f3bd8d0b28afbe5bdbf3324baca00193d546c23b5df16defed95d6
Instruction ID: c37912636cca956182c5e5998ac987818dee0b769bdd234288b4063d946bfb56
Opcode Fuzzy Hash: 67a480a1c1f3bd8d0b28afbe5bdbf3324baca00193d546c23b5df16defed95d6
Instruction Fuzzy Hash: 5B319276500209ABDB21DFA4DC49FEF37BEAF89700F1040A6F61AD2160E7709B459B35

Function 00D1E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00D1BEF4,?,?), ref: 00D1E754
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E76B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E776
CloseHandle.KERNEL32(00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E783
GlobalLock.KERNEL32(00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E78C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E79B
GlobalUnlock.KERNEL32(00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E7A4
CloseHandle.KERNEL32(00000000,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00D1BEF4,?,?,00000000,?), ref: 00D1E7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,00D3D9BC,?), ref: 00D1E7D5
GlobalFree.KERNEL32(00000000), ref: 00D1E7E5
GetObjectW.GDI32(00000000,00000018,?), ref: 00D1E809
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00D1E834
DeleteObject.GDI32(00000000), ref: 00D1E85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00D1E872

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: c51967814f5472a99ec92ccf54f5446280e429b3f47ba166ee4975fec580ed5f
Instruction ID: 8293cd2cfb69f4d8960c1aee14403628da278fb8d860a62386f0068a2902ded5
Opcode Fuzzy Hash: c51967814f5472a99ec92ccf54f5446280e429b3f47ba166ee4975fec580ed5f
Instruction Fuzzy Hash: C5412975600304BFDB119F65EC88EAA7BB9EB89711F104058F916D72A0DB309D41DF70

Function 00D005F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00D0076F
_wcscat.LIBCMT ref: 00D00787
_wcscat.LIBCMT ref: 00D00799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00D007AE
SetCurrentDirectoryW.KERNEL32(?), ref: 00D007C2
GetFileAttributesW.KERNEL32(?), ref: 00D007DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 00D007F4
SetCurrentDirectoryW.KERNEL32(?), ref: 00D00806

Strings

*.*, xrefs: 00D00845

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 7f5ab35005ffb8dac7e62dcbff249a439a46ab3707547a3475f433ba5fdb5662
Instruction ID: fc3d70ab9cc0c85b7c7b6c388c65a86a3ff2ff94cee00d6399204097ad4f83be
Opcode Fuzzy Hash: 7f5ab35005ffb8dac7e62dcbff249a439a46ab3707547a3475f433ba5fdb5662
Instruction Fuzzy Hash: 0B819471504341AFCB24EF24C445B6EBBE9FBC8300F58882EF589C7291EB35D9548BA2

Function 00D1EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D1EF3B
GetFocus.USER32 ref: 00D1EF4B
GetDlgCtrlID.USER32(00000000), ref: 00D1EF56
_memset.LIBCMT ref: 00D1F081
GetMenuItemInfoW.USER32 ref: 00D1F0AC
GetMenuItemCount.USER32(00000000), ref: 00D1F0CC
GetMenuItemID.USER32(?,00000000), ref: 00D1F0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00D1F113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00D1F15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D1F193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00D1F1C8

Strings

0, xrefs: 00D1F079

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 468e207b9c305a85a9893ac53484498777fadf177d4af962100cddcd491facbd
Instruction ID: 45e5d0d4ae454ac28c73f560d956c6d711f3be780859574d716dc5ed692e155f
Opcode Fuzzy Hash: 468e207b9c305a85a9893ac53484498777fadf177d4af962100cddcd491facbd
Instruction Fuzzy Hash: D2816A71108301BFD710CF14E885AABBBE9FB88714F14452EF99997291DB70D981CBB2

Function 00CEA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00CEABD7
Part of subcall function 00CEABBB: GetLastError.KERNEL32(?,00CEA69F,?,?,?), ref: 00CEABE1
Part of subcall function 00CEABBB: GetProcessHeap.KERNEL32(00000008,?,?,00CEA69F,?,?,?), ref: 00CEABF0
Part of subcall function 00CEABBB: HeapAlloc.KERNEL32(00000000,?,00CEA69F,?,?,?), ref: 00CEABF7
Part of subcall function 00CEABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00CEAC0E

Part of subcall function 00CEAC56: GetProcessHeap.KERNEL32(00000008,00CEA6B5,00000000,00000000,?,00CEA6B5,?), ref: 00CEAC62
Part of subcall function 00CEAC56: HeapAlloc.KERNEL32(00000000,?,00CEA6B5,?), ref: 00CEAC69
Part of subcall function 00CEAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CEA6B5,?), ref: 00CEAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CEA8CB
_memset.LIBCMT ref: 00CEA8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CEA8FF
GetLengthSid.ADVAPI32(?), ref: 00CEA910
GetAce.ADVAPI32(?,00000000,?), ref: 00CEA94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CEA969
GetLengthSid.ADVAPI32(?), ref: 00CEA986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CEA995
HeapAlloc.KERNEL32(00000000), ref: 00CEA99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CEA9BD
CopySid.ADVAPI32(00000000), ref: 00CEA9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CEA9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CEAA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CEAA2F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: f7730164ded3765c8bb890bd89fd659fb8640737ba4f2ac38ddea5f738a642d3
Instruction ID: bf1e621a7323f89b05640698a8d36bde8ed3938d5bfd85a1cb08385b9dd92692
Opcode Fuzzy Hash: f7730164ded3765c8bb890bd89fd659fb8640737ba4f2ac38ddea5f738a642d3
Instruction Fuzzy Hash: 80514B71900249AFDF14DFA5DD85AEEBB7AFF04300F148129F921EA290D735AA05DF61

Function 00D09DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D09E36
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00D09E42
CreateCompatibleDC.GDI32(?), ref: 00D09E4E
SelectObject.GDI32(00000000,?), ref: 00D09E5B
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00D09EAF
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00D09EEB
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00D09F0F
SelectObject.GDI32(00000006,?), ref: 00D09F17
DeleteObject.GDI32(?), ref: 00D09F20
DeleteDC.GDI32(00000006), ref: 00D09F27
ReleaseDC.USER32(00000000,?), ref: 00D09F32

Strings

(, xrefs: 00D09ED7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: a668c230fbf144b5596d1789347896859c9dd8cdd64f118821e2f72eb7c8c235
Instruction ID: e486a4334ae0d68dfedf688e3788afaf113e8b2c503c339da45001303af6e81b
Opcode Fuzzy Hash: a668c230fbf144b5596d1789347896859c9dd8cdd64f118821e2f72eb7c8c235
Instruction Fuzzy Hash: 3C513775900309AFCB15CFA8D885EAEBBBAEF48710F14841DF999A7350D731A941CFA0

Function 00CFCC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 00CFCCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 00CFCCC5
__swprintf.LIBCMT ref: 00CFCD1E
__swprintf.LIBCMT ref: 00CFCD37
_wprintf.LIBCMT ref: 00CFCDED
_wprintf.LIBCMT ref: 00CFCE0B

Strings

"%s" (%d) : ==> %s:, xrefs: 00CFCE06
Line %d (File "%s"):, xrefs: 00CFCD18, 00CFCD31
^ ERROR, xrefs: 00CFCD8F
Error: , xrefs: 00CFCDB5
"%s" (%d) : ==> %s:%s%s, xrefs: 00CFCDE8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: f9987dcfcecb1b880fecbd763f07ffdbe810c55290a763107decc8f65890a6fc
Instruction ID: c67686379d28c926c8224f136871ae70e3c688370ac7df7790a09e2270b1d19b
Opcode Fuzzy Hash: f9987dcfcecb1b880fecbd763f07ffdbe810c55290a763107decc8f65890a6fc
Instruction Fuzzy Hash: 9D515E3190024DBBCB15EBA4CE86EEEB779AF09340F100165F515721A2EB316F59EF61

Function 00CFCA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00CFCA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00CFCAB0
__swprintf.LIBCMT ref: 00CFCB09
__swprintf.LIBCMT ref: 00CFCB22
_wprintf.LIBCMT ref: 00CFCBCD
_wprintf.LIBCMT ref: 00CFCBEB

Strings

"%s" (%d) : ==> %s:, xrefs: 00CFCBE6
Line %d (File "%s"):, xrefs: 00CFCB03, 00CFCB1C
^ ERROR , xrefs: 00CFCB64
Error: , xrefs: 00CFCB95
"%s" (%d) : ==> %s:%s%s, xrefs: 00CFCBC8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: 49f58d958152fc390230f4a3ab8608babfcb307efc3dbca591f6230298d6d9fa
Instruction ID: 73c7a7f697abb835884e3dd4490e0ae797cf616cf3d64f42821b09f8c4116fa5
Opcode Fuzzy Hash: 49f58d958152fc390230f4a3ab8608babfcb307efc3dbca591f6230298d6d9fa
Instruction Fuzzy Hash: 08518E31900209BBCB15EBE4DE82EEEB778AF04340F100166F615721A2EB306F59EF61

Function 00CF55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF55D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00CF5664
GetMenuItemCount.USER32(00D71708), ref: 00CF56ED
DeleteMenu.USER32(00D71708,00000005,00000000,000000F5,?,?), ref: 00CF577D
DeleteMenu.USER32(00D71708,00000004,00000000), ref: 00CF5785
DeleteMenu.USER32(00D71708,00000006,00000000), ref: 00CF578D
DeleteMenu.USER32(00D71708,00000003,00000000), ref: 00CF5795
GetMenuItemCount.USER32(00D71708), ref: 00CF579D
SetMenuItemInfoW.USER32(00D71708,00000004,00000000,00000030), ref: 00CF57D3
GetCursorPos.USER32(?), ref: 00CF57DD
SetForegroundWindow.USER32(00000000), ref: 00CF57E6
TrackPopupMenuEx.USER32(00D71708,00000000,?,00000000,00000000,00000000), ref: 00CF57F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00CF5805

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: da5e024059ea8cbcff3e1335bac5dde8fb441a199f54f65d7817c13aa074f981
Instruction ID: 2424c3b5f5cf413bda5ffd0de8c7e5ff0975ead876d91f8b352b8199569fe859
Opcode Fuzzy Hash: da5e024059ea8cbcff3e1335bac5dde8fb441a199f54f65d7817c13aa074f981
Instruction Fuzzy Hash: F471E470640A0DBEEB619B55DC49FBABF65FF01364F240206F734AA2D1C7715910DBA2

Function 00CEA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CEA1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00CEA211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00CEA22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00CEA249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00CEA273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00CEA29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00CEA2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00CEA2AB

Strings

SOFTWARE\Classes\, xrefs: 00CEA17D
\CLSID, xrefs: 00CEA193
\IPC$, xrefs: 00CEA1F3

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: e4cc92f70569035d3b07d215162201eb4f788141a27b77c660938219e51a881d
Instruction ID: 6af3ea4d21c30b7987d2e3c5df3a3958150bdf4e08e92808c115a5959ba32b69
Opcode Fuzzy Hash: e4cc92f70569035d3b07d215162201eb4f788141a27b77c660938219e51a881d
Instruction Fuzzy Hash: E141E776C10229AFDF15EBA4DC85DEEB778BF04740F004529E915B32A1EB70AE05DB60

Function 00D13C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D12BB5,?,?), ref: 00D13C1D

Strings

HKLM, xrefs: 00D13C81
HKCR, xrefs: 00D13CAB
HKCU, xrefs: 00D13CF3
HKEY_CLASSES_ROOT, xrefs: 00D13C96
HKEY_LOCAL_MACHINE, xrefs: 00D13C6C
HKU, xrefs: 00D13D15
HKEY_USERS, xrefs: 00D13D04
HKCC, xrefs: 00D13CD1
HKEY_CURRENT_USER, xrefs: 00D13CE2
HKEY_CURRENT_CONFIG, xrefs: 00D13CC0

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: c6cf1d770ba6a8e498fd512275e0e210f21b585e40180c334e78a59476e264b0
Instruction ID: 33670048239f3665a31531b5e6485c35a968bf693677a81cd6a1cded44a9886e
Opcode Fuzzy Hash: c6cf1d770ba6a8e498fd512275e0e210f21b585e40180c334e78a59476e264b0
Instruction Fuzzy Hash: 6941527010024A9BDF04EF10F851AEB3365AF62340F544458EC965B292EF70DE5ADB70

Function 00CF25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00D236F4,00000010,?,Bad directive syntax error,00D4DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00CF25D6
LoadStringW.USER32(00000000,?,00D236F4,00000010), ref: 00CF25DD
_wprintf.LIBCMT ref: 00CF2610
__swprintf.LIBCMT ref: 00CF2632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00CF26A1

Strings

., xrefs: 00CF2687
Line %d (File "%s"):, xrefs: 00CF2647
Line %d:, xrefs: 00CF262C
%s (%d) : ==> %s.: %s %s, xrefs: 00CF260B
Error: , xrefs: 00CF266F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: 3da88dfc6143d4ea0a05c5d9e67f2539791488da333b8f3385da6c749a5ffe74
Instruction ID: 5d5085996ba1c54bb545d80e8fd74f90c391d0677871d7b53ba8b48b93d5cf6a
Opcode Fuzzy Hash: 3da88dfc6143d4ea0a05c5d9e67f2539791488da333b8f3385da6c749a5ffe74
Instruction Fuzzy Hash: E7215C3184021EBFCF11AF90CC4AFEE7B39BF18304F040455F615A61A2EA71A628EF61

Function 00CF7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00CF7B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00CF7B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CF7B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00CF7B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00CF7B8C

Strings

play PlayMe, xrefs: 00CF7B87
play PlayMe wait, xrefs: 00CF7B76
status PlayMe mode, xrefs: 00CF7B3D
close PlayMe, xrefs: 00CF7B53, 00CF7B80
open , xrefs: 00CF7AF1
alias PlayMe, xrefs: 00CF7B1B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 119737a18265c3f545b293001e44ec550b2c970c0d638e228f6d4273f8d6b385
Instruction ID: 92df467a00b5e58ee958639d414096944fe7acab11f5dd7836e8a4053c735bb3
Opcode Fuzzy Hash: 119737a18265c3f545b293001e44ec550b2c970c0d638e228f6d4273f8d6b385
Instruction Fuzzy Hash: EF1194A165025D7ED720B765CC8ADFF7B7CEBD2B10F000519B422A20D1EEB01A49D5B1

Function 00CF778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CF7794

Part of subcall function 00CCDC38: timeGetTime.WINMM(?,75A8B400,00D258AB), ref: 00CCDC3C

Sleep.KERNEL32(0000000A), ref: 00CF77C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00CF77E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00CF7806
SetActiveWindow.USER32 ref: 00CF7825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00CF7833
SendMessageW.USER32(00000010,00000000,00000000), ref: 00CF7852
Sleep.KERNEL32(000000FA), ref: 00CF785D
IsWindow.USER32 ref: 00CF7869
EndDialog.USER32(00000000), ref: 00CF787A

Strings

BUTTON, xrefs: 00CF77F8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 9d5a00f83b790a642ec119fa313945f9d04eb560bdf53e72ca91f5b736826abf
Instruction ID: ce3abe13a91b5f886139abcca547c0abf5bf1fde5a67a15a903f708bc94cb165
Opcode Fuzzy Hash: 9d5a00f83b790a642ec119fa313945f9d04eb560bdf53e72ca91f5b736826abf
Instruction Fuzzy Hash: 90213E70204709AFE7516B60EC89B363F6AFB45388F400125F61AD63A2EB719D54EA36

Function 00D002EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

CoInitialize.OLE32(00000000), ref: 00D0034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00D003DE
SHGetDesktopFolder.SHELL32(?), ref: 00D003F2
CoCreateInstance.OLE32(00D3DA8C,00000000,00000001,00D63CF8,?), ref: 00D0043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00D004AD
CoTaskMemFree.OLE32(?,?), ref: 00D00505
_memset.LIBCMT ref: 00D00542
SHBrowseForFolderW.SHELL32(?), ref: 00D0057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D005A1
CoTaskMemFree.OLE32(00000000), ref: 00D005A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00D005DF
CoUninitialize.OLE32(00000001,00000000), ref: 00D005E1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: bdd8f9461933c1301ca405fa021747268fd2df09f68dcf3649f921c18d5df702
Instruction ID: eadb8748ac1e59719f809bcc08c7c88d7d71f10ccc1c06abeaf9ab100e59d933
Opcode Fuzzy Hash: bdd8f9461933c1301ca405fa021747268fd2df09f68dcf3649f921c18d5df702
Instruction Fuzzy Hash: B2B1C975A00209AFDB14DFA4C889EAEBBB9EF48304F148459F909EB251DB70ED41CF60

Function 00CF2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CF2ED6
SetKeyboardState.USER32(?), ref: 00CF2F41
GetAsyncKeyState.USER32(000000A0), ref: 00CF2F61
GetKeyState.USER32(000000A0), ref: 00CF2F78
GetAsyncKeyState.USER32(000000A1), ref: 00CF2FA7
GetKeyState.USER32(000000A1), ref: 00CF2FB8
GetAsyncKeyState.USER32(00000011), ref: 00CF2FE4
GetKeyState.USER32(00000011), ref: 00CF2FF2
GetAsyncKeyState.USER32(00000012), ref: 00CF301B
GetKeyState.USER32(00000012), ref: 00CF3029
GetAsyncKeyState.USER32(0000005B), ref: 00CF3052
GetKeyState.USER32(0000005B), ref: 00CF3060

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: b083077df1a057ab3e28d3afe55b51b241b49792b2577c9274546b8268625815
Instruction ID: c63a065db8e8a8029100e0c1a2ba159827524f881b3bed10141f1933b635be8f
Opcode Fuzzy Hash: b083077df1a057ab3e28d3afe55b51b241b49792b2577c9274546b8268625815
Instruction Fuzzy Hash: FB51C620A047DC29FBB5DBA488107FABBB45F11340F08859ED7D25A1C2DE549B8CCB63

Function 00CEED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00CEED1E
GetWindowRect.USER32(00000000,?), ref: 00CEED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00CEED8E
GetDlgItem.USER32(?,00000002), ref: 00CEED99
GetWindowRect.USER32(00000000,?), ref: 00CEEDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00CEEE01
GetDlgItem.USER32(?,000003E9), ref: 00CEEE0F
GetWindowRect.USER32(00000000,?), ref: 00CEEE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00CEEE63
GetDlgItem.USER32(?,000003EA), ref: 00CEEE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00CEEE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 00CEEE9B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 52691e9cfa03438b0eaa244df58b68bae7aeb644d0148f06f36c948dd1bd4f76
Instruction ID: 9369eed2d3a84da977cbbdd1a3abd2646f601eb305eb3f01d5790cd69afdf2f3
Opcode Fuzzy Hash: 52691e9cfa03438b0eaa244df58b68bae7aeb644d0148f06f36c948dd1bd4f76
Instruction Fuzzy Hash: 5F510371B00709AFDB18CF69DD86AAEBBB6FB88740F148129F529D7390D7709E008B10

Function 00CCB73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00CCB759,?,00000000,?,?,?,?,00CCB72B,00000000,?), ref: 00CCBA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00CCB72B), ref: 00CCB7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,00CCB72B,00000000,?,?,00CCB2EF,?,?), ref: 00CCB88D
DestroyAcceleratorTable.USER32(00000000), ref: 00D2D8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00CCB72B,00000000,?,?,00CCB2EF,?,?), ref: 00D2D8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00CCB72B,00000000,?,?,00CCB2EF,?,?), ref: 00D2D8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00CCB72B,00000000,?,?,00CCB2EF,?,?), ref: 00D2D90A
DeleteObject.GDI32(00000000), ref: 00D2D91C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 58f3ba246b0d49874ed6bf578d0f697454230c15c54a1309ee6aee1534b1bf14
Instruction ID: 4bf3a4e9adcfe58ec66b3880778c1893e0bcc61390784ceb9e46ca771777d21b
Opcode Fuzzy Hash: 58f3ba246b0d49874ed6bf578d0f697454230c15c54a1309ee6aee1534b1bf14
Instruction Fuzzy Hash: 36617D34500710DFDB259F69E98AB29B7F6FFA4715F18461DE44A86AA0D730ACC0DFA0

Function 00CCB40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00CCB526: GetWindowLongW.USER32(?,000000EB), ref: 00CCB537

GetSysColor.USER32(0000000F), ref: 00CCB438

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 365088d2d985297d17ad1c08205a9b4cdd88d5a96469315f50e3633840eabc3b
Instruction ID: 2d830aadce50d59aa05b27243410b53cb767de57d30207783904376d3d14bd1a
Opcode Fuzzy Hash: 365088d2d985297d17ad1c08205a9b4cdd88d5a96469315f50e3633840eabc3b
Instruction Fuzzy Hash: D741C3300042509FDB249F68E88AFB93B66AB06731F184269FDA5CE2E6D7318D41DB31

Function 00CF690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00CF6923
_wcscpy.LIBCMT ref: 00CF6934
__wsplitpath.LIBCMT ref: 00CF6958
__wsplitpath.LIBCMT ref: 00CF6979
_wcscpy.LIBCMT ref: 00CF699B
_wcscpy.LIBCMT ref: 00CF69B9
_wcscpy.LIBCMT ref: 00CF69C7
_wcscat.LIBCMT ref: 00CF69D6
_wcscat.LIBCMT ref: 00CF6A2B
_wcscat.LIBCMT ref: 00CF6A61
_wcscat.LIBCMT ref: 00CF6A73

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: 6f847827e454113b767c6e93f44cc20e04871a2f2cbcb9f2cd6cca9ce9138ffb
Instruction ID: 80c834c9e90ca0c277824d5b6bad4e703ee165098d4218acbc07a5a1d649eb8c
Opcode Fuzzy Hash: 6f847827e454113b767c6e93f44cc20e04871a2f2cbcb9f2cd6cca9ce9138ffb
Instruction Fuzzy Hash: C8413D7684511CAECF61EB94CC42DDB73BDEB84300F1041A7B759A2151EB70ABE89F51

Function 00CFD76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00D4DC00,00D4DC00,00D4DC00), ref: 00CFD7CE
GetDriveTypeW.KERNEL32(?,00D63A70,00000061), ref: 00CFD898
_wcscpy.LIBCMT ref: 00CFD8C2

Strings

fixed, xrefs: 00CFD816
network, xrefs: 00CFD82C
unknown, xrefs: 00CFD859
ramdisk, xrefs: 00CFD842
removable, xrefs: 00CFD800
cdrom, xrefs: 00CFD7EA
all, xrefs: 00CFD7D4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: f14ac951581b5ed7789966e19ce43efed8a8c503c55a133c5f7bdf476e71ed89
Instruction ID: af2d48e99300a5c2d8ced165b2b8fb22221ce05a02f5534a7ec873bbe43ece7f
Opcode Fuzzy Hash: f14ac951581b5ed7789966e19ce43efed8a8c503c55a133c5f7bdf476e71ed89
Instruction Fuzzy Hash: 5051B4311043049FC700EF14D882BBEB7A6EF85354F10892DF6AA572E2DB71DE05EA92

Function 00CB936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CB93AB
__itow.LIBCMT ref: 00CB93DF

Part of subcall function 00CD1557: _xtow@16.LIBCMT ref: 00CD1578

Strings

0x%p, xrefs: 00D24CAD
False, xrefs: 00D24C93
True, xrefs: 00D24C8C
%.15g, xrefs: 00CB93A5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 0f8e3aafb8fc45e88dc51cb558d86acb8696e2e3040c349389aaa5937ac32035
Instruction ID: 081610832cac46e352e90811fcb0621818fa19cd9387790f77f24fde7e8d2363
Opcode Fuzzy Hash: 0f8e3aafb8fc45e88dc51cb558d86acb8696e2e3040c349389aaa5937ac32035
Instruction Fuzzy Hash: DB41F871504214EFDB24DF78E942FAA73E4EF45304F24446EEA4AD72D1EA31D941EB20

Function 00D1A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00D1A259
CreateCompatibleDC.GDI32(00000000), ref: 00D1A260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00D1A273
SelectObject.GDI32(00000000,00000000), ref: 00D1A27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D1A286
DeleteDC.GDI32(00000000), ref: 00D1A28F
GetWindowLongW.USER32(?,000000EC), ref: 00D1A299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00D1A2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00D1A2B9

Strings

static, xrefs: 00D1A1F1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 3a08bfc997dbc044038cd00ebd1852933e4439cf98a417d787dba44e6c7168e4
Instruction ID: f5cc1c1ff19bc7297c77c9057b3dbd64c8f5ee58845b1e851c446911ebb82034
Opcode Fuzzy Hash: 3a08bfc997dbc044038cd00ebd1852933e4439cf98a417d787dba44e6c7168e4
Instruction Fuzzy Hash: B3317A31101218BFDB115FA8EC49FEA3B69FF09360F150215FA19A61A0CB31D861DBB4

Function 00CF6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CF6F1D
gethostname.WSOCK32(?,00000100), ref: 00CF6F37
gethostbyname.WSOCK32(?), ref: 00CF6F44
_wcscpy.LIBCMT ref: 00CF6F6C
inet_ntoa.WSOCK32(?), ref: 00CF6F8A
_strcat.LIBCMT ref: 00CF6F98
_wcscpy.LIBCMT ref: 00CF6FAF
WSACleanup.WSOCK32 ref: 00CF6FBD
_wcscpy.LIBCMT ref: 00CF6FCB

Strings

0.0.0.0, xrefs: 00CF6F66

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: c53e83c5bbcd1e9300cf82d35ccff892c0007f882b8ebe5832707a7d4750317e
Instruction ID: ca2c691fd23bedfd9b1cb56b947c1be0644d8698b2528c3a451f6b1834aca64d
Opcode Fuzzy Hash: c53e83c5bbcd1e9300cf82d35ccff892c0007f882b8ebe5832707a7d4750317e
Instruction Fuzzy Hash: 3F11E772504219AFCB24ABB4EC49FEA77BDDF40710F10016AF255D6181EF709A859A61

Function 00CD500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD5047

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

__gmtime64_s.LIBCMT ref: 00CD50E0
__gmtime64_s.LIBCMT ref: 00CD5116
__gmtime64_s.LIBCMT ref: 00CD5133
__allrem.LIBCMT ref: 00CD5189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CD51A5
__allrem.LIBCMT ref: 00CD51BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CD51DA
__allrem.LIBCMT ref: 00CD51F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CD520F
__invoke_watson.LIBCMT ref: 00CD5280

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 639f39d0129372e5ada0256d111e050ff7e38f01f4015e2eb4a3bbbcac7365d8
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 8F71DA72A00F16ABE714AE79CC81B5A73A8AF14764F14422BFA14D77C1E770EE449BD0

Function 00CF4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF4DF8
GetMenuItemInfoW.USER32(00D71708,000000FF,00000000,00000030), ref: 00CF4E59
SetMenuItemInfoW.USER32(00D71708,00000004,00000000,00000030), ref: 00CF4E8F
Sleep.KERNEL32(000001F4), ref: 00CF4EA1
GetMenuItemCount.USER32(?), ref: 00CF4EE5
GetMenuItemID.USER32(?,00000000), ref: 00CF4F01
GetMenuItemID.USER32(?,-00000001), ref: 00CF4F2B
GetMenuItemID.USER32(?,?), ref: 00CF4F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CF4FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CF4FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CF4FEB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: cf44b55269e22eb0c8dac71f3075800e241a6fc49fcb39bf9aad6af30c9fadcc
Instruction ID: 34497771f11549bbbfabe344a579c53f67c47f279dd40e5fcbb03fc449ab2171
Opcode Fuzzy Hash: cf44b55269e22eb0c8dac71f3075800e241a6fc49fcb39bf9aad6af30c9fadcc
Instruction Fuzzy Hash: 7F61AD7590024DAFDB64CFA8D888ABFBBB9FB41308F140159F616E3250D770AE45DB22

Function 00D19C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00D19C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00D19C9B
GetWindowLongW.USER32(?,000000F0), ref: 00D19CBF
_memset.LIBCMT ref: 00D19CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D19CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00D19D5A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 25c8805bac0c88fabbf5113837d6399f48796b219f05d4fd6a9d64b9a87facf1
Instruction ID: 8ed4af5c606a0426d182c41f8af5aedd3bc508f0b3da94ee11e55137127614a5
Opcode Fuzzy Hash: 25c8805bac0c88fabbf5113837d6399f48796b219f05d4fd6a9d64b9a87facf1
Instruction Fuzzy Hash: FD617D75900208AFDB10DFA8DC91EEEB7B8EF09704F14415AFA55E7291DB70A982DB60

Function 00CE94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00CE94FE
SafeArrayAllocData.OLEAUT32(?), ref: 00CE9549
VariantInit.OLEAUT32(?), ref: 00CE955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 00CE957B
VariantCopy.OLEAUT32(?,?), ref: 00CE95BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 00CE95D2
VariantClear.OLEAUT32(?), ref: 00CE95E7
SafeArrayDestroyData.OLEAUT32(?), ref: 00CE95F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CE95FD
VariantClear.OLEAUT32(?), ref: 00CE960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CE961A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: d20732475fd649bb23905ea5e2dcc6dfec1799a169f6e17918b7ef7dcbcace94
Instruction ID: 8a657f4fdec9aff5b27172bbe9580b639d657a56f2733355e7ae5751ff664af9
Opcode Fuzzy Hash: d20732475fd649bb23905ea5e2dcc6dfec1799a169f6e17918b7ef7dcbcace94
Instruction Fuzzy Hash: 6D412C71900219AFCB01EFA5E8889DEBB79FF08354F008069F516E7261DB71EA45DFA1

Function 00D0ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

CoInitialize.OLE32 ref: 00D0ADF6
CoUninitialize.OLE32 ref: 00D0AE01
CoCreateInstance.OLE32(?,00000000,00000017,00D3D8FC,?), ref: 00D0AE61
IIDFromString.OLE32(?,?), ref: 00D0AED4
VariantInit.OLEAUT32(?), ref: 00D0AF6E
VariantClear.OLEAUT32(?), ref: 00D0AFCF

Strings

NULL Pointer assignment, xrefs: 00D0AEA6
Failed to create object, xrefs: 00D0AE6C, 00D0AF22
Invalid parameter, xrefs: 00D0AEED

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: d37fc4cd80878ffbdcf3d4b95267b502fad5cf25c24d3636f63657c2b32ce04a
Instruction ID: 598e58a49b891380bf306264e09dc39e9b2007d699daa84593b8d5588386aa90
Opcode Fuzzy Hash: d37fc4cd80878ffbdcf3d4b95267b502fad5cf25c24d3636f63657c2b32ce04a
Instruction Fuzzy Hash: 39617B71208312AFD710DF58D848B6ABBE8AF48714F14491DFA899B2D1C770ED48CBA3

Function 00D08107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D08168
inet_addr.WSOCK32(?,?,?), ref: 00D081AD
gethostbyname.WSOCK32(?), ref: 00D081B9
IcmpCreateFile.IPHLPAPI ref: 00D081C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00D08237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00D0824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00D082C2
WSACleanup.WSOCK32 ref: 00D082C8

Strings

Ping, xrefs: 00D081EB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 2006deed280cca0a9f9a870e173ec0780cf0b0022625f09604cc80206f8f477d
Instruction ID: c5e5994fa63bb34c804fb955e6673191be6797a7985dbd8f10a649c2e752c315
Opcode Fuzzy Hash: 2006deed280cca0a9f9a870e173ec0780cf0b0022625f09604cc80206f8f477d
Instruction Fuzzy Hash: FB5190316047009FD710DF64DC45B6AB7E5EF48310F088829FA9ADB2E1DB70E901EB66

Function 00D19E43 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D19E5B
CreateMenu.USER32 ref: 00D19E76
SetMenu.USER32(?,00000000), ref: 00D19E85
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D19F12
IsMenu.USER32(?), ref: 00D19F28
CreatePopupMenu.USER32 ref: 00D19F32
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D19F63
DrawMenuBar.USER32 ref: 00D19F71

Strings

0, xrefs: 00D19E54

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0
API String ID: 176399719-4108050209
Opcode ID: a9e76553301604abdae85f729ee2602b1a031d580addfeca73b41861650237b1
Instruction ID: 4f40b3a5954a83b75fb6ba56cde40116369b8f4610970714f2e0755300af741a
Opcode Fuzzy Hash: a9e76553301604abdae85f729ee2602b1a031d580addfeca73b41861650237b1
Instruction Fuzzy Hash: B9416A78A01209AFDB10DF68E864BEABBB6FF49314F184119F945D7360DB30A950CF60

Function 00CFE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CFE396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00CFE40C
GetLastError.KERNEL32 ref: 00CFE416
SetErrorMode.KERNEL32(00000000,READY), ref: 00CFE483

Strings

READONLY, xrefs: 00CFE44E
READY, xrefs: 00CFE45C
INVALID, xrefs: 00CFE455
UNKNOWN, xrefs: 00CFE43B
NOTREADY, xrefs: 00CFE442

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 0630f6cb0af7fa03b3e6fb478f847b1b3f0152103c0d5e784ca17d71adee8b1f
Instruction ID: d64cb50750f509d9d7199dfbbbfdb58f42412eec7a3fe412544b5bfa9e3854b8
Opcode Fuzzy Hash: 0630f6cb0af7fa03b3e6fb478f847b1b3f0152103c0d5e784ca17d71adee8b1f
Instruction Fuzzy Hash: EA318635A0020D9FDB41EFE4D985ABDBBB4EF54300F148069F615E72A1DB70DA01DB92

Function 00CEB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00CEB98C
GetDlgCtrlID.USER32 ref: 00CEB997
GetParent.USER32 ref: 00CEB9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CEB9B6
GetDlgCtrlID.USER32(?), ref: 00CEB9BF
GetParent.USER32(?), ref: 00CEB9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CEB9DE

Strings

ComboBox, xrefs: 00CEB911
ListBox, xrefs: 00CEB949

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 9c1fff7698d3f431ecce204c87aa1a948a0b16cee5ae8e521489c5fa383836c0
Instruction ID: 0376a5684861ffb8c54b31ae31f08af43d75f8654ad4ef02e19a2c69eaa793b6
Opcode Fuzzy Hash: 9c1fff7698d3f431ecce204c87aa1a948a0b16cee5ae8e521489c5fa383836c0
Instruction Fuzzy Hash: 1F21A1B4900248AFDB05ABA5DC86EFEBBB5EB49300F100119F661972E2DB759915AF30

Function 00CEB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00CEBA73
GetDlgCtrlID.USER32 ref: 00CEBA7E
GetParent.USER32 ref: 00CEBA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CEBA9D
GetDlgCtrlID.USER32(?), ref: 00CEBAA6
GetParent.USER32(?), ref: 00CEBAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CEBAC5

Strings

ComboBox, xrefs: 00CEB9FA
ListBox, xrefs: 00CEBA32

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 264cb6f08b21dcee79266c13a6e1319d24ce36a0538f10f0d77021ae8bc31720
Instruction ID: 71e6f99a909da9d6ed3320ac8c2479bc34e3003bfa9c734add20636e8e29a1e1
Opcode Fuzzy Hash: 264cb6f08b21dcee79266c13a6e1319d24ce36a0538f10f0d77021ae8bc31720
Instruction Fuzzy Hash: 682180B4A40248BFDF01ABA5DC86EFEBB79EF45300F104015F561A7291DBB59919AF30

Function 00CEBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00CEBAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 00CEBAF8
_wcscmp.LIBCMT ref: 00CEBB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00CEBB85

Strings

SHELLDLL_DefView, xrefs: 00CEBB04
list, xrefs: 00CEBB67
largeicons, xrefs: 00CEBB19
smallicons, xrefs: 00CEBB4D
details, xrefs: 00CEBB33

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 82939654920df705c9e29fae995ffc1531061b6926693662567b9430f9b07cd3
Instruction ID: 6043caab7e45262b127e9866d57314ddd660d1b7719cbc77536e1f40d5788fea
Opcode Fuzzy Hash: 82939654920df705c9e29fae995ffc1531061b6926693662567b9430f9b07cd3
Instruction Fuzzy Hash: 9F113236608387FFFA20667AEC07DB7379D8B20324F300022FA24E00D9FBA1AD105524

Function 00D0B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D0B2D5
CoInitialize.OLE32(00000000), ref: 00D0B302
CoUninitialize.OLE32 ref: 00D0B30C
GetRunningObjectTable.OLE32(00000000,?), ref: 00D0B40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 00D0B539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00D0B56D
CoGetObject.OLE32(?,00000000,00D3D91C,?), ref: 00D0B590
SetErrorMode.KERNEL32(00000000), ref: 00D0B5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D0B623
VariantClear.OLEAUT32(00D3D91C), ref: 00D0B633

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 573c59d2557e8466c24bf8e5857fb35b7ac8975ad2824b14fb704c9dcdd50c2f
Instruction ID: 62db31917f78d0f2cb7cba90dcb74786f8455da51ba0041b65a05507830a8931
Opcode Fuzzy Hash: 573c59d2557e8466c24bf8e5857fb35b7ac8975ad2824b14fb704c9dcdd50c2f
Instruction Fuzzy Hash: 76C11271608305AFC700DF64C884A6AB7E9FF89718F04495EF98ADB291DB71ED05CB62

Function 00CDACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00CDACC1

Part of subcall function 00CD7CF4: __mtinitlocknum.LIBCMT ref: 00CD7D06
Part of subcall function 00CD7CF4: EnterCriticalSection.KERNEL32(00000000,?,00CD7ADD,0000000D), ref: 00CD7D1F

__calloc_crt.LIBCMT ref: 00CDACD2

Part of subcall function 00CD6986: __calloc_impl.LIBCMT ref: 00CD6995
Part of subcall function 00CD6986: Sleep.KERNEL32(00000000,000003BC,00CCF507,?,0000000E), ref: 00CD69AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 00CDACED
GetStartupInfoW.KERNEL32(?,00D66E28,00000064,00CD5E91,00D66C70,00000014), ref: 00CDAD46
__calloc_crt.LIBCMT ref: 00CDAD91
GetFileType.KERNEL32(00000001), ref: 00CDADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00CDAE11

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 325c384485737add1770cc16ccbf99ff7c5b4191c7161b88345686899475d90b
Instruction ID: fe31abe7f99d30695491115f40976ab6e037fb80873ec4df9709464f53efaa70
Opcode Fuzzy Hash: 325c384485737add1770cc16ccbf99ff7c5b4191c7161b88345686899475d90b
Instruction Fuzzy Hash: E081E1719053418FDB14CF68C8805AABBF1AF49320B24425EE6AAEB3D1D7349943CB66

Function 00CF67E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CF67FD
__swprintf.LIBCMT ref: 00CF680A

Part of subcall function 00CD172B: __woutput_l.LIBCMT ref: 00CD1784

FindResourceW.KERNEL32(?,?,0000000E), ref: 00CF6834
LoadResource.KERNEL32(?,00000000), ref: 00CF6840
LockResource.KERNEL32(00000000), ref: 00CF684D
FindResourceW.KERNEL32(?,?,00000003), ref: 00CF686D
LoadResource.KERNEL32(?,00000000), ref: 00CF687F
SizeofResource.KERNEL32(?,00000000), ref: 00CF688E
LockResource.KERNEL32(?), ref: 00CF689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00CF68F9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 8b9b423e6392992ba634d802b78cd08cad0201f97e625d1cea122fd14fc6e4f9
Instruction ID: 753c80014b3e2b38ecef35dba432171dc0f0ce90057d9b96e7b6a241acfc0828
Opcode Fuzzy Hash: 8b9b423e6392992ba634d802b78cd08cad0201f97e625d1cea122fd14fc6e4f9
Instruction Fuzzy Hash: 9A31907590021AABDB509FA1ED45EBF7BA9EF08380F004429FA16D6290E730DA51DB75

Function 00CF4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CF4047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF405B
GetWindowThreadProcessId.USER32(00000000), ref: 00CF4062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF4071
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CF4083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF40AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF40F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF4108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00CF30A5,?,00000001), ref: 00CF4113

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 0c3b3e4656dab6d41a074de798e9f2a110478623373f80b555c2fbfe2cb4cc1a
Instruction ID: 396a3e6ba7cde464789daf6074400e5c1521fcf73827101fb1fa529928966879
Opcode Fuzzy Hash: 0c3b3e4656dab6d41a074de798e9f2a110478623373f80b555c2fbfe2cb4cc1a
Instruction Fuzzy Hash: 8E31A071500309ABEB55DB54EC86B7A77BEAB90311F118019FA18D63A0DBB49A809F72

Function 00D2DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00CCB496
SetTextColor.GDI32(?,000000FF), ref: 00CCB4A0
SetBkMode.GDI32(?,00000001), ref: 00CCB4B5
GetStockObject.GDI32(00000005), ref: 00CCB4BD
GetClientRect.USER32(?), ref: 00D2DD63
SendMessageW.USER32(?,00001328,00000000,?), ref: 00D2DD7A
GetWindowDC.USER32(?), ref: 00D2DD86
GetPixel.GDI32(00000000,?,?), ref: 00D2DD95
ReleaseDC.USER32(?,00000000), ref: 00D2DDA7
GetSysColor.USER32(00000005), ref: 00D2DDC5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: ef425708052225190cdb25ab2c927bcd5e44573d47f4488520aacdfe83b6de13
Instruction ID: 43a5db5660938e4e7d78d3c81f0d5b73b29c4b8ba009472b77bdbd1deec915c8
Opcode Fuzzy Hash: ef425708052225190cdb25ab2c927bcd5e44573d47f4488520aacdfe83b6de13
Instruction Fuzzy Hash: B0113731500705EFDB216BB4FC0AFA97B62EB15325F108665FA66D52E2CB324A51EF30

Function 00CECB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00CECF50), ref: 00CECE90

Strings

TEXT, xrefs: 00CECDC7
REGEXPCLASS, xrefs: 00CECC56
CLASSNN, xrefs: 00CECC33
INSTANCE, xrefs: 00CECD9E
NAME, xrefs: 00CECCC2
CLASS, xrefs: 00CECC10

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 79104de187269832ab3b3ae8415951fc8504f48b93d16400c3bc91cc86cf5762
Instruction ID: 65b695ab7cefbfbe9628b0db509743c56ea922caaf6c8308b10b5f0634a7137e
Opcode Fuzzy Hash: 79104de187269832ab3b3ae8415951fc8504f48b93d16400c3bc91cc86cf5762
Instruction Fuzzy Hash: D7916330600686ABCB18DF65C4C2BEAFB75FF04300F548519E959A7291DF30AA5BDBE0

Function 00CB3093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00CB30DC
CoUninitialize.OLE32(?,00000000), ref: 00CB3181
UnregisterHotKey.USER32(?), ref: 00CB32A9
DestroyWindow.USER32(?), ref: 00D25079
FreeLibrary.KERNEL32(?), ref: 00D250F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00D25125

Strings

close all, xrefs: 00CB30D7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 908b7bdae41ed3bcbf42bc1e8341f4c3046fab60ec25a4b394ae1117f348858f
Instruction ID: c476b3df7fad1a6995c98be7b39dbac680a97ae511f0661bd1b688967b239c00
Opcode Fuzzy Hash: 908b7bdae41ed3bcbf42bc1e8341f4c3046fab60ec25a4b394ae1117f348858f
Instruction Fuzzy Hash: B7914A346002528FC715EF24E995FA9F3B4FF14304F5482A9E50AA7262DF30AE6ADF54

Function 00CCCB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00CCCC15

Part of subcall function 00CCCCCD: GetClientRect.USER32(?,?), ref: 00CCCCF6
Part of subcall function 00CCCCCD: GetWindowRect.USER32(?,?), ref: 00CCCD37
Part of subcall function 00CCCCCD: ScreenToClient.USER32(?,?), ref: 00CCCD5F

GetDC.USER32 ref: 00D2D137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D2D14A
SelectObject.GDI32(00000000,00000000), ref: 00D2D158
SelectObject.GDI32(00000000,00000000), ref: 00D2D16D
ReleaseDC.USER32(?,00000000), ref: 00D2D175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00D2D200

Strings

U, xrefs: 00D2D0D5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 461c59d6fe55330743755ff8020b2c1f44c86531bec2d2cdcc8d88208bd5a533
Instruction ID: 569a27945459cf27d4d544cff656c6f32b2b7e1e2b746a0ac83399730d4d9f40
Opcode Fuzzy Hash: 461c59d6fe55330743755ff8020b2c1f44c86531bec2d2cdcc8d88208bd5a533
Instruction Fuzzy Hash: 5A71B234400305DFCF219F64E885EAA7BB6FF68318F184269ED69962A5D7318C91DF70

Function 00D1ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

Part of subcall function 00CCB63C: GetCursorPos.USER32(000000FF), ref: 00CCB64F
Part of subcall function 00CCB63C: ScreenToClient.USER32(00000000,000000FF), ref: 00CCB66C
Part of subcall function 00CCB63C: GetAsyncKeyState.USER32(00000001), ref: 00CCB691
Part of subcall function 00CCB63C: GetAsyncKeyState.USER32(00000002), ref: 00CCB69F

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 00D1ED3C
ImageList_EndDrag.COMCTL32 ref: 00D1ED42
ReleaseCapture.USER32 ref: 00D1ED48
SetWindowTextW.USER32(?,00000000), ref: 00D1EDF0
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00D1EE03
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 00D1EEDC

Strings

@GUI_DROPID, xrefs: 00D1EE33
@GUI_DRAGFILE, xrefs: 00D1EE77

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: c46ddda23168441ad282203ac2ab7bf55d371b665b1932c291a831b5c54b0bc1
Instruction ID: c258c47d8fd6ad648fe010ceac473f18d46bdad5e81e3b3f445a8d55b546994a
Opcode Fuzzy Hash: c46ddda23168441ad282203ac2ab7bf55d371b665b1932c291a831b5c54b0bc1
Instruction Fuzzy Hash: 81519874204300AFD714DF24EC86FAE77E5EB88704F044A1DF995972E2DB709988DB62

Function 00D045C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D045FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00D0462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00D0466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00D04682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D0468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00D046BF
InternetCloseHandle.WININET(00000000), ref: 00D04706

Part of subcall function 00D05052: GetLastError.KERNEL32(?,?,00D043CC,00000000,00000000,00000001), ref: 00D05067

Strings

, xrefs: 00D046B8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 31a9407301031f0927387934136a523089abe962606a955f061a7fb605c51116
Instruction ID: 878ad35949ffbedd5e6df89f43059f770855067b3eb0c830a95ba53523b5af93
Opcode Fuzzy Hash: 31a9407301031f0927387934136a523089abe962606a955f061a7fb605c51116
Instruction Fuzzy Hash: 29415BF1501205BBEB029F50DC89FFB77ACEF09344F144116FA0A9A281EBB199448BB4

Function 00D0B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00D4DC00), ref: 00D0B715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00D4DC00), ref: 00D0B749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00D0B8C1
SysFreeString.OLEAUT32(?), ref: 00D0B8EB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 3b4e186c51ccf9988fbeb2270b52f74bd35cabd616ccb0e88655b4922274a5ca
Instruction ID: 67104e5eb7fc4f2cebff040a866a4a89aa814054117ed52d486d3acfe2b8720e
Opcode Fuzzy Hash: 3b4e186c51ccf9988fbeb2270b52f74bd35cabd616ccb0e88655b4922274a5ca
Instruction Fuzzy Hash: 8FF11B75A04209EFCF04DF94C888EAEB7B9FF48315F148459F919AB290DB71AE45CB60

Function 00D124D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D124F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D12688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00D126AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D126EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00D1270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D1286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00D128A1
CloseHandle.KERNEL32(?), ref: 00D128D0
CloseHandle.KERNEL32(?), ref: 00D12947

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 00b507f09b01dd32bb4dd7ff6963046042c15f858fa38c2b911c211a1b107bb3
Instruction ID: 74f3d3ae70e775ba85074ab1b6b8387681eb33241024ffecf85580113a3bcbd2
Opcode Fuzzy Hash: 00b507f09b01dd32bb4dd7ff6963046042c15f858fa38c2b911c211a1b107bb3
Instruction Fuzzy Hash: 48D1A231604340EFCB15EF24D891BAABBE5EF84310F18845DF9899B2A1DB31DC95DB62

Function 00D1B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00D1B3F4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b331cc7d79d3eae25bd31963a1a225ebf972b280917c19fdc9ef26fb22af0541
Instruction ID: 0cfaf36121290ae094df80eb4aeaee817e0874ec86db207f1462286784823008
Opcode Fuzzy Hash: b331cc7d79d3eae25bd31963a1a225ebf972b280917c19fdc9ef26fb22af0541
Instruction Fuzzy Hash: 6D517F70500208BBEB209F28EC85BED3B65AB05338F684117F665D62E2DF71E9D09B71

Function 00CCA699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00D2DB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D2DB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00D2DB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00D2DB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D2DB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00CCA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00D2DBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D2DBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00CCA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00D2DBC8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 7049a15f6d43c355830b1240a4440abad2146bd8c530fac6abd2e5858d8d6f37
Instruction ID: da4d6a01766ce236085e5524188f12239b812066315e60c32565289bc0b805be
Opcode Fuzzy Hash: 7049a15f6d43c355830b1240a4440abad2146bd8c530fac6abd2e5858d8d6f37
Instruction Fuzzy Hash: 7A517A70600308EFDB20DF69DC96FAA77BABB18758F140618F956D6290D770AD80DB60

Function 00CF7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CF5FA6,?), ref: 00CF6ED8

Part of subcall function 00CF6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CF5FA6,?), ref: 00CF6EF1

Part of subcall function 00CF72CB: GetFileAttributesW.KERNEL32(?,00CF6019), ref: 00CF72CC

lstrcmpiW.KERNEL32(?,?), ref: 00CF75CA
_wcscmp.LIBCMT ref: 00CF75E2
MoveFileW.KERNEL32(?,?), ref: 00CF75FB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 701dcbfd0944cc5e4d9563f159c70fccf8908bbcb2f4cbd2d7490ea4b369f4b9
Instruction ID: 9b9ceea436178af76304afe21a944d6b25c033edd84ca2c0e6819eccfd4f93fe
Opcode Fuzzy Hash: 701dcbfd0944cc5e4d9563f159c70fccf8908bbcb2f4cbd2d7490ea4b369f4b9
Instruction Fuzzy Hash: 825100B290922D9ADF91EB94D841DEE73BC9F48310F1041AAF705E3141EA7497C5CB61

Function 00CCEA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00D2DAD1,00000004,00000000,00000000), ref: 00CCEAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00D2DAD1,00000004,00000000,00000000), ref: 00CCEB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00D2DAD1,00000004,00000000,00000000), ref: 00D2DC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00D2DAD1,00000004,00000000,00000000), ref: 00D2DCF2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: a6605726e95bf3dedfa2005913436d644162d274c3c35ffb551ad17ea992cc21
Instruction ID: acfd2d65d83557284659f2fe1928822e2149f30a5f6edac8a0a1aa27ca8c0330
Opcode Fuzzy Hash: a6605726e95bf3dedfa2005913436d644162d274c3c35ffb551ad17ea992cc21
Instruction Fuzzy Hash: 4E41F8B02087809BD7395B29ED9DF7A7A97AB57304F19040DF09782661D670BC81E739

Function 00CEB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00CEAEF1,00000B00,?,?), ref: 00CEB26C
HeapAlloc.KERNEL32(00000000,?,00CEAEF1,00000B00,?,?), ref: 00CEB273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00CEAEF1,00000B00,?,?), ref: 00CEB288
GetCurrentProcess.KERNEL32(?,00000000,?,00CEAEF1,00000B00,?,?), ref: 00CEB290
DuplicateHandle.KERNEL32(00000000,?,00CEAEF1,00000B00,?,?), ref: 00CEB293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00CEAEF1,00000B00,?,?), ref: 00CEB2A3
GetCurrentProcess.KERNEL32(00CEAEF1,00000000,?,00CEAEF1,00000B00,?,?), ref: 00CEB2AB
DuplicateHandle.KERNEL32(00000000,?,00CEAEF1,00000B00,?,?), ref: 00CEB2AE
CreateThread.KERNEL32(00000000,00000000,00CEB2D4,00000000,00000000,00000000), ref: 00CEB2C8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 18c6776dee6f811d6ad5f2388ad6c437f677be268665bba1ce6a519a6c8f9967
Instruction ID: 0bc27fd94b4e946f4e46eac39e6043a78d94bb42fc09d8b6b0c84176e2871791
Opcode Fuzzy Hash: 18c6776dee6f811d6ad5f2388ad6c437f677be268665bba1ce6a519a6c8f9967
Instruction Fuzzy Hash: 5D0166B5640348BFE710ABA5ED49F6B7BADEB89711F018411FA05DB2A1CAB59C00CF71

Function 00D0C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00D0C876, 00D0C887
Not an Object type, xrefs: 00D0C49E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fc88fc18828d7abdeb7d7ca2f16747a993e9d9ac6b967e308fcda029d3573679
Instruction ID: c2738db738e699908987075f7e1c004bd1663c1d6f0d9a9ea825617ac76d6658
Opcode Fuzzy Hash: fc88fc18828d7abdeb7d7ca2f16747a993e9d9ac6b967e308fcda029d3573679
Instruction Fuzzy Hash: BDE1B271A10219AFDF14DFA8C885BAE77B5EF48314F189229F909A72C1D770ED45CBA0

Function 00D0BB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0BB5C
VariantInit.OLEAUT32(?), ref: 00D0BC2D
VariantInit.OLEAUT32(?), ref: 00D0BD2E
VariantClear.OLEAUT32(?), ref: 00D0BD38
VariantClear.OLEAUT32(?), ref: 00D0BD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 00D0BBBD, 00D0BCEB, 00D0BDA7
Incorrect Object type in FOR..IN loop, xrefs: 00D0BD11

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 8ba73efec9555166eabab97df0889951777e1ca794555ed1b836715186a50422
Instruction ID: 86c54097767c7fe4de295e941e82194a4d2b66b2d67f4e2b2760a4d0eaa0a6ae
Opcode Fuzzy Hash: 8ba73efec9555166eabab97df0889951777e1ca794555ed1b836715186a50422
Instruction Fuzzy Hash: 3F919171A04219AFDF24CFA5D844FAEBBB8EF45720F14855AF51AAB280D7709944CFB0

Function 00CB86C2 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CB7DBD

Strings

], xrefs: 00CB7D9F
[, xrefs: 00CB7E14
^, xrefs: 00CB7D96
Q\E, xrefs: 00CB86D6
\, xrefs: 00CB7D89
\, xrefs: 00CB7E1D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _memset
String ID: Q\E$[$\$\$]$^
API String ID: 2102423945-1026548749
Opcode ID: 973474f35af9b1d09e63936790d508c8b383338bc99f4cf12e657dd7eb423291
Instruction ID: 2fb59cdb3135f993440b872fbe9aaee0abe9beffbe5a64f1f455774548e30194
Opcode Fuzzy Hash: 973474f35af9b1d09e63936790d508c8b383338bc99f4cf12e657dd7eb423291
Instruction Fuzzy Hash: 27516171D002599BDF24CF98C8816EDB7B6EF94318F28866AD824B7251E7319E85CB90

Function 00D19A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00D19B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00D19B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00D19B47
_wcscat.LIBCMT ref: 00D19BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00D19BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00D19BE7

Strings

SysListView32, xrefs: 00D19AEB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 7eabfeaeef3223e4872984a648889040bed0563db0e864880af7cdc5ca8a94a6
Instruction ID: 48c0bf26b30ce232028c0310239c22e5cfa2bf49c519ed7470fef65f8567dee2
Opcode Fuzzy Hash: 7eabfeaeef3223e4872984a648889040bed0563db0e864880af7cdc5ca8a94a6
Instruction Fuzzy Hash: 4B41A070944308BBDB219FA4EC95BEEB7B9EF08350F14442AF589E7291DA719D84CB70

Function 00D1172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00CF6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00CF6554
Part of subcall function 00CF6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00CF6564
Part of subcall function 00CF6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00CF65F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D1179A
GetLastError.KERNEL32 ref: 00D117AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00D117D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00D11855
GetLastError.KERNEL32(00000000), ref: 00D11860
CloseHandle.KERNEL32(00000000), ref: 00D11895

Strings

SeDebugPrivilege, xrefs: 00D117B8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 7095930ec67e7fc4cf08c0a66c30580e655ad81866ed9c9e51facbf860a8e914
Instruction ID: 06199aae8aaf5cab6a4f1fdf97fab58fcb79f82ad7ecf261777d660a926b2dae
Opcode Fuzzy Hash: 7095930ec67e7fc4cf08c0a66c30580e655ad81866ed9c9e51facbf860a8e914
Instruction Fuzzy Hash: 1741AD75600204AFDB05EF54D895FBEB7A2AF44310F088059FA069F3D2DFB8A941DBA5

Function 00CF5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00CF58B8

Strings

question, xrefs: 00CF5871
info, xrefs: 00CF5859
warning, xrefs: 00CF58A1
stop, xrefs: 00CF5889
blank, xrefs: 00CF583A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 0ba463b4966b96959e38073f438ce14bb991f709793b15ef11272cdee38fc0c7
Instruction ID: 6f4ba1c22f633094811c70f3fc813f75a14c938d223e3f9dc289c25a5a0ea856
Opcode Fuzzy Hash: 0ba463b4966b96959e38073f438ce14bb991f709793b15ef11272cdee38fc0c7
Instruction Fuzzy Hash: B511E73564974ABFE7055B99DC82EBA379C9F153A4F30003AF751E63C1E7B0AA008676

Function 00CFA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00CFA806

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: b082e017d1a7e75195a2dea0a0e6fadbce07d6b81cfc5985f445e36b560c042f
Instruction ID: 406b9f5fef292a84167bc71d4d458110f84ff35defb2f85e0edbcd822788dc84
Opcode Fuzzy Hash: b082e017d1a7e75195a2dea0a0e6fadbce07d6b81cfc5985f445e36b560c042f
Instruction Fuzzy Hash: ECC18CB5A0020ADFDB44DF98D481BBEB7F4EF08310F20806AE619E7241D774AA45DF92

Function 00CF6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00CF6B63
LoadStringW.USER32(00000000), ref: 00CF6B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00CF6B80
LoadStringW.USER32(00000000), ref: 00CF6B87
_wprintf.LIBCMT ref: 00CF6BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CF6BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00CF6BA8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 7e29d6fb5fc927b7b745fa4ea1e0374bf6daf75bd2e921cadb21e034ba9aefa0
Instruction ID: 1f908c93588123990169e4fe04b0fda43fc02f15ba10436b975f016227d63271
Opcode Fuzzy Hash: 7e29d6fb5fc927b7b745fa4ea1e0374bf6daf75bd2e921cadb21e034ba9aefa0
Instruction Fuzzy Hash: 14011DF6900318BFEB51ABA4AD89EF6766DD708304F0444A1B746E2251EA749E848F71

Function 00D12B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D13C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D12BB5,?,?), ref: 00D13C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D12BF6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: f2e311139812d36a997573b531862921f458447cf62ae733618674e78ae0ce66
Instruction ID: 44afa52e46286688e14bfe879d34c22e11ac905569307929227e9a4befdcb44e
Opcode Fuzzy Hash: f2e311139812d36a997573b531862921f458447cf62ae733618674e78ae0ce66
Instruction Fuzzy Hash: EC916A71204201AFCB04EF54E891BAEB7E5FF88310F08881DF996972A1DB35E955DF92

Function 00D095BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00D09691
WSAGetLastError.WSOCK32(00000000), ref: 00D0969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00D096C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00D096E9
WSAGetLastError.WSOCK32(00000000), ref: 00D096F8
htons.WSOCK32(?,?,?,00000000,?), ref: 00D097AA
inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,00D4DC00), ref: 00D09765

Part of subcall function 00CED2FF: _strlen.LIBCMT ref: 00CED309

_strlen.LIBCMT ref: 00D09800

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLast_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3480843537-0
Opcode ID: 04f5a362043c959176f4b9e8e692d5c12f76a5e5c49b46d525f259610954284f
Instruction ID: ad674b32f1406ce0daedf7ad3c91aa9bc13144c1cf5b9e83dc112c908d6f2cc2
Opcode Fuzzy Hash: 04f5a362043c959176f4b9e8e692d5c12f76a5e5c49b46d525f259610954284f
Instruction Fuzzy Hash: CD81BC71504200ABC714EF64CC95FABB7A9EF89710F144A1DF55A9B2A2EB30DD04DBA2

Function 00CDA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00CDA991

Part of subcall function 00CD7D7C: __FF_MSGBANNER.LIBCMT ref: 00CD7D91
Part of subcall function 00CD7D7C: __NMSG_WRITE.LIBCMT ref: 00CD7D98
Part of subcall function 00CD7D7C: __malloc_crt.LIBCMT ref: 00CD7DB8

__lock.LIBCMT ref: 00CDA9A4
__lock.LIBCMT ref: 00CDA9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00D66DE0,00000018,00CE5E7B,?,00000000,00000109), ref: 00CDAA0C
EnterCriticalSection.KERNEL32(8000000C,00D66DE0,00000018,00CE5E7B,?,00000000,00000109), ref: 00CDAA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 00CDAA39

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 3a2d88a3029e53cc7035e734ba956ef238c993872d028620898b0b76576df0fa
Instruction ID: caf13943bbd26ea9a4cda114bb677f8d8fc131afcbed1be3a67b7172352ec9f3
Opcode Fuzzy Hash: 3a2d88a3029e53cc7035e734ba956ef238c993872d028620898b0b76576df0fa
Instruction Fuzzy Hash: 854126719003019BEB109F68DA44759BBB0AF05324F14831BE62DEB3D1E7749E41DFA6

Function 00D18ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D18EE4
GetDC.USER32(00000000), ref: 00D18EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D18EF7
ReleaseDC.USER32(00000000,00000000), ref: 00D18F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00D18F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D18F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00D1BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00D18F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D18FAA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1ea03014dc365eeabdb4cc84e578bbd7bf10466b63e9915c6c71e421cc45bbc4
Instruction ID: ef0bde3ae4e566b8af52a7231ed6b9eca8b4fcadea65234f73746ef0104c3ca3
Opcode Fuzzy Hash: 1ea03014dc365eeabdb4cc84e578bbd7bf10466b63e9915c6c71e421cc45bbc4
Instruction Fuzzy Hash: 63318072100614BFEB108F50EC4AFEB3BAEEF49715F084065FE08DA291CA759842CB70

Function 00D016DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

Part of subcall function 00CCC6F4: _wcscpy.LIBCMT ref: 00CCC717

_wcstok.LIBCMT ref: 00D0184E
_wcscpy.LIBCMT ref: 00D018DD
_memset.LIBCMT ref: 00D01910

Strings

X, xrefs: 00D01948

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 6bf75f408fc5e88f9843f611223eee21b33c38bd122bd9d7a5834502cb3b4ccd
Instruction ID: e497831e8ff46bd5e00a5703c49e1b31047b3de0ba9b855b568a87ca0118b221
Opcode Fuzzy Hash: 6bf75f408fc5e88f9843f611223eee21b33c38bd122bd9d7a5834502cb3b4ccd
Instruction Fuzzy Hash: 81C17C356083409FC724EF64C981BAEB7E4BF85350F04492DF99A972A2DB30ED05DB92

Function 00D20133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

GetSystemMetrics.USER32(0000000F), ref: 00D2016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00D2038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D203AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 00D203D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D203FF
ShowWindow.USER32(00000003,00000000), ref: 00D20421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00D20440

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: 16a0f76366946e683efbbfcb53baf360017a39e4468a4acec290514dcf1749ec
Instruction ID: f3c624dca47456e0f33e612c94cd730d92847a67fb79420113cd0293a5aab900
Opcode Fuzzy Hash: 16a0f76366946e683efbbfcb53baf360017a39e4468a4acec290514dcf1749ec
Instruction Fuzzy Hash: B9A19F35600626EFDB18CF68D9897BDBBB1BF18704F188115EC54A7291D734AD61CBA0

Function 00CCAE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b6b86bc06e336f91b69a533906b502cf0ebfa0e3e0fd59347ad2cd2fe4d4a00
Instruction ID: fcfe322582638d0a8c8abb1fa77cb7ee694838f5801fc9740107c011940aa41d
Opcode Fuzzy Hash: 2b6b86bc06e336f91b69a533906b502cf0ebfa0e3e0fd59347ad2cd2fe4d4a00
Instruction Fuzzy Hash: A3715CB1900109EFCB14CF99CC89EAEBB79FF85318F14814DF915AA251C730AA52DFA5

Function 00D12230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D1225A
_memset.LIBCMT ref: 00D12323
ShellExecuteExW.SHELL32(?), ref: 00D12368

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

Part of subcall function 00CCC6F4: _wcscpy.LIBCMT ref: 00CCC717

CloseHandle.KERNEL32(00000000), ref: 00D1242F
FreeLibrary.KERNEL32(00000000), ref: 00D1243E

Strings

@, xrefs: 00D12334

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: ff972c4cacf586390fa0fe419f8163bc16b6138ab9e7a04d1d3d8fe3d0acaf9b
Instruction ID: bd8464d3ff0fc1d102e0fae57a4b2cfe0c2ff3b506ab110134fa8ecde663693b
Opcode Fuzzy Hash: ff972c4cacf586390fa0fe419f8163bc16b6138ab9e7a04d1d3d8fe3d0acaf9b
Instruction Fuzzy Hash: B5718070A00619AFCF04EFA8D881AEEB7F5FF48310F148459E856AB351CB35AD50DBA4

Function 00CF3DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00CF3DE7
GetKeyboardState.USER32(?), ref: 00CF3DFC
SetKeyboardState.USER32(?), ref: 00CF3E5D
PostMessageW.USER32(?,00000101,00000010,?), ref: 00CF3E8B
PostMessageW.USER32(?,00000101,00000011,?), ref: 00CF3EAA
PostMessageW.USER32(?,00000101,00000012,?), ref: 00CF3EF0
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00CF3F13

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4d5da2da2b3324b18fe96afec97e4fefdf0659c0578bc12da9d34efe32385e3a
Instruction ID: d116760d7239790d50771b5d8c5ebfc1cbd442859d9269f4f965c4facee3c680
Opcode Fuzzy Hash: 4d5da2da2b3324b18fe96afec97e4fefdf0659c0578bc12da9d34efe32385e3a
Instruction Fuzzy Hash: 5851D4A0A047D93DFB764374CC45BBA7EA95F06304F088589F2E5868C2D2949FC8D762

Function 00CF3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00CF3C02
GetKeyboardState.USER32(?), ref: 00CF3C17
SetKeyboardState.USER32(?), ref: 00CF3C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00CF3CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00CF3CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00CF3D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00CF3D26

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 6895f3875908df6434a446c5b3566b9e1783eb0b788949fce9f46c2af0dc2083
Instruction ID: f68ce4590ddb1fc8588aaa00525be79de75d36ac95839b009821ae5964d1f8bc
Opcode Fuzzy Hash: 6895f3875908df6434a446c5b3566b9e1783eb0b788949fce9f46c2af0dc2083
Instruction Fuzzy Hash: A05108A05147DD3DFB768374CC55BBABFA96B06300F0C8588E2E55A4C2D294EF84E762

Function 00CF7DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00CF7DBE
_wcsncpy.LIBCMT ref: 00CF7DF3
_wcsncpy.LIBCMT ref: 00CF7E25
_wcsncpy.LIBCMT ref: 00CF7E58
_wcsncpy.LIBCMT ref: 00CF7E9A
_wcsncpy.LIBCMT ref: 00CF7ED4
_wcsncpy.LIBCMT ref: 00CF7F03

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: c2d08245cbf33e647f42ffae580f3e05d5c638316af07d76aee70342eb1bdfc9
Instruction ID: d7325f87190648216df442c4304f76843d9ba78962207dd31ea78130298cdbeb
Opcode Fuzzy Hash: c2d08245cbf33e647f42ffae580f3e05d5c638316af07d76aee70342eb1bdfc9
Instruction Fuzzy Hash: E5417066C10218B6CB10EBF8C886ADFB3ACDF55310F548967E614E3221FA34E615C3A6

Function 00D13D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00D13DA1
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D13DCB
FreeLibrary.KERNEL32(00000000), ref: 00D13E80

Part of subcall function 00D13D72: RegCloseKey.ADVAPI32(?), ref: 00D13DE8
Part of subcall function 00D13D72: FreeLibrary.KERNEL32(?), ref: 00D13E3A
Part of subcall function 00D13D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00D13E5D

RegDeleteKeyW.ADVAPI32(?,?), ref: 00D13E25

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 954101d8ac29628f504a6a3ab3f0d0e0c86eafd9a1c5d134f8b7a899ee951116
Instruction ID: adb3e835706a6f6911670f267f1688899afbc8588e8ff68f0838c832dd210d9d
Opcode Fuzzy Hash: 954101d8ac29628f504a6a3ab3f0d0e0c86eafd9a1c5d134f8b7a899ee951116
Instruction Fuzzy Hash: 6931D9B1901209BFDB159B94EC85AFFB7BDEB08350F14026AF512E2150DA749F899BB0

Function 00D18FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00D18FE7
GetWindowLongW.USER32(0162F0E8,000000F0), ref: 00D1901A
GetWindowLongW.USER32(0162F0E8,000000F0), ref: 00D1904F
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00D19081
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00D190AB
GetWindowLongW.USER32(?,000000F0), ref: 00D190BC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D190D6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c42268cedaea5164b51e39d49126987a5edce2c9ebeaf8e73ff6f3221463d32f
Instruction ID: 09b5839810d8754096263ebca20afd600b05b41c72422cff5b32792b84598f1e
Opcode Fuzzy Hash: c42268cedaea5164b51e39d49126987a5edce2c9ebeaf8e73ff6f3221463d32f
Instruction Fuzzy Hash: 60311539600215AFDB20CF58ECA5FA477A5FB4A714F180268F519CB2B1CF71A880DF61

Function 00CF08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CF08F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CF0918
SysAllocString.OLEAUT32(00000000), ref: 00CF091B
SysAllocString.OLEAUT32(?), ref: 00CF0939
SysFreeString.OLEAUT32(?), ref: 00CF0942
StringFromGUID2.OLE32(?,?,00000028), ref: 00CF0967
SysAllocString.OLEAUT32(?), ref: 00CF0975

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: bd0b2731a58eb516c9a1fe58c89edf1192b2d345271ca2289eb39d3c7778b3a0
Instruction ID: 7ad2470b35ed3b037893da32f796fc35bc513110431a251ef6a03e13bb927b77
Opcode Fuzzy Hash: bd0b2731a58eb516c9a1fe58c89edf1192b2d345271ca2289eb39d3c7778b3a0
Instruction Fuzzy Hash: 0B21C97660130CAF9B509FB8DC84DBB73ACEB09760B108125FA15DB252E6B0ED41CB60

Function 00CF2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CF2485
__wcsnicmp.LIBCMT ref: 00CF24A6
__wcsnicmp.LIBCMT ref: 00CF24C0

Strings

#notrayicon, xrefs: 00CF247D
#OnAutoItStartRegister, xrefs: 00CF24BA
#requireadmin, xrefs: 00CF24A0

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 22066ecceec15893da45ffcfbc46a7af74364cfa90ec7e3d64c26577ff09b824
Instruction ID: 6f521bac1c50f160faaf16d7c3a590f25d6bc36c28c3187109b2fefadf3b573d
Opcode Fuzzy Hash: 22066ecceec15893da45ffcfbc46a7af74364cfa90ec7e3d64c26577ff09b824
Instruction Fuzzy Hash: D921BE3220421977D321EB34CC12FBB7399EF64300F20402AFB4697181E7919E42E3AB

Function 00CF0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CF09CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CF09F1
SysAllocString.OLEAUT32(00000000), ref: 00CF09F4
SysAllocString.OLEAUT32 ref: 00CF0A15
SysFreeString.OLEAUT32 ref: 00CF0A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 00CF0A38
SysAllocString.OLEAUT32(?), ref: 00CF0A46

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a204133cb1f9830d4467ad840cd95d2e15c081ef1bf775ab063f921fb18c25d1
Instruction ID: 484b9e4c8bdbb9d23f14a947df08ef96935b5f8ba397f9ca872ad3289ae7bda5
Opcode Fuzzy Hash: a204133cb1f9830d4467ad840cd95d2e15c081ef1bf775ab063f921fb18c25d1
Instruction Fuzzy Hash: EE21B635200308AFDB10DFB8DC89DBAB3EDEF087607108125FA18CB265E670ED419B61

Function 00D1A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CCD1BA
Part of subcall function 00CCD17C: GetStockObject.GDI32(00000011), ref: 00CCD1CE
Part of subcall function 00CCD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CCD1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00D1A32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00D1A33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00D1A345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D1A354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00D1A360

Strings

Msctls_Progress32, xrefs: 00D1A2FE

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 86bcc4bbf0856a0d91893ef47b5421d52d7f7026b01e07dd008654a949fd42ec
Instruction ID: 55aeaf0a46c90707347677c3648026fe18de7a9e52cf663136eaa4307b03f820
Opcode Fuzzy Hash: 86bcc4bbf0856a0d91893ef47b5421d52d7f7026b01e07dd008654a949fd42ec
Instruction Fuzzy Hash: 371190B1150219BEEF115FA4DC86EEB7F6DFF09798F014114FA18A60A0CA729C61DBB4

Function 00CCCCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00CCCCF6
GetWindowRect.USER32(?,?), ref: 00CCCD37
ScreenToClient.USER32(?,?), ref: 00CCCD5F
GetClientRect.USER32(?,?), ref: 00CCCE8C
GetWindowRect.USER32(?,?), ref: 00CCCEA5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 58871c8117e8b308ffbd3ae0971922216384c888fa013c8b2cb132c7ef624a40
Instruction ID: f69f52e6fea0bc2bb74311f3ca44ee005ff79d6bc7048b5d02d15b8660e5bc64
Opcode Fuzzy Hash: 58871c8117e8b308ffbd3ae0971922216384c888fa013c8b2cb132c7ef624a40
Instruction Fuzzy Hash: C3B13879900249DBDB10CFA9C580BEDBBB1FF08314F18952DEC69EB251DB30AA51CB64

Function 00D11BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D11C18
Process32FirstW.KERNEL32(00000000,?), ref: 00D11C26
__wsplitpath.LIBCMT ref: 00D11C54

Part of subcall function 00CD1DFC: __wsplitpath_helper.LIBCMT ref: 00CD1E3C

_wcscat.LIBCMT ref: 00D11C69
Process32NextW.KERNEL32(00000000,?), ref: 00D11CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00D11CF1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: 34da0636ee81e20bafe80073a37a9404438f8e9c62e3c62268a42741a47d05b6
Instruction ID: 0b985663031191cbbd962384a494bce6df5cc5370dd0c547e8a894029f0fa13f
Opcode Fuzzy Hash: 34da0636ee81e20bafe80073a37a9404438f8e9c62e3c62268a42741a47d05b6
Instruction Fuzzy Hash: 14516E71504340AFD720DF24D885FABB7E8EF88754F04491EF58A97251EB70D904CBA2

Function 00D12FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D13C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D12BB5,?,?), ref: 00D13C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D130AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D130EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00D13112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00D1313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D1317E
RegCloseKey.ADVAPI32(00000000), ref: 00D1318B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 3fd8693d6d75c0f63b587c018597c74bb1504d8cffec048dd1a40255e92644d8
Instruction ID: aa0116d2eafd7aa173d24f128a345a9fe5d69ff7b0f42ba46d7d9d863c8a0dbf
Opcode Fuzzy Hash: 3fd8693d6d75c0f63b587c018597c74bb1504d8cffec048dd1a40255e92644d8
Instruction Fuzzy Hash: 75514431208344AFC704EF64D885EAABBF9FF88300F04491DF595972A1DB31EA49DB62

Function 00D184DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00D18540
GetMenuItemCount.USER32(00000000), ref: 00D18577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00D1859F
GetMenuItemID.USER32(?,?), ref: 00D1860E
GetSubMenu.USER32(?,?), ref: 00D1861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 00D1866D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: e7a96d8f40d4fd82d3a1083a97a783e7cb5d7924cd5520dd3fa7f130735f019e
Instruction ID: d30d5f1d740afb37491452517248a1466738bc3230c57a7a90570ebea7faa42f
Opcode Fuzzy Hash: e7a96d8f40d4fd82d3a1083a97a783e7cb5d7924cd5520dd3fa7f130735f019e
Instruction Fuzzy Hash: E551BC31A00218AFDB01EFA4D841AEEB7F5EF48310F144499E915BB351DF30AE81EBA1

Function 00CF4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF4B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CF4B5B
IsMenu.USER32(00000000), ref: 00CF4B7B
CreatePopupMenu.USER32 ref: 00CF4BAF
GetMenuItemCount.USER32(000000FF), ref: 00CF4C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00CF4C3E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: ea75374bc0103110736d5bb35e0be7fddf955b04a14566d110aedc092e288461
Instruction ID: 310baa38fd2c69d52eab05ec1a79a132d9f9261732c55aaa4dfa48bf87e0526a
Opcode Fuzzy Hash: ea75374bc0103110736d5bb35e0be7fddf955b04a14566d110aedc092e288461
Instruction Fuzzy Hash: 8A51FF7060130DEBDF68CF68D888BBEBBF5BF01318F204119E6259B291D3709A40CB22

Function 00D08DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00D4DC00), ref: 00D08E7C
WSAGetLastError.WSOCK32(00000000), ref: 00D08E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00D08EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 00D08EC5
_strlen.LIBCMT ref: 00D08EF7
WSAGetLastError.WSOCK32(00000000), ref: 00D08F6A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 231363c38d9f58aceff965a47032b361720628335663ca01adbfbef537ad0374
Instruction ID: 4621464fc3be5554bd4cb88898158fa1a0e490611d08d62571a915f06f021880
Opcode Fuzzy Hash: 231363c38d9f58aceff965a47032b361720628335663ca01adbfbef537ad0374
Instruction Fuzzy Hash: 5041AF71600204ABCB14EBA4CD85FEEB7BAAF48310F104259F55A972D1DF30EE40EB60

Function 00CCABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

BeginPaint.USER32(?,?,?), ref: 00CCAC2A
GetWindowRect.USER32(?,?), ref: 00CCAC8E
ScreenToClient.USER32(?,?), ref: 00CCACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00CCACBC
EndPaint.USER32(?,?,?,?,?), ref: 00CCAD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00D2E673

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 3dc92f0cfba265bab67b200a5cafa0d522feb8c440cf98402e6c766b826542a9
Instruction ID: 0e57e5a0a46394be37ab951ea4d64f28359fb2d72f6719e5521bebe31cb341fb
Opcode Fuzzy Hash: 3dc92f0cfba265bab67b200a5cafa0d522feb8c440cf98402e6c766b826542a9
Instruction Fuzzy Hash: 4241AE70104304AFC710DF29DC89FAA7BA8FB59724F18066DF9A9C72A1D7319884DB72

Function 00D1E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00D71628,00000000,00D71628,00000000,00000000,00D71628,?,00D2DC5D,00000000,?,00000000,00000000,00000000,?,00D2DAD1,00000004), ref: 00D1E40B
EnableWindow.USER32(?,00000000), ref: 00D1E42F
ShowWindow.USER32(00D71628,00000000), ref: 00D1E48F
ShowWindow.USER32(?,00000004), ref: 00D1E4A1
EnableWindow.USER32(?,00000001), ref: 00D1E4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00D1E4E8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: f9d6051368cfc144a3d1d0978828a2b8e4ebe7dbf763a05cd946d4daf94dcd4e
Instruction ID: c7cf14f9b220949191c1796911f1513eb56e94eaae44f3534b0f470cb0a5a164
Opcode Fuzzy Hash: f9d6051368cfc144a3d1d0978828a2b8e4ebe7dbf763a05cd946d4daf94dcd4e
Instruction Fuzzy Hash: 69412E34601155FFDB26CF24E499BD47BE1BB09304F5C41A9EE598F2A2CB31E881DBA1

Function 00CF98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00CF98D1

Part of subcall function 00CCF4EA: std::exception::exception.LIBCMT ref: 00CCF51E
Part of subcall function 00CCF4EA: __CxxThrowException@8.LIBCMT ref: 00CCF533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00CF9908
EnterCriticalSection.KERNEL32(?), ref: 00CF9924
LeaveCriticalSection.KERNEL32(?), ref: 00CF999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00CF99B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00CF99D2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: 16e1a94550fd1d7e442ae845555bc7469d58655b4d74993c5bb55749cf2702b7
Instruction ID: 65b7b558a3a211bccf14b8bf69ba822f6d8a399ddb8ccf8fbb9df6be011dce0c
Opcode Fuzzy Hash: 16e1a94550fd1d7e442ae845555bc7469d58655b4d74993c5bb55749cf2702b7
Instruction Fuzzy Hash: 92315E31A00205ABDF10EFA4DC85EABB779FF45710B1580A9F904EB246D770DA15DBA1

Function 00D09B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00D077F4,?,?,00000000,00000001), ref: 00D09B53

Part of subcall function 00D06544: GetWindowRect.USER32(?,?), ref: 00D06557

GetDesktopWindow.USER32 ref: 00D09B7D
GetWindowRect.USER32(00000000), ref: 00D09B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00D09BB6

Part of subcall function 00CF7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CF7AD0

GetCursorPos.USER32(?), ref: 00D09BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00D09C44

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 5369b027f3f956ced02baf2dc74e8e28055b2ae95b170496526f2d99b4ce4ff2
Instruction ID: 6f7140b77c4209df18991306347fa690800f93242d98b55610396157e41aa933
Opcode Fuzzy Hash: 5369b027f3f956ced02baf2dc74e8e28055b2ae95b170496526f2d99b4ce4ff2
Instruction Fuzzy Hash: E531C172504309ABC710DF14DC49F9AB7EAFF89314F00091AF599D72C2D631E914CBA2

Function 00CEAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00CEAFAE
OpenProcessToken.ADVAPI32(00000000), ref: 00CEAFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00CEAFC4
CloseHandle.KERNEL32(00000004), ref: 00CEAFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CEAFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 00CEB012

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 8c82060e8905b68b615a1a2ec351f9ffbb512b40922c8b462a9cd3484f2b362f
Instruction ID: b19ec0c52f17f25f7b207a7dc1c6378f8123efc519e28205ff7e406c981504d8
Opcode Fuzzy Hash: 8c82060e8905b68b615a1a2ec351f9ffbb512b40922c8b462a9cd3484f2b362f
Instruction Fuzzy Hash: 2F2150B2104349AFDF028FD5ED09FAE7BA9EF44704F144065F901A2161C376EE21EB61

Function 00D1EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00CCAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00CCAFE3
Part of subcall function 00CCAF83: SelectObject.GDI32(?,00000000), ref: 00CCAFF2
Part of subcall function 00CCAF83: BeginPath.GDI32(?), ref: 00CCB009
Part of subcall function 00CCAF83: SelectObject.GDI32(?,00000000), ref: 00CCB033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00D1EC20
LineTo.GDI32(00000000,00000003,?), ref: 00D1EC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D1EC42
LineTo.GDI32(00000000,00000000,?), ref: 00D1EC52
EndPath.GDI32(00000000), ref: 00D1EC62
StrokePath.GDI32(00000000), ref: 00D1EC72

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: d4f66ba8d53b7cbf4d6e8c14807b15ccaf04b94a5dbff6c66c5491ca20767503
Instruction ID: 71ec49a9e93992c99260f89ebcb4855b0a97a9810b45b3557c3c4b63ea665650
Opcode Fuzzy Hash: d4f66ba8d53b7cbf4d6e8c14807b15ccaf04b94a5dbff6c66c5491ca20767503
Instruction Fuzzy Hash: 02110C7600024DBFDB019FA4EC88EDA7F6EEB08354F048116BE0885260D7719D95DBA0

Function 00CEE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CEE1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 00CEE1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CEE1D8
ReleaseDC.USER32(00000000,00000000), ref: 00CEE1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00CEE1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 00CEE209

Part of subcall function 00CE9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00CE9A05,00000000,00000000,?,00CE9DDB), ref: 00CEA53A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 331866d9500ca1f99b7d442bec0b71e573e537b1a4985539be0e2efacff99161
Instruction ID: 5da5e50857ee4b7656bd596c5f8b09749ec4336cf1b4af8b22dc17782c7f9c06
Opcode Fuzzy Hash: 331866d9500ca1f99b7d442bec0b71e573e537b1a4985539be0e2efacff99161
Instruction Fuzzy Hash: 2B018FB5A00758BFEB109BA69C46B5EBFB9EB48751F004066FE08E7391D6709D00CFA0

Function 00CD7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00CD7B47

Part of subcall function 00CD123A: __initp_misc_winsig.LIBCMT ref: 00CD125E
Part of subcall function 00CD123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00CD7F51
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00CD7F65
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00CD7F78
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00CD7F8B
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00CD7F9E
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00CD7FB1
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00CD7FC4
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00CD7FD7
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00CD7FEA
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00CD7FFD
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00CD8010
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00CD8023
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00CD8036
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00CD8049
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00CD805C
Part of subcall function 00CD123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00CD806F

__mtinitlocks.LIBCMT ref: 00CD7B4C

Part of subcall function 00CD7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00D6AC68,00000FA0,?,?,00CD7B51,00CD5E77,00D66C70,00000014), ref: 00CD7E41

__mtterm.LIBCMT ref: 00CD7B55

Part of subcall function 00CD7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00CD7B5A,00CD5E77,00D66C70,00000014), ref: 00CD7D3F
Part of subcall function 00CD7BBD: _free.LIBCMT ref: 00CD7D46
Part of subcall function 00CD7BBD: DeleteCriticalSection.KERNEL32(00D6AC68,?,?,00CD7B5A,00CD5E77,00D66C70,00000014), ref: 00CD7D68

__calloc_crt.LIBCMT ref: 00CD7B7A
GetCurrentThreadId.KERNEL32 ref: 00CD7BA3

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 0274fae058d6005a068618a67a1bbb688efa46420ec843830362d720ccc8bdd3
Instruction ID: d17f90b065d195025d58eff9f2211f39c49e9fd9a47a5ff13a5b047167d832f9
Opcode Fuzzy Hash: 0274fae058d6005a068618a67a1bbb688efa46420ec843830362d720ccc8bdd3
Instruction Fuzzy Hash: 67F06D3210D3522AEA2876387C06A5A27849B01730B2007ABFAA4D63D2FB318941A5B0

Function 00CB27EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CB281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00CB2825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CB2830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CB283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00CB2843
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CB284B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: bb9933113641bb2d05c359a12d0738409d7fc9577e15163d041458d9a6065894
Instruction ID: ddcb6196909163fbdab3543a7693575002b4c9bee471a53c0164cbd7d97df967
Opcode Fuzzy Hash: bb9933113641bb2d05c359a12d0738409d7fc9577e15163d041458d9a6065894
Instruction Fuzzy Hash: D60144B0902B5ABDE3008F6A8C85A52FEA8FF19354F00411BA15C87A42C7B5A864CBE5

Function 00CF9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 08936ebb9bc26b8ca36f7687bd1429691867c3be041adc1b902cc03f667b2246
Instruction ID: b29e029792f8998b3d83900a9b34baf8c7f53df5776edd8a3baf608af09016e9
Opcode Fuzzy Hash: 08936ebb9bc26b8ca36f7687bd1429691867c3be041adc1b902cc03f667b2246
Instruction Fuzzy Hash: 70018136102316ABDB652B64FC48EFB776BFF88701B04042AF603D21A0DB749910EF62

Function 00CF7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00CF7C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00CF7C1D
GetWindowThreadProcessId.USER32(?,?), ref: 00CF7C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CF7C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CF7C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CF7C4C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 6585566d5a807ae33d781bf4095b236500fc637a05a3bf42f2c528c7a2b89875
Instruction ID: d748591343470423e79b71b3a6a8e20a17fedfa4f1eee83172dd1221a7f4590f
Opcode Fuzzy Hash: 6585566d5a807ae33d781bf4095b236500fc637a05a3bf42f2c528c7a2b89875
Instruction Fuzzy Hash: 31F03A72242258BBE7215B62AC0EEEF7F7DEFC6B11F000028FA11D1251D7A05A41DAB5

Function 00CF9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00CF9A33
EnterCriticalSection.KERNEL32(?,?,?,?,00D25DEE,?,?,?,?,?,00CBED63), ref: 00CF9A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00D25DEE,?,?,?,?,?,00CBED63), ref: 00CF9A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00D25DEE,?,?,?,?,?,00CBED63), ref: 00CF9A5E

Part of subcall function 00CF93D1: CloseHandle.KERNEL32(?,?,00CF9A6B,?,?,?,00D25DEE,?,?,?,?,?,00CBED63), ref: 00CF93DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 00CF9A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00D25DEE,?,?,?,?,?,00CBED63), ref: 00CF9A78

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 96f94ab0c59da8a40050b28b50e7203663ec8d30e37aca8c89f7554e9f6980ed
Instruction ID: 2e010b1deade14f4e9758cdc41addc433d9145b70f6c020a11cd4e10518530f9
Opcode Fuzzy Hash: 96f94ab0c59da8a40050b28b50e7203663ec8d30e37aca8c89f7554e9f6980ed
Instruction Fuzzy Hash: B7F05E3A141311ABD7511BA4FC89EEB773BFF85301B140425F603D11A0DBB59915EF65

Function 00CB1CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00CCF4EA: std::exception::exception.LIBCMT ref: 00CCF51E
Part of subcall function 00CCF4EA: __CxxThrowException@8.LIBCMT ref: 00CCF533

__swprintf.LIBCMT ref: 00CB1EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00CB1D49

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 81065caca09143f8c46122e7a5e4cade92803549500db826942889a98688225c
Instruction ID: e99f9137f96c38287d2c93b8d09008670b2731be94bd0023a7385780bc5ad203
Opcode Fuzzy Hash: 81065caca09143f8c46122e7a5e4cade92803549500db826942889a98688225c
Instruction Fuzzy Hash: E5919A71118251AFC724EF24D895CAFB7A8EF95700F04492DF895972A1DB30EE05DBA2

Function 00D0AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D0B006
CharUpperBuffW.USER32(?,?), ref: 00D0B115
VariantClear.OLEAUT32(?), ref: 00D0B298

Part of subcall function 00CF9DC5: VariantInit.OLEAUT32(00000000), ref: 00CF9E05
Part of subcall function 00CF9DC5: VariantCopy.OLEAUT32(?,?), ref: 00CF9E0E
Part of subcall function 00CF9DC5: VariantClear.OLEAUT32(?), ref: 00CF9E1A

Strings

Incorrect Parameter format, xrefs: 00D0B03E, 00D0B20B
AUTOIT.ERROR, xrefs: 00D0B11B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 3a7ee591450e9062b647b2752c5311615da8fe597dfe252002a76bc76d7f9104
Instruction ID: 684d7f9f1d7397209a7676a18bdbe1ba21e202532aac8da2b5d194d6ee71c384
Opcode Fuzzy Hash: 3a7ee591450e9062b647b2752c5311615da8fe597dfe252002a76bc76d7f9104
Instruction Fuzzy Hash: C3915D706083019FCB10DF24C495A9EB7F5EF89714F04486EF89A9B3A1DB31E945CB62

Function 00CF5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCC6F4: _wcscpy.LIBCMT ref: 00CCC717

_memset.LIBCMT ref: 00CF5438
GetMenuItemInfoW.USER32(?), ref: 00CF5467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00CF5513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00CF553D

Strings

0, xrefs: 00CF5430

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 75099c44f75218f94ff0828d95ab59394c08347a3bff05e27a9862946ac89e1e
Instruction ID: 82f87da78df63b417fa51eb29a004e431c1180386d66a041067d7324e0b0d97f
Opcode Fuzzy Hash: 75099c44f75218f94ff0828d95ab59394c08347a3bff05e27a9862946ac89e1e
Instruction Fuzzy Hash: 9F5124712047099BD7949B2CC8457BBBBE9AF85314F04062EFBA5D31A1DB60CE44DB53

Function 00CF0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CF027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00CF02B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00CF02C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CF0344

Strings

DllGetClassObject, xrefs: 00CF02B7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 9244aaf5cbbe94346c57e16a002f512cb34b157bf50eb30f47f618f09b5eeea5
Instruction ID: 60384189f17122c387acd8543022ad8a9820052c850a281fd96be26e8a006df2
Opcode Fuzzy Hash: 9244aaf5cbbe94346c57e16a002f512cb34b157bf50eb30f47f618f09b5eeea5
Instruction Fuzzy Hash: 414150B1600208DFDB45CF54C985BBA7BB9EF44710B2480A9EA09DF216D7B1DA48DBA1

Function 00CF5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF5075
GetMenuItemInfoW.USER32 ref: 00CF5091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00CF50D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D71708,00000000), ref: 00CF5120

Strings

0, xrefs: 00CF506D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: ece932e753fbdda04f7b39a7d7fd845bce06f631f69705cb020c3ab64842789c
Instruction ID: b3480d113c3d4ae1592e5f665d2cd6dd04bb423a93c8edec2d49713114c73b31
Opcode Fuzzy Hash: ece932e753fbdda04f7b39a7d7fd845bce06f631f69705cb020c3ab64842789c
Instruction Fuzzy Hash: 1441CF30204705AFD720DF28D885B6EB7E8AF85324F148A1EFB6697291D770E904CB63

Function 00D10567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00D10587

Strings

none, xrefs: 00D10662
cdecl, xrefs: 00D105DE
winapi, xrefs: 00D105F8
stdcall, xrefs: 00D10609

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 6a88c9cbaf4d879024cba15e5e2383c029212a7763611c4477e98134a193cc4a
Instruction ID: 4bdd0cd67402c7fe058baf79f87481254372d7825d46d8e124789e83cb95d45b
Opcode Fuzzy Hash: 6a88c9cbaf4d879024cba15e5e2383c029212a7763611c4477e98134a193cc4a
Instruction Fuzzy Hash: B231AD30500216AFCF00EF68D8819EEB7B4FF55310B108629E866A76D1DFB1E995CBA0

Function 00CEB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00CEB88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00CEB8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 00CEB8D1

Strings

ComboBox, xrefs: 00CEB815
ListBox, xrefs: 00CEB84D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 9ecd5b3ea437dccd1b15b4e8dcc757ec0695cb6ec627fe3e65ff3069db88372b
Instruction ID: c69349b7610cb8ab0bc38ffaf39215ba029c3e60393f1563755d9733ea26adda
Opcode Fuzzy Hash: 9ecd5b3ea437dccd1b15b4e8dcc757ec0695cb6ec627fe3e65ff3069db88372b
Instruction Fuzzy Hash: C021E171A00248AFDB14ABA5DC87DFF7779DF45350F104129F021A62E1DB744E0AAA60

Function 00D043E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D04401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D04427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00D04457
InternetCloseHandle.WININET(00000000), ref: 00D0449E

Part of subcall function 00D05052: GetLastError.KERNEL32(?,?,00D043CC,00000000,00000000,00000001), ref: 00D05067

Strings

, xrefs: 00D04450

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 65d140f5476f34c437c2918848ebc7478296087efa0e4d5e8899de4dd5aad489
Instruction ID: c66a7f7636f0e3269a4576c5a3fce47475c290946ccba878227e706167d2eeb6
Opcode Fuzzy Hash: 65d140f5476f34c437c2918848ebc7478296087efa0e4d5e8899de4dd5aad489
Instruction Fuzzy Hash: D42180F1500208BEE7119F54DC85FBF76EDEB48744F14801AF64AD2280EAA4CD059B70

Function 00D190E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CCD1BA
Part of subcall function 00CCD17C: GetStockObject.GDI32(00000011), ref: 00CCD1CE
Part of subcall function 00CCD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CCD1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00D1915C
LoadLibraryW.KERNEL32(?), ref: 00D19163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00D19178
DestroyWindow.USER32(?), ref: 00D19180

Strings

SysAnimate32, xrefs: 00D19137

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 1e6159981cc5118820ec86f1237ee643bff6e53460201baa37231f9eaa3b4b17
Instruction ID: 56de96a0590508905f17e257c98b6efd673ccfecdd05da01b2ad14e9cb1acfbb
Opcode Fuzzy Hash: 1e6159981cc5118820ec86f1237ee643bff6e53460201baa37231f9eaa3b4b17
Instruction Fuzzy Hash: 4C218E71200306BBEF104F64ECA5EFAB7A9EB99364F180618FA5492190CB31DCD1A770

Function 00CF9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00CF9588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CF95B9
GetStdHandle.KERNEL32(0000000C), ref: 00CF95CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00CF9605

Strings

nul, xrefs: 00CF9600

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 1d97d718cc40c8ab890ea112a66cd6d31dc1f057f62a55e21b50cfea22c21711
Instruction ID: fab789a4bed0f3f54f5695e735698f3e75198ae3a0893624d09f3d69839913ef
Opcode Fuzzy Hash: 1d97d718cc40c8ab890ea112a66cd6d31dc1f057f62a55e21b50cfea22c21711
Instruction Fuzzy Hash: 1121A170500309ABDF619F25DC04BAABBB4EF44724F204B19FAA1D72E0D770DA44CB21

Function 00CF9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CF9653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CF9683
GetStdHandle.KERNEL32(000000F6), ref: 00CF9694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00CF96CE

Strings

nul, xrefs: 00CF96C9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 9fe57c6a8752571f6e0f25b21f9e7aa7e176f9dc1964c583da48d64e3272a948
Instruction ID: 89eb0505b9123002235b8d61df494e4c99db5dfa408718c5a372db88775120fb
Opcode Fuzzy Hash: 9fe57c6a8752571f6e0f25b21f9e7aa7e176f9dc1964c583da48d64e3272a948
Instruction Fuzzy Hash: 6F2190715003099BDFA09F699C04FAAB7B8EF55724F200A19FAB1D72D0D770D945CB22

Function 00CFDAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CFDB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00CFDB5E
__swprintf.LIBCMT ref: 00CFDB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,00D4DC00), ref: 00CFDBB5

Strings

%lu, xrefs: 00CFDB71

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: c2fbadce05eca43b46122cf37f9f2e7040e33ce98f568536828e23cc9b498dfc
Instruction ID: 2f337935c52ee8f286e1deca1d0a975ca510c802d369d605a5a56d91866a50ce
Opcode Fuzzy Hash: c2fbadce05eca43b46122cf37f9f2e7040e33ce98f568536828e23cc9b498dfc
Instruction Fuzzy Hash: BC218335600208AFCB10EFA4DD85EEEB7B9EF49704B054069FA05D7351DB70EA01DB61

Function 00CEC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CEC84A
Part of subcall function 00CEC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CEC85D
Part of subcall function 00CEC82D: GetCurrentThreadId.KERNEL32 ref: 00CEC864
Part of subcall function 00CEC82D: AttachThreadInput.USER32(00000000), ref: 00CEC86B

GetFocus.USER32 ref: 00CECA05

Part of subcall function 00CEC876: GetParent.USER32(?), ref: 00CEC884

GetClassNameW.USER32(?,?,00000100), ref: 00CECA4E
EnumChildWindows.USER32(?,00CECAC4), ref: 00CECA76
__swprintf.LIBCMT ref: 00CECA90

Strings

%s%d, xrefs: 00CECA8A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: c4cdbeb047f5d3423cb90cf43ec136ddd0e36a9b29e99eda61a8f361ead2e022
Instruction ID: 52faf06a09123882a799f01ab9dadb96c471d7882e1fe74290447faf27dc30e4
Opcode Fuzzy Hash: c4cdbeb047f5d3423cb90cf43ec136ddd0e36a9b29e99eda61a8f361ead2e022
Instruction Fuzzy Hash: 2D1172716002097BCF11BFA1DCC6FE93769AB44714F004076FE18AA182CB749546EB70

Function 00D11945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00D119F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00D11A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00D11B49
CloseHandle.KERNEL32(?), ref: 00D11BBF

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 2ecb0420f7239fe5340b59b756867184d99b25635a41fc466abb53b50d1f893d
Instruction ID: 793f6a62b062d70c9d3ffdaa160aed83e929638efa38b29412264d1c6630a58f
Opcode Fuzzy Hash: 2ecb0420f7239fe5340b59b756867184d99b25635a41fc466abb53b50d1f893d
Instruction Fuzzy Hash: 7E819174600204ABDF109F64C996FADBBE5AF04720F188459FA15AF382DBB5ED41DFA0

Function 00D1E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00D1E1D5
SendMessageW.USER32(?,000000B0,?,?), ref: 00D1E20D
IsDlgButtonChecked.USER32(?,00000001), ref: 00D1E248
GetWindowLongW.USER32(?,000000EC), ref: 00D1E269
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00D1E281

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$ButtonCheckedLongWindow
String ID:
API String ID: 3188977179-0
Opcode ID: b4df564edba06d4562f3ed815ab7593e57bdc34121d96bba20652ee38de9d682
Instruction ID: d2d3cc128d655e8a069d809c938d3e7304e83797a7f3c7ac0a4b719a3d6b63a6
Opcode Fuzzy Hash: b4df564edba06d4562f3ed815ab7593e57bdc34121d96bba20652ee38de9d682
Instruction Fuzzy Hash: E4615C34A44304BFDB258F58E895FEA77BAAB89300F184159FD59973A1CB71A9D0CB20

Function 00CF1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CF1CB4
VariantClear.OLEAUT32(00000013), ref: 00CF1D26
VariantClear.OLEAUT32(00000000), ref: 00CF1D81
VariantClear.OLEAUT32(?), ref: 00CF1DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00CF1E26

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 27617e9956c889c97d736b0053375661691f9ed088c38664a9495e5d434cfc91
Instruction ID: 683ef089a37cad4d92049228b78beebf204e3f0c99eaafef8cf8797b0f108983
Opcode Fuzzy Hash: 27617e9956c889c97d736b0053375661691f9ed088c38664a9495e5d434cfc91
Instruction Fuzzy Hash: 3F515AB5A00209EFDB14CF58D884AAAB7B9FF4C314B158559EE59DB301D330EA51CFA1

Function 00D10688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00D106EE
GetProcAddress.KERNEL32(00000000,?), ref: 00D1077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00D1079B
GetProcAddress.KERNEL32(00000000,?), ref: 00D107E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 00D107FB

Part of subcall function 00CCE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00CFA574,?,?,00000000,00000008), ref: 00CCE675
Part of subcall function 00CCE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00CFA574,?,?,00000000,00000008), ref: 00CCE699

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 898c8db7d21473e3f3526731dfc9a85e79f0bbdb37be92beaeebc4a2c309e805
Instruction ID: 0d18f5760c424b7292f386f612f42bcfd7dc40d9fad357f33dafc90cb46e07b2
Opcode Fuzzy Hash: 898c8db7d21473e3f3526731dfc9a85e79f0bbdb37be92beaeebc4a2c309e805
Instruction Fuzzy Hash: 14512975A00209EFCB00EFA8D4819EDBBB5BF49310F188059E956AB351DB70ED85DB91

Function 00D12E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D13C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D12BB5,?,?), ref: 00D13C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D12EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D12F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00D12F75
RegCloseKey.ADVAPI32(?,?), ref: 00D12FA1
RegCloseKey.ADVAPI32(00000000), ref: 00D12FAE

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: d83ae4e454f39469f0e2b3e9690c5d4bec079de4fad013f307643ae170a803f0
Instruction ID: 86c484f1503935426ebc67c8d8cfa4927068a378ad7b6be4f0d6a4b10cf0b3fc
Opcode Fuzzy Hash: d83ae4e454f39469f0e2b3e9690c5d4bec079de4fad013f307643ae170a803f0
Instruction Fuzzy Hash: A0515871208204AFD704EF64D881EAEB7F9FF88704F04881DF596972A1EB31E955DB62

Function 00D1CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1762c75d1d152b5327d287ef5ea3e6a678acf87aba702d916a08ca8cd96f9631
Instruction ID: 6443ac309b1c9c209f34974f2efd9e9b1332fbc3922aee738a667f1b26c97fe8
Opcode Fuzzy Hash: 1762c75d1d152b5327d287ef5ea3e6a678acf87aba702d916a08ca8cd96f9631
Instruction Fuzzy Hash: 9241C179A50244BBC720DB68FC44FE9BB69EB09310F181225F859E72E1DB30AD91DA70

Function 00D01206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00D012B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00D012DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00D0131C

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00D01341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00D01349

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: f3d1bd8de23c782809e2c6590e3a1cca5aff7125a9fb4daafee30bb6fc4db379
Instruction ID: 195de80a4fa59ee07e228f036afc610c296bfca080bd698dcf89a9c07c897341
Opcode Fuzzy Hash: f3d1bd8de23c782809e2c6590e3a1cca5aff7125a9fb4daafee30bb6fc4db379
Instruction Fuzzy Hash: 8841FD35600205DFDB05EF64C991AAEBBF5FF08310B188099E909AB3A1DB31ED01DB65

Function 00CCB63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 00CCB64F
ScreenToClient.USER32(00000000,000000FF), ref: 00CCB66C
GetAsyncKeyState.USER32(00000001), ref: 00CCB691
GetAsyncKeyState.USER32(00000002), ref: 00CCB69F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 503c32e4f8109d79570cd67d728cf7aa12fadaf8f86a45251ce723ac71470c1e
Instruction ID: cf7e3b4d89f3f0e3a608a65e3e27a862d34d99cff04e49fd824f1e4e1d1f2356
Opcode Fuzzy Hash: 503c32e4f8109d79570cd67d728cf7aa12fadaf8f86a45251ce723ac71470c1e
Instruction Fuzzy Hash: 29417D35904119BFCF199FA4D845EE9BB75FF05324F204319F82996290CB31AD90EFA1

Function 00CEB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CEB369
PostMessageW.USER32(?,00000201,00000001), ref: 00CEB413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00CEB41B
PostMessageW.USER32(?,00000202,00000000), ref: 00CEB429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00CEB431

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: ce611dfb4f737d5322b99abae96023593b91ce520ae8d2bd878213e261e1b852
Instruction ID: 138c9fa41211199c489b6bdda06c4dbfb92fb88c0016d90e43570910bd3c0375
Opcode Fuzzy Hash: ce611dfb4f737d5322b99abae96023593b91ce520ae8d2bd878213e261e1b852
Instruction Fuzzy Hash: 8931BF71900359EBDB04CF69DD4AAAE7BB5EB04315F104229F921E62E1C7B0DE14DB90

Function 00CEDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00CEDBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00CEDBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00CEDC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00CEDC52
_wcsstr.LIBCMT ref: 00CEDC5C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 029dd17bda7540bf78bcf11a6ed1f0543993b138d6b021e3a643f554e08190ce
Instruction ID: 0b2beb3b753600c72b6259abb8b3f9fb18a9f6cb0947b8f49c65b141020b0192
Opcode Fuzzy Hash: 029dd17bda7540bf78bcf11a6ed1f0543993b138d6b021e3a643f554e08190ce
Instruction Fuzzy Hash: B9212C71204244BBE7155F3AEC49E7B7BA9DF45750F20403DF90ACA151EAA1DD41D660

Function 00CEBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00CEBC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CEBCC2
__itow.LIBCMT ref: 00CEBCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00CEBD00
__itow.LIBCMT ref: 00CEBD11

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 041e9a7a8065fbd182d12504ac92d6af9538092c886990e65207ca226178a1ed
Instruction ID: d0baa15ba1385c1088aa44bdd30172ed6f9b433ddc031b1713b55c068022893f
Opcode Fuzzy Hash: 041e9a7a8065fbd182d12504ac92d6af9538092c886990e65207ca226178a1ed
Instruction Fuzzy Hash: B621C6357006587BDB10AE669C86FEF7A69AF49710F100025FA15EB181EB70CE0597A1

Function 00CF6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00CB50E6: _wcsncpy.LIBCMT ref: 00CB50FA

GetFileAttributesW.KERNEL32(?,?,?,?,00CF60C3), ref: 00CF6369
GetLastError.KERNEL32(?,?,?,00CF60C3), ref: 00CF6374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00CF60C3), ref: 00CF6388
_wcsrchr.LIBCMT ref: 00CF63AA

Part of subcall function 00CF6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00CF60C3), ref: 00CF63E0

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 97fab0a5cbaa6feb95a8873b5db9fb7d7ce5bacfcafb8d81300f4a09394084ae
Instruction ID: 35248fec13b8568eaeb97e2ebc5c04a5599727350190d1af2c82a866b85f5fdd
Opcode Fuzzy Hash: 97fab0a5cbaa6feb95a8873b5db9fb7d7ce5bacfcafb8d81300f4a09394084ae
Instruction Fuzzy Hash: 20212B3150431D4BDB55AB78AC42FFA336DEF16360F10006AF215C31E0EB60DA899A66

Function 00D08B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D0A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D0A84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00D08BD3
WSAGetLastError.WSOCK32(00000000), ref: 00D08BE2
connect.WSOCK32(00000000,?,00000010), ref: 00D08BFE

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 7701d7b275e2b98446a3439add85808c64f8d9b38ccbdd28a7ed41f40b1d720d
Instruction ID: 1c676d8cf50dd1febd684b29abe1017b69ed822082aec4d4496bf774c59d927f
Opcode Fuzzy Hash: 7701d7b275e2b98446a3439add85808c64f8d9b38ccbdd28a7ed41f40b1d720d
Instruction Fuzzy Hash: 0E214A712002149FDB10AB68D985B7E77A9AF48720F088459F95AEB3D2CE74A8019B65

Function 00D08420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D08441
GetForegroundWindow.USER32 ref: 00D08458
GetDC.USER32(00000000), ref: 00D08494
GetPixel.GDI32(00000000,?,00000003), ref: 00D084A0
ReleaseDC.USER32(00000000,00000003), ref: 00D084DB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: c3f9e18d2e78e23edb492141a4ac9449cabf31ff33eafc99986406f8228eebb1
Instruction ID: 72f97403fbd593e1852bef7f0aedc60e6cdea1d15bfa7113c46f0affeae1e8e0
Opcode Fuzzy Hash: c3f9e18d2e78e23edb492141a4ac9449cabf31ff33eafc99986406f8228eebb1
Instruction Fuzzy Hash: 4D214F75A00204AFD700DFA4D989AAEBBE6EF48301F148479E95AD7352DB74ED40DB60

Function 00CCAF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00CCAFE3
SelectObject.GDI32(?,00000000), ref: 00CCAFF2
BeginPath.GDI32(?), ref: 00CCB009
SelectObject.GDI32(?,00000000), ref: 00CCB033

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 35aec95aee9ccf5a6ddac9644f01d1f0a53643241af2934e514800b1445a6690
Instruction ID: 0ad4aa5d01bd5759d529a7955959ce5bc7b64e60cad87d77a7806db775bea2fa
Opcode Fuzzy Hash: 35aec95aee9ccf5a6ddac9644f01d1f0a53643241af2934e514800b1445a6690
Instruction Fuzzy Hash: C62171B4800309EFDB10DFA9EC49B9E7B69BB10356F14431EE429D62A0E3705995DFA1

Function 00CD217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00CD21A9
CreateThread.KERNEL32(?,?,00CD22DF,00000000,?,?), ref: 00CD21ED
GetLastError.KERNEL32 ref: 00CD21F7
_free.LIBCMT ref: 00CD2200
__dosmaperr.LIBCMT ref: 00CD220B

Part of subcall function 00CD7C0E: __getptd_noexit.LIBCMT ref: 00CD7C0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 8a95c41fdf65564048b494f159f38729221137f92508ee1d75b62d746b0cdbde
Instruction ID: 553c69051972330fd2cbae549f529381d8723c9863f4d7ecc81201e683c9ba8b
Opcode Fuzzy Hash: 8a95c41fdf65564048b494f159f38729221137f92508ee1d75b62d746b0cdbde
Instruction Fuzzy Hash: 8A1108331043066F9B11AF65DC41D9F3799EF51770710012BFB24C6351EB31CD11AAA0

Function 00CEABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00CEABD7
GetLastError.KERNEL32(?,00CEA69F,?,?,?), ref: 00CEABE1
GetProcessHeap.KERNEL32(00000008,?,?,00CEA69F,?,?,?), ref: 00CEABF0
HeapAlloc.KERNEL32(00000000,?,00CEA69F,?,?,?), ref: 00CEABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00CEAC0E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 4775b023723b0f86883684cdbf2703e434c957af83253fbe87210ba9067ec070
Instruction ID: e5e4ac44af73a08f447599b5f5e01cfe91471a7a0787683acab4fc366233a876
Opcode Fuzzy Hash: 4775b023723b0f86883684cdbf2703e434c957af83253fbe87210ba9067ec070
Instruction Fuzzy Hash: 4C01F671200344BFDB105FAAEC49DAB3ABEEF8A7557200429F955C3260DA729D50DE71

Function 00CE9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00CE9ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 00CE9AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 00CE9B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00CE9B15
CLSIDFromString.OLE32(?,?), ref: 00CE9B21

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: a515d9678192a9ce823ce1d3745ce4caa5327bdb5034853e8f69ad1172ce080b
Instruction ID: 463dacb69505afef030b7eebded04f259539628b70648556e875f3825184d449
Opcode Fuzzy Hash: a515d9678192a9ce823ce1d3745ce4caa5327bdb5034853e8f69ad1172ce080b
Instruction Fuzzy Hash: B4014F76600215BFDB214F66ED44B9A7AFEEF44751F144424F905D2210D774DE40DBB0

Function 00CF7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CF7A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CF7A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00CF7A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00CF7A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CF7AD0

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 580511902aa7ec5129883a6eebcd57c3a9e5b4e03fcf2943f33c85131591dc71
Instruction ID: da065e975fc1712b38a60a2145886671c006fd68660bbbf6a9dde4f4a46c747d
Opcode Fuzzy Hash: 580511902aa7ec5129883a6eebcd57c3a9e5b4e03fcf2943f33c85131591dc71
Instruction Fuzzy Hash: F6011735C0472DABCF40AFA5EC48AEDBB79FB18711F021555E602B2250DB3096509BB2

Function 00CEAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CEAADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CEAAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CEAAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CEAAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CEAB10

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: af38543fb43c2f6b02367d3263cb73c2d0bc2417e384e653d939156aa23b79db
Instruction ID: ae59f1abe3fb9a52a1400aad69a8ed7a17996fe4fe390dedb4e675ddffe45045
Opcode Fuzzy Hash: af38543fb43c2f6b02367d3263cb73c2d0bc2417e384e653d939156aa23b79db
Instruction Fuzzy Hash: 67F03C722003086FEB111FA5EC88EA73B6EFF46754F000029F951C7290CA60A9119E71

Function 00CEAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CEAA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CEAA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CEAA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CEAA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CEAAAF

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3dc5c06bb3c74146363c6c309fca477fde0f088e10165a5a2ff43a5fdb991e51
Instruction ID: cf482f05c744764d1421e531a381bf5105e496ee02565686eb01b7fab1c39a53
Opcode Fuzzy Hash: 3dc5c06bb3c74146363c6c309fca477fde0f088e10165a5a2ff43a5fdb991e51
Instruction Fuzzy Hash: 4AF04F712003046FEB115FA5AC89EA73BADFF4A754F000429F951C7290DA60EC51DE71

Function 00CEEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00CEEC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 00CEECAB
MessageBeep.USER32(00000000), ref: 00CEECC3
KillTimer.USER32(?,0000040A), ref: 00CEECDF
EndDialog.USER32(?,00000001), ref: 00CEECF9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 959f8bb3ee7e2bb7ed41e183a00e9d2ed9664407278bb0c92fb8f6c54696b7b4
Instruction ID: 72a2a41de2f139dd7c67b8b4cbda7233a29c6a8bcc32d22d5c83ccb4427abd97
Opcode Fuzzy Hash: 959f8bb3ee7e2bb7ed41e183a00e9d2ed9664407278bb0c92fb8f6c54696b7b4
Instruction Fuzzy Hash: D5018131500744ABEB245F21EE4EB9677B9FB00745F100559B693A15E0DBF4AA54CF90

Function 00CCB0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00CCB0BA
StrokeAndFillPath.GDI32(?,?,00D2E680,00000000,?,?,?), ref: 00CCB0D6
SelectObject.GDI32(?,00000000), ref: 00CCB0E9
DeleteObject.GDI32 ref: 00CCB0FC
StrokePath.GDI32(?), ref: 00CCB117

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: bf8e052b187f810956b594e163225e9a367099094f723aadbe71393820696fab
Instruction ID: 85c1359e924293729d062dd3add431444b8a95de0b81d1402e12b5aa38588b6a
Opcode Fuzzy Hash: bf8e052b187f810956b594e163225e9a367099094f723aadbe71393820696fab
Instruction Fuzzy Hash: 85F0B678000344AFDB259FA9EC09B593B65B710762F088319F469C52F0D7318999DF60

Function 00CFF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CFF2DA
CoCreateInstance.OLE32(00D3DA7C,00000000,00000001,00D3D8EC,?), ref: 00CFF2F2
CoUninitialize.OLE32 ref: 00CFF555

Strings

.lnk, xrefs: 00CFF28B, 00CFF290, 00CFF29E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 6ca2b67da7d56ed645e66a0800524d7ac3e5804f6d3229dbc541342193cf068d
Instruction ID: 0ae3e11b1cfefba1704eb9897bda83d270592696561634e9ba3d0054c948db1e
Opcode Fuzzy Hash: 6ca2b67da7d56ed645e66a0800524d7ac3e5804f6d3229dbc541342193cf068d
Instruction Fuzzy Hash: 30A10971104205AFD300EFA4C891EAFB7ECEF98714F00495DF65597292EB70EA49DBA2

Function 00CFE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00CB660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00CB53B1,?,?,00CB61FF,?,00000000,00000001,00000000), ref: 00CB662F

CoInitialize.OLE32(00000000), ref: 00CFE85D
CoCreateInstance.OLE32(00D3DA7C,00000000,00000001,00D3D8EC,?), ref: 00CFE876
CoUninitialize.OLE32 ref: 00CFE893

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

Strings

.lnk, xrefs: 00CFE83B, 00CFE84D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 7bb7337f3b6d7ab92b78f010288408cddeae780997d2b8041626db5dba1779eb
Instruction ID: ba842460386ba856080bad5af13c41e56aa2a42b244e486ba671281e829b4df3
Opcode Fuzzy Hash: 7bb7337f3b6d7ab92b78f010288408cddeae780997d2b8041626db5dba1779eb
Instruction Fuzzy Hash: 56A135356043059FCB54DF14C8849AEBBE5FF88320F148958FAA69B3A1CB31ED45CB92

Function 00CD325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00CD32ED

Part of subcall function 00CDE0D0: __87except.LIBCMT ref: 00CDE10B

Strings

pow, xrefs: 00CD32C5, 00CD32E2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 616d55747a1d4df1e5b5e437256790d125b3063372ee66251d34417ebf65fb08
Instruction ID: 3ddea007204487a0a1eae25e0dcba3e1b437c931fb9e9dffb7f2ef8fe22403e5
Opcode Fuzzy Hash: 616d55747a1d4df1e5b5e437256790d125b3063372ee66251d34417ebf65fb08
Instruction Fuzzy Hash: 89515731A0824196CB157B14CA0137E7BA4AB41710F608D2BF6E5CA3EADF348FC5EA57

Function 00CF4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00D4DC50,?,0000000F,0000000C,00000016,00D4DC50,?), ref: 00CF4645

Part of subcall function 00CB936C: __swprintf.LIBCMT ref: 00CB93AB
Part of subcall function 00CB936C: __itow.LIBCMT ref: 00CB93DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 00CF46C5

Strings

REMOVE, xrefs: 00CF4676
THIS, xrefs: 00CF4703

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: ae9a493371962e3baec57d37aa838ac4dcb0bf5d56d9a45de4936da8084408bd
Instruction ID: 0a01dbbd9391a7e041760bfb3bcfdcc2f6764838d2771b866dff5b9351b02ba3
Opcode Fuzzy Hash: ae9a493371962e3baec57d37aa838ac4dcb0bf5d56d9a45de4936da8084408bd
Instruction Fuzzy Hash: 42417F34A0020D9FCF45EFA4C881ABEB7B5FF49314F148059EA26AB2A2DB34DD45DB51

Function 00CEC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CEBC08,?,?,00000034,00000800,?,00000034), ref: 00CF4335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00CEC1D3

Part of subcall function 00CF42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CEBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00CF4300

Part of subcall function 00CF422F: GetWindowThreadProcessId.USER32(?,?), ref: 00CF425A
Part of subcall function 00CF422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00CEBBCC,00000034,?,?,00001004,00000000,00000000), ref: 00CF426A
Part of subcall function 00CF422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00CEBBCC,00000034,?,?,00001004,00000000,00000000), ref: 00CF4280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CEC240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CEC28D

Strings

@, xrefs: 00CEC2A5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 0b50c4327e9328c40e231b67512487153e184005f5bdd105e1f40b23f50053aa
Instruction ID: 0747baa4856099b514040eac4bc399981ced4fb5b58825ce8b4029671da4ee6f
Opcode Fuzzy Hash: 0b50c4327e9328c40e231b67512487153e184005f5bdd105e1f40b23f50053aa
Instruction Fuzzy Hash: 5741297290021CAFDB15DFA4CD82AEEB7B8BF09700F004095FA55B7191DA71AF49DB61

Function 00D1A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00D4DC00,00000000,?,?,?,?), ref: 00D1A6D8
GetWindowLongW.USER32 ref: 00D1A6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D1A705

Strings

SysTreeView32, xrefs: 00D1A6AA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a0e50be26c7182be1f4459c47459dc5055677b4ef009f417c969b9ac846ed852
Instruction ID: a94dc1f6197108583c21d96bbec908b1b3359d997756b4d5cdbf4e6c5009b642
Opcode Fuzzy Hash: a0e50be26c7182be1f4459c47459dc5055677b4ef009f417c969b9ac846ed852
Instruction Fuzzy Hash: A0318E31201606BFDB118F78EC41BEA77A9EB49324F294725F875D32E0DB70AD909B60

Function 00D1A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00D1A15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00D1A172
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D1A196

Strings

SysMonthCal32, xrefs: 00D1A129

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 164ba2bd5abaf053fad4f1fe612cab7cba9e4114ff1dba3c718e1f1b6145d1af
Instruction ID: 46ff086578699089867c7a7fdb4298cafc40a8458b5334af20bac81e50aa244b
Opcode Fuzzy Hash: 164ba2bd5abaf053fad4f1fe612cab7cba9e4114ff1dba3c718e1f1b6145d1af
Instruction Fuzzy Hash: D5218D32510218BBDF118FA8DC42FEA3B7AEF48714F150214FA55AB1D0DAB5A8959BA0

Function 00D1A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00D1A941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00D1A94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D1A956

Strings

msctls_updown32, xrefs: 00D1A8BB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 86f71208ebcea9c1bcaedb569b51667850a15dba12b7970f1962b041a9edf5a0
Instruction ID: f98d6b59e1f0f60e934bae69156221da280159e1ae3dc1c8949f14ad24169a43
Opcode Fuzzy Hash: 86f71208ebcea9c1bcaedb569b51667850a15dba12b7970f1962b041a9edf5a0
Instruction Fuzzy Hash: DF2181B5600209BFDB10DF28DC92DAB37ADEB5A3A4B450159FA05D7361DB30EC918A71

Function 00D199A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00D19A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00D19A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00D19A65

Strings

Listbox, xrefs: 00D199FD

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 1699cfee9722f082e2b51b1e3f485f4bab81ec15c30651daf96d32895da16c1e
Instruction ID: 2d4457ab3217d523b93495cec4da9e8bc0c3be5125c687c0e04fc13244b1cc97
Opcode Fuzzy Hash: 1699cfee9722f082e2b51b1e3f485f4bab81ec15c30651daf96d32895da16c1e
Instruction Fuzzy Hash: EF21F572600218BFDB118F54ECA5FFF7BAAEF89760F058128F95497190CA719C918BB0

Function 00D1A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00D1A46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00D1A482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00D1A48F

Strings

msctls_trackbar32, xrefs: 00D1A444

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: d6bd54e7bfdabaf22e679100ec7c5d0d60ff9929e07ba4839597ba76d668e5a1
Instruction ID: f981663f6cf6920ba1dfe0f19020e6b1976066a31e1b8384cb165db7f12eb3d3
Opcode Fuzzy Hash: d6bd54e7bfdabaf22e679100ec7c5d0d60ff9929e07ba4839597ba76d668e5a1
Instruction Fuzzy Hash: DD110A71240308BEEF205F68DC45FEB3769EF89754F054118FA4996091D6B1E851DB34

Function 00CD2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00CD2350,?), ref: 00CD22A1
GetProcAddress.KERNEL32(00000000), ref: 00CD22A8

Strings

RoInitialize, xrefs: 00CD2290
combase.dll, xrefs: 00CD229C

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 63b82ab0686a2b045ab41b1329cbcfc99cb6527c8fea1d09178bc4209c55628b
Instruction ID: 5b11c093aae55514a2df6c84b0869be12e0829d82b4db98870d76a7021f1d902
Opcode Fuzzy Hash: 63b82ab0686a2b045ab41b1329cbcfc99cb6527c8fea1d09178bc4209c55628b
Instruction Fuzzy Hash: 86E01270A94701EFDB205F74ED4AB253A6AAB20B12F804020F646E63E4EBF44094DF38

Function 00CD235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00CD2276), ref: 00CD2376
GetProcAddress.KERNEL32(00000000), ref: 00CD237D

Strings

RoUninitialize, xrefs: 00CD2365
combase.dll, xrefs: 00CD2371

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: b1556bcca6a7b8f7e7d6baa16697dbd03ac5746e523d7d60d7a458351131ee56
Instruction ID: 84a3b46dd9c347cb3a4b27d9e5cf7b009b786903a415f4aefad1f6d80938c94a
Opcode Fuzzy Hash: b1556bcca6a7b8f7e7d6baa16697dbd03ac5746e523d7d60d7a458351131ee56
Instruction Fuzzy Hash: B7E09970688300EFDB206F60AD09B053A6AB720702F500424FA4DE23F8EBF995949E34

Function 00D2AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D2AC60
__swprintf.LIBCMT ref: 00D2AC94

Strings

WIN_XPe, xrefs: 00D2ACD3
%.3d, xrefs: 00D2AC6E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 5024918e0599d6a973924a1947306c78e78b0e76c082d3230cd9824c7b81567d
Instruction ID: d4d435a85a9266a8c896a449407b29d4c740dd3b7f787ca69ba12cc7397651f4
Opcode Fuzzy Hash: 5024918e0599d6a973924a1947306c78e78b0e76c082d3230cd9824c7b81567d
Instruction Fuzzy Hash: 1FE0C275804628EFCB01A744ED04DFA737CEB18300F1000D3F946E1100D631CB94BA32

Function 00CB42F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00CB42EC,?,00CB42AA,?), ref: 00CB4304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00CB4316

Strings

Wow64RevertWow64FsRedirection, xrefs: 00CB4310
kernel32.dll, xrefs: 00CB42FF

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 1f09b413046c1fed9dc33870c79f432d87146912f192e92af1930403bdad2963
Instruction ID: c79f947a388aaf5c087365acc57fc19d63f3572d6155009c5d98a089f9cb0ec8
Opcode Fuzzy Hash: 1f09b413046c1fed9dc33870c79f432d87146912f192e92af1930403bdad2963
Instruction Fuzzy Hash: 4CD0A770444B12DFC7248F20F80C64176E4AB04301F14442AF451D2271D7B0CC848E70

Function 00D12205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D121FB,?,00D123EF), ref: 00D12213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00D12225

Strings

kernel32.dll, xrefs: 00D1220E
GetProcessId, xrefs: 00D1221F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: 69d60ba6201b924009fdc7ac1712f215d3a251c53aee54924453c9635975ae9d
Instruction ID: 34e4bbc1734c538822c6edd8309ffee694a5ff16a1915243f26d228661355c61
Opcode Fuzzy Hash: 69d60ba6201b924009fdc7ac1712f215d3a251c53aee54924453c9635975ae9d
Instruction Fuzzy Hash: AED0A734400712AFC7214F30F80865576F5EB04304B14442AF842E2250DB71D8C48A70

Function 00CB434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00CB41BB,00CB4341,?,00CB422F,?,00CB41BB,?,?,?,?,00CB39FE,?,00000001), ref: 00CB4359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00CB436B

Strings

kernel32.dll, xrefs: 00CB4354
Wow64DisableWow64FsRedirection, xrefs: 00CB4365

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 7cf8ec0f7c7da4031aac3cb756678fa61dd54c1afa6659fbd63799b4c145c0c6
Instruction ID: 5cc66ce1de2bd089b53826dae4ee98d496ed779809e4a750f2fe8b98ed771a9c
Opcode Fuzzy Hash: 7cf8ec0f7c7da4031aac3cb756678fa61dd54c1afa6659fbd63799b4c145c0c6
Instruction Fuzzy Hash: 6CD0A7304047229FC7244F30F808A4176E4AB20715F14442AF491D2261D7B0D8848E70

Function 00CF0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00CF052F,?,00CF06D7), ref: 00CF0572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00CF0584

Strings

UnRegisterTypeLibForUser, xrefs: 00CF057E
oleaut32.dll, xrefs: 00CF056D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: cf491ffc46c13496f702bf0da0c464589e99b0d91222e942ff8ec915e3eb2876
Instruction ID: b3893d83f9fe97fa426b9887c97c528a69b8d3a15a09d0b4039474ae8728be51
Opcode Fuzzy Hash: cf491ffc46c13496f702bf0da0c464589e99b0d91222e942ff8ec915e3eb2876
Instruction Fuzzy Hash: 62D0C7705047169FD7605F75FC08B6277E5BF04711B20851DE955D2251D7F0D5C88E71

Function 00CF0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,00CF051D,?,00CF05FE), ref: 00CF0547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00CF0559

Strings

RegisterTypeLibForUser, xrefs: 00CF0553
oleaut32.dll, xrefs: 00CF0542

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 0436121c955af5427de3f43bbb49070b0bdc1d5e168571307fa271a523959da3
Instruction ID: d70ecd3ef57f0311219e1a34098a1b147c34605b51ae56abcac5b807904f2625
Opcode Fuzzy Hash: 0436121c955af5427de3f43bbb49070b0bdc1d5e168571307fa271a523959da3
Instruction Fuzzy Hash: 7ED0C770544B169FD7609F65FC0866176F5AF14711B20C41DE556D2251D6F0C9848E71

Function 00D0ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D0ECBE,?,00D0EBBB), ref: 00D0ECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00D0ECE8

Strings

GetSystemWow64DirectoryW, xrefs: 00D0ECE2
kernel32.dll, xrefs: 00D0ECD1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 70f45c935c9cd8d7bdc20c73c8ac91e5583096056730f631f00978165998820d
Instruction ID: aa32efc123c119faba4dd416e862767ab37699c65fe0b664c59b66dd76ba9c50
Opcode Fuzzy Hash: 70f45c935c9cd8d7bdc20c73c8ac91e5583096056730f631f00978165998820d
Instruction Fuzzy Hash: B2D0A730401723DFDB205F61F848702B7E4AB00300B18882AF849D2291DFB0D8848A70

Function 00D0BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00D0BAD3,00000001,00D0B6EE,?,00D4DC00), ref: 00D0BAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00D0BAFD

Strings

GetModuleHandleExW, xrefs: 00D0BAF7
kernel32.dll, xrefs: 00D0BAE6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 7f1ba91f9e0a87fc202a52459ef2f98fe50eedd39fbab9758257604d2119e665
Instruction ID: b7487ab7356508fd45692164a43c31ed6761089cd0bf945747c8bb424df7e7ef
Opcode Fuzzy Hash: 7f1ba91f9e0a87fc202a52459ef2f98fe50eedd39fbab9758257604d2119e665
Instruction Fuzzy Hash: E8D0A7308147129FC7305F20F848B1577E4AB00310B14442BF887D2290DB70C884CA70

Function 00D13BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00D13BD1,?,00D13E06), ref: 00D13BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D13BFB

Strings

RegDeleteKeyExW, xrefs: 00D13BF5
advapi32.dll, xrefs: 00D13BE4

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 85d9243a03822884190012e6afcccff23382c5943d7c81baa169327dc7743443
Instruction ID: d90a3dfee40a99ca7b5a9999986ea8ee94c83a7c8c715fb495ce5684a70daca3
Opcode Fuzzy Hash: 85d9243a03822884190012e6afcccff23382c5943d7c81baa169327dc7743443
Instruction Fuzzy Hash: 0BD0C774500752AFD7205FE5F808683FAF5AB15715B144419E456F2250DAB0D4C48EB0

Function 00CE9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad97ec02852ee43f60a1bb8f81cd532e739384ce03805e5d5700f12397bdf8e
Instruction ID: 16a0637710f8ccec37ab7693decca450cdce5e8a520e39b001d4a51334bd49aa
Opcode Fuzzy Hash: fad97ec02852ee43f60a1bb8f81cd532e739384ce03805e5d5700f12397bdf8e
Instruction Fuzzy Hash: E8C16075A0025AEFCB14DF95C884EAEB7B5FF48700F208598E915EB251D730EE81DBA0

Function 00D0AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D0AAB4
CoUninitialize.OLE32 ref: 00D0AABF

Part of subcall function 00CF0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00CF027B

VariantInit.OLEAUT32(?), ref: 00D0AACA
VariantClear.OLEAUT32(?), ref: 00D0AD9D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 5987296cb318168b7f0a417e010cd012edbce33898c68bc74fcec16117a22138
Instruction ID: d3e596377221d5721eba5e3d0580ff2d828bcaa2e134248d0c710e36ebd0906c
Opcode Fuzzy Hash: 5987296cb318168b7f0a417e010cd012edbce33898c68bc74fcec16117a22138
Instruction Fuzzy Hash: 3FA149352047019FDB10DF18C481B5AB7E5FF89720F188449FA9A9B3A2DB30ED44DBA6

Function 00CE91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CE91DD
SysAllocString.OLEAUT32(?), ref: 00CE9286
VariantCopy.OLEAUT32 ref: 00CE92B5
VariantClear.OLEAUT32(?), ref: 00CE92DC

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 0bd85902b1df64287b4116fc910c19bd5c535a1509547c432ebdcc2e85df77ba
Instruction ID: cacf41e5fb65b48658a7e83f5b1843016b85f52ce60f10049f5d3e99d4d32f5a
Opcode Fuzzy Hash: 0bd85902b1df64287b4116fc910c19bd5c535a1509547c432ebdcc2e85df77ba
Instruction Fuzzy Hash: AF518070604386ABDB24AF6BD491B6EB3E9EF45310F24881FE657CB2E1DB7098809715

Function 00CFC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00CB4517: _fseek.LIBCMT ref: 00CB452F

Part of subcall function 00CFC56D: _wcscmp.LIBCMT ref: 00CFC65D
Part of subcall function 00CFC56D: _wcscmp.LIBCMT ref: 00CFC670

_free.LIBCMT ref: 00CFC4DD
_free.LIBCMT ref: 00CFC4E4
_free.LIBCMT ref: 00CFC54F

Part of subcall function 00CD1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00CD7A85), ref: 00CD1CB1
Part of subcall function 00CD1C9D: GetLastError.KERNEL32(00000000,?,00CD7A85), ref: 00CD1CC3

_free.LIBCMT ref: 00CFC557

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 8ebe9a19176b59577dd3d9a31b6d24208439706ac66631614e3897939724f17f
Instruction ID: a9b4996ff8dec8b148dbb8ba342ca89a3fd1d5cf56fa0fc6cf3c91b55278bd4c
Opcode Fuzzy Hash: 8ebe9a19176b59577dd3d9a31b6d24208439706ac66631614e3897939724f17f
Instruction Fuzzy Hash: 0A516EB1A04218AFDB589F64DC81AEDBBB9EF48300F1040AEB659A3241DB715A909F59

Function 00D1C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D1C544
ScreenToClient.USER32(?,00000002), ref: 00D1C574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00D1C5DA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: c596ba8497114e8646cdc3d98ae76ecac3ea7db81a5d00fc64ce5ce21fbf2e58
Instruction ID: 29d87410061b579e3c156a10c27d7655ae88f11a9729453442f39d7ffb664053
Opcode Fuzzy Hash: c596ba8497114e8646cdc3d98ae76ecac3ea7db81a5d00fc64ce5ce21fbf2e58
Instruction Fuzzy Hash: 1E517E75910204EFDF10CF68E881AEE77B6EB55320F149659F869D7291DB30ED81CBA0

Function 00CEC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00CEC462
__itow.LIBCMT ref: 00CEC49C

Part of subcall function 00CEC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00CEC753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00CEC505
__itow.LIBCMT ref: 00CEC55A

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 2b3294c56fbd2cdd5741d70cfd3207f4d077fae4748c93eaf072fe43e712afad
Instruction ID: 78dea6102440f42dad2e81eac6d63a1c04c55ad763a89e3851f68384d690e053
Opcode Fuzzy Hash: 2b3294c56fbd2cdd5741d70cfd3207f4d077fae4748c93eaf072fe43e712afad
Instruction Fuzzy Hash: EC41A771600749AFDF11DF59CC92BFE7BB9AF49700F000019FA15A7281DB749A46DBA1

Function 00CF390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00CF3966
SetKeyboardState.USER32(00000080,?,00000001), ref: 00CF3982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00CF39EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00CF3A4D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c72a39ca5002789c071c2286cdd08e4f1312821c679293da0182586246c73804
Instruction ID: a21b9ac89612b93e0ec74e70854ce79a680e0f3ef4323ba1aa6c005ad86cce96
Opcode Fuzzy Hash: c72a39ca5002789c071c2286cdd08e4f1312821c679293da0182586246c73804
Instruction Fuzzy Hash: BE412770A0428CBEEFA18B658805BFDBBB99B45311F04015AF6D1962C1C7F48F85EB67

Function 00CFE698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00CFE742
GetLastError.KERNEL32(?,00000000), ref: 00CFE768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00CFE78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00CFE7B9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 03ea22b5e12d860eca2c09d6a27b92febb538fc49194a482678bfafea18a3d75
Instruction ID: 38c2722cecf96f029a6fcc6e888f8fca5b9d7fecb8cf721fcb04db3f903926f0
Opcode Fuzzy Hash: 03ea22b5e12d860eca2c09d6a27b92febb538fc49194a482678bfafea18a3d75
Instruction Fuzzy Hash: 6A412539200614DFCB11AF15C544A5DBBE6FF59720F098099EA06AB3B2CB70FD00DB92

Function 00D1B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D1B5D1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: af8ccb088edb8cdde1b73609530bd8c0d537c02c9620b2d8e966fda49a0ba2a8
Instruction ID: 493257ff81091fa6a95b50b39e86f34a55098fe5931044dc0fbd4f87d4f9b6ab
Opcode Fuzzy Hash: af8ccb088edb8cdde1b73609530bd8c0d537c02c9620b2d8e966fda49a0ba2a8
Instruction Fuzzy Hash: 4A316B74601208BFEB209B18EC89BE87B66EB15370F584517FA51DA2E1DF30E9D09A71

Function 00D1D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00D1D807
GetWindowRect.USER32(?,?), ref: 00D1D87D
PtInRect.USER32(?,?,00D1ED5A), ref: 00D1D88D
MessageBeep.USER32(00000000), ref: 00D1D8FE

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: ed844c93d515656cd7baf70c704ec6c99d7f7e90c0056faf0ad8ff36b8647247
Instruction ID: a5b588d4e1a9855728e82edc54bc7a177bc7afba03aed9f3795e1a104b38eb5a
Opcode Fuzzy Hash: ed844c93d515656cd7baf70c704ec6c99d7f7e90c0056faf0ad8ff36b8647247
Instruction Fuzzy Hash: EF413974A00219EFCB11DF58E884AED7BB6BB45315F1881AAE414DB251DB30E985CF60

Function 00CF3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00CF3AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00CF3AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00CF3B34
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00CF3B92

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d0148b7f1bd27ee3eb8c562e36cbf6c070b00658876c7dae5f78e7f16b62a03d
Instruction ID: 10c0916a119db0807959e98324c1228409086b12826c9af16b60a9d1caddbb82
Opcode Fuzzy Hash: d0148b7f1bd27ee3eb8c562e36cbf6c070b00658876c7dae5f78e7f16b62a03d
Instruction Fuzzy Hash: 4B314830A003DCBFEFA18B6488297FEBBA69B45310F14015AE691972D1C7748F45D767

Function 00CE4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CE4038
__isleadbyte_l.LIBCMT ref: 00CE4066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00CE4094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00CE40CA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 69adadd44e02e02931bf14d2c747bfd7e358397e82d942fc84517c5562bd9533
Instruction ID: 4b1a077326a34abf25f059d39adb0205a900916b999fe5a5e9707b79dd5df576
Opcode Fuzzy Hash: 69adadd44e02e02931bf14d2c747bfd7e358397e82d942fc84517c5562bd9533
Instruction Fuzzy Hash: 9231C131600286EFDF299F76C844BBA7BA5FF40320F154439EA658B1A1E731E991DB90

Function 00D17CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00D17CB9

Part of subcall function 00CF5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CF5F6F
Part of subcall function 00CF5F55: GetCurrentThreadId.KERNEL32 ref: 00CF5F76
Part of subcall function 00CF5F55: AttachThreadInput.USER32(00000000,?,00CF781F), ref: 00CF5F7D

GetCaretPos.USER32(?), ref: 00D17CCA
ClientToScreen.USER32(00000000,?), ref: 00D17D03
GetForegroundWindow.USER32 ref: 00D17D09

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: c0aa59772f5a3d00858a1bc80d366cf7946f030b9068e29551ebcdb1826ca3da
Instruction ID: b34163f2c7cdbc0ad058e2bb69b5e146d36bf027655eb75edd017a511ab0cb0e
Opcode Fuzzy Hash: c0aa59772f5a3d00858a1bc80d366cf7946f030b9068e29551ebcdb1826ca3da
Instruction Fuzzy Hash: 4F311A72900108AFDB00EFA9D885DEFBBF9EF58314B10846AE915E3211DA319E059FA0

Function 00D1F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

GetCursorPos.USER32(?), ref: 00D1F211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00D2E4C0,?,?,?,?,?), ref: 00D1F226
GetCursorPos.USER32(?), ref: 00D1F270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D2E4C0,?,?,?), ref: 00D1F2A6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: b4c7f1116bb942fd77c88afcfdfb98a56e29e66bbc7497a718f3a2a1b64aeaf9
Instruction ID: 4f49f4507196ba92f11fc8ca80efd811823666f1b177d1797e732b13c58002d5
Opcode Fuzzy Hash: b4c7f1116bb942fd77c88afcfdfb98a56e29e66bbc7497a718f3a2a1b64aeaf9
Instruction Fuzzy Hash: 23217E39500128BFCB258F98E859EEE7BB5FB0A710F088169F909C72A1D7309D91DB74

Function 00D0431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D04358

Part of subcall function 00D043E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D04401
Part of subcall function 00D043E2: InternetCloseHandle.WININET(00000000), ref: 00D0449E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 28e74ee1e8304de07f5e6370c31f61d1a4964516194f8a3b3906230867b908f2
Instruction ID: c9038ae2d754d38c56ef63f4d0babef1cc651f68894b459c2e4a3d233a59af32
Opcode Fuzzy Hash: 28e74ee1e8304de07f5e6370c31f61d1a4964516194f8a3b3906230867b908f2
Instruction Fuzzy Hash: 5321D1B5240B01BBEB119F60EC01FBBB7AAFF44710F14501AFB5A96690DB71D8209BB0

Function 00D08A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00D08AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00D08AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 00D08AFF
WSAGetLastError.WSOCK32(00000000), ref: 00D08B16

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 8d8a2dfec302b6ffa2821a5ac959a9449b422c4581e861bc47c7cb2ef55deb0e
Instruction ID: 00ec1551ad381092e7faba18f241542ead953043c7b7ed0391262bffd8f54e69
Opcode Fuzzy Hash: 8d8a2dfec302b6ffa2821a5ac959a9449b422c4581e861bc47c7cb2ef55deb0e
Instruction Fuzzy Hash: 1D216372A00124AFC7219F69D885A9EBBEDEF49350F00416AF84AD7291DB74DE419FA0

Function 00D18A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00D18AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D18AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D18ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00D18ADC

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 88169c8515972a1a70541e3f5815da780a7cefe2fceebc09325d05c2e237b5fd
Instruction ID: 85923fbd6a68035712c59c3aedfa60bb80f01972c7cc3c6087204842b31793d6
Opcode Fuzzy Hash: 88169c8515972a1a70541e3f5815da780a7cefe2fceebc09325d05c2e237b5fd
Instruction Fuzzy Hash: 57118E31345215AFE704AB28EC05FBA779DAF85321F18411AF916C72E1DF74AC409BA5

Function 00CF0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00CF0ABB,?,?,?,00CF187A,00000000,000000EF,00000119,?,?), ref: 00CF1E77
Part of subcall function 00CF1E68: lstrcpyW.KERNEL32(00000000,?), ref: 00CF1E9D
Part of subcall function 00CF1E68: lstrcmpiW.KERNEL32(00000000,?,00CF0ABB,?,?,?,00CF187A,00000000,000000EF,00000119,?,?), ref: 00CF1ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00CF187A,00000000,000000EF,00000119,?,?,00000000), ref: 00CF0AD4
lstrcpyW.KERNEL32(00000000,?), ref: 00CF0AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,00CF187A,00000000,000000EF,00000119,?,?,00000000), ref: 00CF0B2E

Strings

cdecl, xrefs: 00CF0B25

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: dc8d798b80ec041cf508a5114d84b1ced9018a22bf74b2925a946775b28c72e4
Instruction ID: ecb346c565f4656333298d4280f483abe8b487e171408aaff2189c740c3513f8
Opcode Fuzzy Hash: dc8d798b80ec041cf508a5114d84b1ced9018a22bf74b2925a946775b28c72e4
Instruction Fuzzy Hash: D1112236200309EFCB25AF34DC05E7A77B9FF45710B90402AFA06CB291EB719940D7A2

Function 00CE2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CE2FB5

Part of subcall function 00CD395C: __FF_MSGBANNER.LIBCMT ref: 00CD3973
Part of subcall function 00CD395C: __NMSG_WRITE.LIBCMT ref: 00CD397A
Part of subcall function 00CD395C: RtlAllocateHeap.NTDLL(01610000,00000000,00000001,00000001,00000000,?,?,00CCF507,?,0000000E), ref: 00CD399F

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a839068486f197823373455f07acacc4d4183112619132d514acbf679625977c
Instruction ID: 417a03ec87e18a4e14661d14bfba314eba03cb387daa95848ddb02303465defa
Opcode Fuzzy Hash: a839068486f197823373455f07acacc4d4183112619132d514acbf679625977c
Instruction Fuzzy Hash: 4F112031409391AFDB313FB2AC0975A3B98AF403A0F244916FA19D7351EB34CD40AEA0

Function 00CCEB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CCEBB2

Part of subcall function 00CB51AF: _memset.LIBCMT ref: 00CB522F
Part of subcall function 00CB51AF: _wcscpy.LIBCMT ref: 00CB5283
Part of subcall function 00CB51AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00CB5293

KillTimer.USER32(?,00000001,?,?), ref: 00CCEC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00CCEC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00D23C88

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: b7139faead5736d99ea15301f2705ec4216cb4252d9ce5ef258d7976144eff0d
Instruction ID: bf80542031ec308b128147048c847032971489482e230f0e5466db1e325aaa87
Opcode Fuzzy Hash: b7139faead5736d99ea15301f2705ec4216cb4252d9ce5ef258d7976144eff0d
Instruction Fuzzy Hash: 8821FC755047949FE7329B28DC55FE7BBEC9B11308F04044DE69E96281C3746B84DB61

Function 00CF058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00CF05AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00CF05C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00CF05DD
FreeLibrary.KERNEL32(?), ref: 00CF0632

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 9e1af99482ebf26d065ee88f00f8dcbda5e43b15b08c2a8900046328fb80fa87
Instruction ID: c1a40cd7ef6e364b30a2ab967bbaa2bec08d0d85ac12eed19e2868f7d736d4b7
Opcode Fuzzy Hash: 9e1af99482ebf26d065ee88f00f8dcbda5e43b15b08c2a8900046328fb80fa87
Instruction Fuzzy Hash: 4821757190030DEFDB608F91DC88AEAB7B8EF40B00F208469FA16D2151D770EA55DF61

Function 00CF6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00CF6733
_memset.LIBCMT ref: 00CF6754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00CF67A6
CloseHandle.KERNEL32(00000000), ref: 00CF67AF

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 826fc8d5a2f0628ff692e1607295e24bfe4526af73afbbc085eac3118ee33de0
Instruction ID: 5fd04a377f6b3794da62ec3c9576b325060ef00e69581e0395902e05be35fbb0
Opcode Fuzzy Hash: 826fc8d5a2f0628ff692e1607295e24bfe4526af73afbbc085eac3118ee33de0
Instruction Fuzzy Hash: 81110A75901328BAE72067A5AC4DFABBABCEF44724F10419AF504E72C0D2704F808B75

Function 00CEB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CEAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CEAA79
Part of subcall function 00CEAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CEAA83
Part of subcall function 00CEAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CEAA92
Part of subcall function 00CEAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CEAA99
Part of subcall function 00CEAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CEAAAF

GetLengthSid.ADVAPI32(?,00000000,00CEADE4,?,?), ref: 00CEB21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00CEB227
HeapAlloc.KERNEL32(00000000), ref: 00CEB22E
CopySid.ADVAPI32(?,00000000,?), ref: 00CEB247

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: 5e6d8bb791509deeb4e73942172012f2239c790b2b1041362011c466f2660eb9
Instruction ID: 208568020a42c27bc9626d7c889d666bc9012fa24dc9fc3aa09c7aab61796c8c
Opcode Fuzzy Hash: 5e6d8bb791509deeb4e73942172012f2239c790b2b1041362011c466f2660eb9
Instruction Fuzzy Hash: 76119171A01205EFDB049FA5DE85ABFB7AAEF85304F14802DEA52D7210D731AE44DB20

Function 00CEB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00CEB498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CEB4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CEB4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CEB4DB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9bd263857cb181bae83eaadc07c1e75fa56780cf5e8f2ff2e25f243abbc64586
Instruction ID: 13b0dee31f16c48fb248886bdb11b3f507a891432b60867320517a31940a0259
Opcode Fuzzy Hash: 9bd263857cb181bae83eaadc07c1e75fa56780cf5e8f2ff2e25f243abbc64586
Instruction Fuzzy Hash: 20112A7A900218FFEB11DFA9CD85EAEBBB4FB08710F204091E614B7295D771AE11DB94

Function 00CCB55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00CCB34E: GetWindowLongW.USER32(?,000000EB), ref: 00CCB35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00CCB5A5
GetClientRect.USER32(?,?), ref: 00D2E69A
GetCursorPos.USER32(?), ref: 00D2E6A4
ScreenToClient.USER32(?,?), ref: 00D2E6AF

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 14e52cef374ef9601d38bd2b047cff5b90bd5e5efd442f80138eae6347b34ff6
Instruction ID: 68aedd0b07bf33589609c4373af400e38b596682187d25525f29ed87698be315
Opcode Fuzzy Hash: 14e52cef374ef9601d38bd2b047cff5b90bd5e5efd442f80138eae6347b34ff6
Instruction Fuzzy Hash: A0110635900129BBCB10DFA8E886DEE7BBAEB09305F100455F911E7240D734AA96DBB1

Function 00CF732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CF7352
MessageBoxW.USER32(?,?,?,?), ref: 00CF7385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00CF739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00CF73A2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: c458e55c75fcb0bead89b4a956408cb62d00687528918869e7d951bdc01ed937
Instruction ID: 15739c9ac0858c97c89fcfa7b28ad72f45c468dec4d51ae5a29c3acb34ef4f4b
Opcode Fuzzy Hash: c458e55c75fcb0bead89b4a956408cb62d00687528918869e7d951bdc01ed937
Instruction Fuzzy Hash: A0110872A04309FFC7019B6CDC05AAE7BAE9B45310F144315F925D3361E6708E049BB5

Function 00CCD17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CCD1BA
GetStockObject.GDI32(00000011), ref: 00CCD1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 00CCD1D8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 5cecbb82e87db26e88aa86beaf9bb5e38b0cb4b6485c1536bc8170509dbafccd
Instruction ID: e0aa3711f0e5d02abf59ef44db01306d9588b48ae895bbdb57e6ffcd14d3eb93
Opcode Fuzzy Hash: 5cecbb82e87db26e88aa86beaf9bb5e38b0cb4b6485c1536bc8170509dbafccd
Instruction Fuzzy Hash: B611A172101609BFEF024F90DC55EEE7B6AFF09364F080125FA1692150C731DD60DBA0

Function 00CE4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00CE4E16

Part of subcall function 00CE54F5: __fltout2.LIBCMT ref: 00CE551E

__cftog_l.LIBCMT ref: 00CE4E3C
__cftoe_l.LIBCMT ref: 00CE4E6E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: aa6cc6f1c4668f000c2a48208b585f2a6b11b439915ebdf1ec476897c4acc73d
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 75014C3640018EBBCF165E86DC068EE7F23BB18354B588455FE285A031D336CAB1BB81

Function 00CD7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CD7A0D: __getptd_noexit.LIBCMT ref: 00CD7A0E

__lock.LIBCMT ref: 00CD748F
InterlockedDecrement.KERNEL32(?), ref: 00CD74AC
_free.LIBCMT ref: 00CD74BF
InterlockedIncrement.KERNEL32(01622880), ref: 00CD74D7

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 02ae69e05de9e42054dfb8d0220431b6a5daa511418da693a2f4fdd1b96d987d
Instruction ID: 6487d3b06b0d9d372568dd26ba7661f39669a9416bbfb470bc12e8c2504bb3ed
Opcode Fuzzy Hash: 02ae69e05de9e42054dfb8d0220431b6a5daa511418da693a2f4fdd1b96d987d
Instruction Fuzzy Hash: 9501D632909721ABC713AF68A50675DBB60BF04710F154207FA64B3790E7345E00DFE2

Function 00CD7A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00CD7AD8

Part of subcall function 00CD7CF4: __mtinitlocknum.LIBCMT ref: 00CD7D06
Part of subcall function 00CD7CF4: EnterCriticalSection.KERNEL32(00000000,?,00CD7ADD,0000000D), ref: 00CD7D1F

InterlockedIncrement.KERNEL32(?), ref: 00CD7AE5
__lock.LIBCMT ref: 00CD7AF9
___addlocaleref.LIBCMT ref: 00CD7B17

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: b6f089fdd900fe68aef0eff065b35d034e7b66e878025412db29b69f46d42466
Instruction ID: 5777d36a007b2bae408a9da1431a5cc7a58f55d76aab2236b1ca79efa038b5a2
Opcode Fuzzy Hash: b6f089fdd900fe68aef0eff065b35d034e7b66e878025412db29b69f46d42466
Instruction Fuzzy Hash: C2015B71405B00AFD7209F79D90674AB7F0AF50325F20890FE59A967A0DBB0A644DF11

Function 00D1E32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D1E33D
_memset.LIBCMT ref: 00D1E34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D73D00,00D73D44), ref: 00D1E37B
CloseHandle.KERNEL32 ref: 00D1E38D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 1a5e35b31508477cc1736692dddc68266fee89c2028912e0b79da384868cabd3
Instruction ID: a8b212273e51d1e4034cabcdce7620e6a9a85188aaccd7e553469ead5db941d6
Opcode Fuzzy Hash: 1a5e35b31508477cc1736692dddc68266fee89c2028912e0b79da384868cabd3
Instruction Fuzzy Hash: F0F05EF1540314BAE3201B64AC49FBB7E5DDB05754F004422BF0CD63A2E7759E40A6B9

Function 00D1EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00CCAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00CCAFE3
Part of subcall function 00CCAF83: SelectObject.GDI32(?,00000000), ref: 00CCAFF2
Part of subcall function 00CCAF83: BeginPath.GDI32(?), ref: 00CCB009
Part of subcall function 00CCAF83: SelectObject.GDI32(?,00000000), ref: 00CCB033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D1EA8E
LineTo.GDI32(00000000,?,?), ref: 00D1EA9B
EndPath.GDI32(00000000), ref: 00D1EAAB
StrokePath.GDI32(00000000), ref: 00D1EAB9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 34bf227e67ba30ac183c099d2093551c976f5ff87d0b54e83f78ddbdd9fbd2d5
Instruction ID: e50a92e7719e3b00e73c86efc7131dd8f7dc6a062ea1e450398d5dbee55795d2
Opcode Fuzzy Hash: 34bf227e67ba30ac183c099d2093551c976f5ff87d0b54e83f78ddbdd9fbd2d5
Instruction Fuzzy Hash: 36F05E32045359BBDB169FA4BC0DFCE3F2AAF06711F084205FE11A12E187B45595DBB5

Function 00CEC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CEC84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CEC85D
GetCurrentThreadId.KERNEL32 ref: 00CEC864
AttachThreadInput.USER32(00000000), ref: 00CEC86B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: bad1f49eff9105ad41de7d53d50d3befc2f1c4cb120bc430310bdce0c029004b
Instruction ID: 9d991760ec20beea23e126c5f7b9801fdb09b490ba9b33009bac876684f4f491
Opcode Fuzzy Hash: bad1f49eff9105ad41de7d53d50d3befc2f1c4cb120bc430310bdce0c029004b
Instruction Fuzzy Hash: FCE03971141368BADB201BA2EC4EFDB7F2DEF167A1F008021B619C45A0C6B18581DBF0

Function 00CEB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00CEB0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,00CEAC9D), ref: 00CEB0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00CEAC9D), ref: 00CEB0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,00CEAC9D), ref: 00CEB0F1

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 2a3fae7a2b418a9f86a4f2dd3e996368c6f28b3b8485bf15ebcfff424b43b0f3
Instruction ID: 805d8c8b8aec518fd572d01b548f4aacb292d0528ca20bcfde7610a8870eeacf
Opcode Fuzzy Hash: 2a3fae7a2b418a9f86a4f2dd3e996368c6f28b3b8485bf15ebcfff424b43b0f3
Instruction Fuzzy Hash: 7EE086727013119BD7201FB2AD0DB573BADEF55B91F018828F241D6140DB349801CF70

Function 00CCB47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00CCB496
SetTextColor.GDI32(?,000000FF), ref: 00CCB4A0
SetBkMode.GDI32(?,00000001), ref: 00CCB4B5
GetStockObject.GDI32(00000005), ref: 00CCB4BD
GetWindowDC.USER32(?,00000000), ref: 00D2DE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D2DE38
GetPixel.GDI32(00000000,?,00000000), ref: 00D2DE51
GetPixel.GDI32(00000000,00000000,?), ref: 00D2DE6A
GetPixel.GDI32(00000000,?,?), ref: 00D2DE8A
ReleaseDC.USER32(?,00000000), ref: 00D2DE95

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 106920b635e25f7feb6c8665d2ec4fe35a242146b7cf4ee6d11990ea4a5d302f
Instruction ID: a80ca22c175e7b751831a1e31397e0321f0e9d0335c683b5e3c9a29b394501be
Opcode Fuzzy Hash: 106920b635e25f7feb6c8665d2ec4fe35a242146b7cf4ee6d11990ea4a5d302f
Instruction Fuzzy Hash: 1CE0ED31504340AFDB215B64FC09BD87B22AB62339F14C666F6B9980E5C7714981DF21

Function 00CEB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00CEB2DF
UnloadUserProfile.USERENV(?,?), ref: 00CEB2EB
CloseHandle.KERNEL32(?), ref: 00CEB2F4
CloseHandle.KERNEL32(?), ref: 00CEB2FC

Part of subcall function 00CEAB24: GetProcessHeap.KERNEL32(00000000,?,00CEA848), ref: 00CEAB2B
Part of subcall function 00CEAB24: HeapFree.KERNEL32(00000000), ref: 00CEAB32

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 0cf3594639d67305d944c41477d2e4d61808deaca9f1313a61e44d58c578ba60
Instruction ID: a5f52e921a05520e715531abbc4e7536209e25acef49e617775127f3b4a8f51b
Opcode Fuzzy Hash: 0cf3594639d67305d944c41477d2e4d61808deaca9f1313a61e44d58c578ba60
Instruction Fuzzy Hash: 54E02F7A104505BFDB016B95EC08859FB77FF993213108621F616C1675CB32A871EFA5

Function 00D2B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D2B29A
GetDC.USER32(00000000), ref: 00D2B2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D2B2C3
ReleaseDC.USER32 ref: 00D2B2E2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d2f4286b68173e421db0f71e535c6b98e615f5975dc038e477ef6d0bb3d432b9
Instruction ID: a78401b07ff8c02ca306719740d8828643e5721969ff7c6f1ccce7761b119269
Opcode Fuzzy Hash: d2f4286b68173e421db0f71e535c6b98e615f5975dc038e477ef6d0bb3d432b9
Instruction Fuzzy Hash: B0E01AB1100308EFDB005F70E849A2D7BA6EB4C350F11881AF86AC7310CA7598409F60

Function 00D2B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00D2B2AE
GetDC.USER32(00000000), ref: 00D2B2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D2B2C3
ReleaseDC.USER32 ref: 00D2B2E2

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 96ebe4d53f197a5f6496590fc647ee53e4bff72da45f7ac1437c815feffc04b9
Instruction ID: e9cff6d6fe2fd65d2974467cc3273444b2ebfab95fe651330da48750695ad479
Opcode Fuzzy Hash: 96ebe4d53f197a5f6496590fc647ee53e4bff72da45f7ac1437c815feffc04b9
Instruction Fuzzy Hash: C0E046B1500308EFDB005F70E849A2D7BAAEB4C390F118819F96ECB310CF7998008F20

Function 00CEDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00CEDEAA

Strings

Container, xrefs: 00CEDE29
AutoIt3GUI, xrefs: 00CEDE22

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 166244a134d3071b8d4f39cce1f65dc13899b60356bc5038f085f5b92190037a
Instruction ID: df25ab94ddfa87a0e7adb9c3fd30b112131dc1b2770163b3eedc6c8da754e09c
Opcode Fuzzy Hash: 166244a134d3071b8d4f39cce1f65dc13899b60356bc5038f085f5b92190037a
Instruction Fuzzy Hash: CB913570600701AFDB14CF65C888F6ABBB9BF49710F20896DF95ACB691DB70E941CB60

Function 00CCBCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00CCBCDA
GlobalMemoryStatusEx.KERNEL32 ref: 00CCBCF3

Strings

@, xrefs: 00CCBCE8

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: f1b96034d22884f32512554c78e1bba2861ead60f733698a1f7104e60e36b8ec
Instruction ID: 8ee6a63368fc14f9e4e141e86f6e083d3370695fc94ba94a8baae8543b182300
Opcode Fuzzy Hash: f1b96034d22884f32512554c78e1bba2861ead60f733698a1f7104e60e36b8ec
Instruction Fuzzy Hash: 6D5124714087449BE320AF54DC86FAFBBE8FF94354F41484EF1C8811A6DF7085A89766

Function 00CFC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00CB44ED: __fread_nolock.LIBCMT ref: 00CB450B

_wcscmp.LIBCMT ref: 00CFC65D
_wcscmp.LIBCMT ref: 00CFC670

Strings

FILE, xrefs: 00CFC5A5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: d5a86c9ddf8fb955edb2b3d530397b64b47f1f7a1f0d664d052a51b16800f29c
Instruction ID: c2b00d6eadde13d3a27d6a0a889f4344690706303236c48718e182f666a30e91
Opcode Fuzzy Hash: d5a86c9ddf8fb955edb2b3d530397b64b47f1f7a1f0d664d052a51b16800f29c
Instruction Fuzzy Hash: 2C41E572A0420EBBDF249AA4DC82FEF77B9AF49704F004069F605EB181D7709A04DB61

Function 00D1A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00D1A85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D1A86F

Strings

', xrefs: 00D1A7C3

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 22956daa4455f96e8cee203e37d57afa32b32462ad9bf84287af84821ea96da1
Instruction ID: f429c3df1511f315dd4b8d4d9b7ddca1e7a07ac540a1550049bdcc80cad0e13d
Opcode Fuzzy Hash: 22956daa4455f96e8cee203e37d57afa32b32462ad9bf84287af84821ea96da1
Instruction Fuzzy Hash: 5E41C975A01309AFDB54CF68D981BDA7BB5FB08700F14016AE905EB391DB70A985CFA1

Function 00D05180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D05190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D051C6

Strings

|, xrefs: 00D051B5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 7620e29101ad0ffbf2c6e44d434a8a1e180983dbc3902f0ca9900e865236ce08
Instruction ID: 3f0e81b90ec9b196c4e1587af2856832e106e41132ecef99fc85d980333e9646
Opcode Fuzzy Hash: 7620e29101ad0ffbf2c6e44d434a8a1e180983dbc3902f0ca9900e865236ce08
Instruction Fuzzy Hash: 25313B71C01119ABCF01EFA4DC85AEE7FB9FF14710F100055F919A6166DB35A906DFA1

Function 00D1975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00D1980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00D1984A

Strings

static, xrefs: 00D197AA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: cd0cd056986bc2e607f53fc02b5dcece65764bdac2902ae48e2ac1a52a254821
Instruction ID: 418d548f0c0e55372b255d77f1f910039b4220f6944b3a70f3a58738dd65abab
Opcode Fuzzy Hash: cd0cd056986bc2e607f53fc02b5dcece65764bdac2902ae48e2ac1a52a254821
Instruction Fuzzy Hash: A7316B71110604AEEB109F78DC91BFBB3A9FF59764F048619F8A9C7190DA31AC81DB70

Function 00CF5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF51C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CF5201

Strings

0, xrefs: 00CF51BF

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: ecbed82a054466ac376a980262f3c872bc81f7027a6e753598691c00ea4c5aa0
Instruction ID: e64283adbc7c7be0e5f3d03ffcc1b1463ea95911e53912106d57475f3bd26533
Opcode Fuzzy Hash: ecbed82a054466ac376a980262f3c872bc81f7027a6e753598691c00ea4c5aa0
Instruction Fuzzy Hash: C731F53160070C9BEB68CF99D845BBEBBF4EF46350F14421DEBA5A61A0E7709B44CB12

Function 00D0658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00D06608

Strings

, $, xrefs: 00D06648
AUTOITCALLVARIABLE%d, xrefs: 00D065FA

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: 3d9a97c1312a94126190c988f78e502cb61277efce516a9ae292a7e3bf70cc7a
Instruction ID: e66ff58d45b4f4f90a7f2d77ea87e8f9e3953f3b6f6a222fa976ea27ea413fc9
Opcode Fuzzy Hash: 3d9a97c1312a94126190c988f78e502cb61277efce516a9ae292a7e3bf70cc7a
Instruction Fuzzy Hash: 98218071600218AFCF10EFA8C892FEE77B4AF49740F440499F509AB181DB71EA55DBB5

Function 00D193CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D1945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D19467

Strings

Combobox, xrefs: 00D19429

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: fe4328764c6c3d15ae308e522aacc5e7b1b9fd8baecdff091df5979f901fb51f
Instruction ID: 2e86f7598f7e13028529960b989101ba6780880daf2f113a409d487875f6074c
Opcode Fuzzy Hash: fe4328764c6c3d15ae308e522aacc5e7b1b9fd8baecdff091df5979f901fb51f
Instruction Fuzzy Hash: 2211B2B1300208BFEF15DE54ECA0EFB776EEB483A4F140125F91997290DA319C928774

Function 00D198FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CCD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00CCD1BA
Part of subcall function 00CCD17C: GetStockObject.GDI32(00000011), ref: 00CCD1CE
Part of subcall function 00CCD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00CCD1D8

GetWindowRect.USER32(00000000,?), ref: 00D19968
GetSysColor.USER32(00000012), ref: 00D19982

Strings

static, xrefs: 00D19945

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1e5b259e1e177cd7351f6d4f99f5e3262ea03c93288c6c3809d588adbfd84686
Instruction ID: 30087d00c2b267898025ad4df88f360cffc2d773264f28ee6cb5cde91b764f95
Opcode Fuzzy Hash: 1e5b259e1e177cd7351f6d4f99f5e3262ea03c93288c6c3809d588adbfd84686
Instruction Fuzzy Hash: 48112972510209BFDB04DFB8DC55AEEBBA8FB08354F055629F956D3250E734E850DB60

Function 00D19617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00D19699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00D196A8

Strings

edit, xrefs: 00D1967D

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 783db6d17dfedea4cbe4437f3ebe05ff31ef07061de49fefd25e1e16d8137575
Instruction ID: 98d82dcef74e3e7ae84b76d720ac0e4eb67a46481bfbb4d0e5b077818e5cec84
Opcode Fuzzy Hash: 783db6d17dfedea4cbe4437f3ebe05ff31ef07061de49fefd25e1e16d8137575
Instruction Fuzzy Hash: 6B116A71500208BBEB105F64EC64EEB7B6AEB053B8F144314F965932E0CB35DC919B70

Function 00CF5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF52D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00CF52F4

Strings

0, xrefs: 00CF52CE

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 4630bc1cbf80e61eec1b909b29397999294f41e0223914722708b929d2466872
Instruction ID: b6921ccc66871ce481b8a37350d2c52dc4f425c4ee8159daeacf53db32e805f3
Opcode Fuzzy Hash: 4630bc1cbf80e61eec1b909b29397999294f41e0223914722708b929d2466872
Instruction Fuzzy Hash: F811E975D01B28EBDBA0DB9CD944BBD77B89B05754F140115EB15E72A0D3B0EE08C7A2

Function 00D04D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00D04DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00D04E1E

Strings

<local>, xrefs: 00D04DE6

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 31e3126777d4ce097323dceddb9d2a99b8bcf525c4bb2bd3023ea7eba5f6990f
Instruction ID: 5a55a18efc8f12d6313fed90f0b85a9b75a9b612861743251cdae7b0cd036c89
Opcode Fuzzy Hash: 31e3126777d4ce097323dceddb9d2a99b8bcf525c4bb2bd3023ea7eba5f6990f
Instruction Fuzzy Hash: 4D119EB0501221FBDB258B52C888FFBFAA8FF06754F10822AF64996180E6709950C6F0

Function 00D0A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D0A84E
htons.WSOCK32(00000000,?,00000000), ref: 00D0A88B

Strings

255.255.255.255, xrefs: 00D0A866

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: efa8a19301c121032e4b699935aa79c3c0985f31b5a01155d9c96c045909880f
Instruction ID: a7e65e7fe7a47995d86aa10fa584b243dc9fd880f5c814f3935c2fd96d449f81
Opcode Fuzzy Hash: efa8a19301c121032e4b699935aa79c3c0985f31b5a01155d9c96c045909880f
Instruction Fuzzy Hash: EF01F575200304ABCB209F6CD886FADB765EF44310F14852AF51A9B3D1D771E806DB76

Function 00CEB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00CEB7EF

Strings

ComboBox, xrefs: 00CEB78B
ListBox, xrefs: 00CEB7B9

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 3d4a010e1435d4daa1ed92730af71095f29cac093a2cba62bdcdc02caa499f17
Instruction ID: e05475a783c8021d2192dbdecc908dc4039af662b4218233da01e97859725493
Opcode Fuzzy Hash: 3d4a010e1435d4daa1ed92730af71095f29cac093a2cba62bdcdc02caa499f17
Instruction Fuzzy Hash: DF01D471641158AFCB04EBA5CC929FF3379BF46350B04061DF472A72D2EB705D189BA0

Function 00CEB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 00CEB6EB

Strings

ComboBox, xrefs: 00CEB687
ListBox, xrefs: 00CEB6B5

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 5ca81696f31f99a285bb0b231168c991eb22e6bcd5a759d66461a506644b6e51
Instruction ID: 62ced53b47a9fda8e9fd488cf9d4d4aad0b9636236898f26d7daeee25215dc95
Opcode Fuzzy Hash: 5ca81696f31f99a285bb0b231168c991eb22e6bcd5a759d66461a506644b6e51
Instruction Fuzzy Hash: F7018FB1641148ABCB08EBA5C993BFF73BC9B05344F100029B412A3281DB909F18ABB5

Function 00CEB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 00CEB76C

Strings

ComboBox, xrefs: 00CEB70A
ListBox, xrefs: 00CEB738

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 2388a91fef368b9d4b7374f191c72af37eba0462d39e93cadbf4b92bb873845d
Instruction ID: db5bc9b2ec4e931b5d3e8618f82447718219358961b6238661921fe0197a2885
Opcode Fuzzy Hash: 2388a91fef368b9d4b7374f191c72af37eba0462d39e93cadbf4b92bb873845d
Instruction Fuzzy Hash: E101D1B5681248ABCB00EBA5C943FFF73AC9F05344F100019B412B3292DB609F19ABB5

Function 00CF7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CF7762
_wcscmp.LIBCMT ref: 00CF7774

Strings

#32770, xrefs: 00CF776E

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: c07f83e6bdf26500f26dc0b90eec1f3321eb1d5b2c76c991afe1683725cd9dff
Instruction ID: 87bc76789da1d2c745a21d3185e50ac70ef624301298de9e91ddb1603a794975
Opcode Fuzzy Hash: c07f83e6bdf26500f26dc0b90eec1f3321eb1d5b2c76c991afe1683725cd9dff
Instruction Fuzzy Hash: B1E09277A043282BD720ABA5EC0AE97FBACAB55760F000116BA15D3141E670E64587E0

Function 00CEA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00CEA63F

Part of subcall function 00CD13F1: _doexit.LIBCMT ref: 00CD13FB

Strings

AutoIt, xrefs: 00CEA633
Error allocating memory., xrefs: 00CEA638

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: e424b7ab43fa1c02ee24a14bbf9d8daa2a9a438527e157a88b9b9f9a5a71b9bc
Instruction ID: 0b146b9402502141deabaf3d869bba4ec94bfb641d901ad7391208576f3774a4
Opcode Fuzzy Hash: e424b7ab43fa1c02ee24a14bbf9d8daa2a9a438527e157a88b9b9f9a5a71b9bc
Instruction Fuzzy Hash: 32D05B313C47183BD21537997C17FD5758D8B55B95F08001AFB08D56D249E2965051F9

Function 00D2AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00D2ACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00D2AEBD

Strings

WIN_XPe, xrefs: 00D2ACD3

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: b70c89f73657b277412b0d687b00e3b52d1ff5d953a6742d5c9a59699698ac7f
Instruction ID: 8eaf2fd08f96f951e8adee823be98378bf696c75e6ce65c3edfc06d89638222c
Opcode Fuzzy Hash: b70c89f73657b277412b0d687b00e3b52d1ff5d953a6742d5c9a59699698ac7f
Instruction Fuzzy Hash: 5FE06D74C00729DFCB11EBA9E944AECB7B9EB98304F148085E046B2260DB704A84EF32

Function 00D186CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D186E2
PostMessageW.USER32(00000000), ref: 00D186E9

Part of subcall function 00CF7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CF7AD0

Strings

Shell_TrayWnd, xrefs: 00D186DB

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bedb62f41105e1ed67e7d3c702428ad41315a297d96d47bdb000bdd9397f832d
Instruction ID: f1c484ae1fbb70f1e17aba3c2c887996541575c44507ea6c11f9f2e6000b0aa4
Opcode Fuzzy Hash: bedb62f41105e1ed67e7d3c702428ad41315a297d96d47bdb000bdd9397f832d
Instruction Fuzzy Hash: ACD012317853187BF264A770AC0BFC67A199B05B11F111915B746EB2D0C9E0E950CB75

Function 00D18698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D186A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00D186B5

Part of subcall function 00CF7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00CF7AD0

Strings

Shell_TrayWnd, xrefs: 00D1869B

Memory Dump Source

Source File: 00000000.00000002.2017551072.0000000000CB1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CB0000, based on PE: true

Associated: 00000000.00000002.2017452195.0000000000CB0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D3D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017609193.0000000000D5E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017650945.0000000000D6A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2017674111.0000000000D74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cb0000_z47maaaaaaaaaaaaax.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: ea55eb8cd59b085f61c4381f94dd4219b91b76ab4115b784a37c4fee3f0332ba
Instruction ID: ab6ce8a6611cd2c6211ad4124b26a953f70a39fad3b87116f6434ccd2b9a1c35
Opcode Fuzzy Hash: ea55eb8cd59b085f61c4381f94dd4219b91b76ab4115b784a37c4fee3f0332ba
Instruction Fuzzy Hash: 29D01231784318BBE264A770AC0BFD67E199B04B11F111915B74AEB2D0C9E0E950CB74

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z47maaaaaaaaaaaaax.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut92F0.tmp

C:\Users\user\AppData\Local\Temp\aut932F.tmp

C:\Users\user\AppData\Local\Temp\epistemology

C:\Users\user\AppData\Local\Temp\translucently

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
z47maaaaaaaaaaaaax.exe

Function 00CDB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00CB3D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Function 00CCDDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 00CB406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00CFFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 00CB3F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00CFBFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 00CB3742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00CB3E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 00CB49FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 00CB36B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00CB51AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00CB4139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258
COMMON

Function 00CB4A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138
COMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre