Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1518425
MD5:	7a1336cb114d90e0f64b7d29f29bbda8
SHA1:	c8fe455d1bc2e8117236b58c952fd920cc87f166
SHA256:	ec92d229701dbcc7e54bc124c94e917c05adc13bdaba3a67e3e00180735ff888
Tags:	exeuser-jstrosch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Machine Learning detection for sample

Renames NTDLL to bypass HIPS

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Detected potential crypto function

Drops PE files

Enables debug privileges

Enables driver privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5956 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7A1336CB114D90E0F64B7D29F29BBDA8)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://121.40.100.23:12616/down/2b4pI1hCJx7p.exe

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.10000000.4.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: devco n.pdbo source: file.exe
Source:	Binary string: wntdll.pdbUGP source: file.exe, 00000000.00000003.2128212727.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371663637.0000000002D03000.00000040.00000020.00020000.00000000.sdmp, 4db5eb.tmp.0.dr
Source:	Binary string: wntdll.pdb source: file.exe, 00000000.00000003.2128212727.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371663637.0000000002D03000.00000040.00000020.00020000.00000000.sdmp, 4db5eb.tmp.0.dr
Source:	Binary string: wuser32.pdb source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371806602.0000000002EBA000.00000040.00000020.00020000.00000000.sdmp, 4db659.tmp.0.dr
Source:	Binary string: DrvInDM U.pdbe source: file.exe
Source:	Binary string: wuser32.pdbUGP source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371806602.0000000002EBA000.00000040.00000020.00020000.00000000.sdmp, 4db659.tmp.0.dr
Source:	Binary string: devc@on.pdb source: file.exe

Source: file.exe	String found in binary or memory: http://121.40.100.23/1.html
Source: file.exe	String found in binary or memory: http://121.40.100.23:12616/down/2b4pI1hCJx7p.exe
Source: file.exe	String found in binary or memory: http://121.40.100.23:12616/down/4IbByzd41Ya1.zip
Source: file.exe	String found in binary or memory: http://121.40.100.23:12616/down/ZWLu16Av5FGr.txt
Source: file.exe	String found in binary or memory: http://ocsp.t
Source: file.exe	String found in binary or memory: http://sf.symc
Source: file.exe	String found in binary or memory: http://ts-ocsp.ws.s
Source: file.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.
Source: file.exe	String found in binary or memory: https://ww(w.v

Source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_8b205abc-2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401206 NtQueryInformationProcess,CloseHandle,

0_2_00401206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005062DB

0_2_005062DB

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 0040157A appears 34 times

Source: 4db5eb.tmp.0.dr

Static PE information: Resource name: RT_MESSAGETABLE type: PDP-11 separate I&D executable not stripped

Source: 4db5eb.tmp.0.dr

Static PE information: No import functions for PE file found

Source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuser32j% vs file.exe
Source: file.exe, 00000000.00000002.3371663637.0000000002E30000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs file.exe
Source: file.exe, 00000000.00000002.3371806602.0000000002F62000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameuser32j% vs file.exe
Source: file.exe, 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSkinH_EL.dll vs file.exe
Source: file.exe, 00000000.00000003.2128212727.0000000002C7B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs file.exe
Source: file.exe, 00000000.00000002.3371602045.0000000002A3D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSkinH_EL.dll vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameSkinH_EL.dll vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 4db5eb.tmp.0.dr

Binary string: \Device\IPT[

Source: classification engine

Classification label: mal76.evad.winEXE@1/2@0/0

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\4db5eb.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dciman32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior

Source: file.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: file.exe

Static file information: File size 5603328 > 1048576

Source: file.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x37a000

Source:	Binary string: devco n.pdbo source: file.exe
Source:	Binary string: wntdll.pdbUGP source: file.exe, 00000000.00000003.2128212727.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371663637.0000000002D03000.00000040.00000020.00020000.00000000.sdmp, 4db5eb.tmp.0.dr
Source:	Binary string: wntdll.pdb source: file.exe, 00000000.00000003.2128212727.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371663637.0000000002D03000.00000040.00000020.00020000.00000000.sdmp, 4db5eb.tmp.0.dr
Source:	Binary string: wuser32.pdb source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371806602.0000000002EBA000.00000040.00000020.00020000.00000000.sdmp, 4db659.tmp.0.dr
Source:	Binary string: DrvInDM U.pdbe source: file.exe
Source:	Binary string: wuser32.pdbUGP source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371806602.0000000002EBA000.00000040.00000020.00020000.00000000.sdmp, 4db659.tmp.0.dr
Source:	Binary string: devc@on.pdb source: file.exe

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.10000000.4.unpack

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007609D3 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007609D3

Source: 4db5eb.tmp.0.dr	Static PE information: section name: RT
Source: 4db5eb.tmp.0.dr	Static PE information: section name: .mrdata
Source: 4db5eb.tmp.0.dr	Static PE information: section name: .00cfg
Source: 4db659.tmp.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00754B7C push eax; ret

0_2_00754B9A

Source: 4db5eb.tmp.0.dr

Static PE information: section name: .text entropy: 6.844715065913507

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\4db5eb.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\4db659.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Renames NTDLL to bypass HIPS

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Windows\SysWOW64\ntdll.dll			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4db5eb.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4db659.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F509E GetSystemInfo,

0_2_005F509E

Source: file.exe, 00000000.00000002.3371192702.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_007609D3 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007609D3

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug			Jump to behavior

Source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371806602.0000000002EBA000.00000040.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371192702.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: file.exe, 00000000.00000002.3371192702.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindowe
Source: file.exe, 00000000.00000002.3371192702.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow\
Source: file.exe, 00000000.00000003.2128945599.0000000002B5E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371806602.0000000002EBA000.00000040.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3371192702.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00772830 GetVersion,InitializeCriticalSection,

0_2_00772830

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 LSASS Driver	1 Process Injection	1 Process Injection	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 LSASS Driver	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	3 Obfuscated Files or Information	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	87%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\4db5eb.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\4db659.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ts-ocsp.ws.symantec.	0%	Avira URL Cloud	safe
http://sf.symc	0%	Avira URL Cloud	safe
http://121.40.100.23/1.html	0%	Avira URL Cloud	safe
http://121.40.100.23:12616/down/2b4pI1hCJx7p.exe	100%	Avira URL Cloud	malware
http://ocsp.t	0%	Avira URL Cloud	safe
http://ts-ocsp.ws.s	0%	Avira URL Cloud	safe
https://ww(w.v	0%	Avira URL Cloud	safe
http://121.40.100.23:12616/down/4IbByzd41Ya1.zip	0%	Avira URL Cloud	safe
http://121.40.100.23:12616/down/ZWLu16Av5FGr.txt	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://121.40.100.23/1.html	file.exe	false	Avira URL Cloud: safe	unknown
http://121.40.100.23:12616/down/4IbByzd41Ya1.zip	file.exe	false	Avira URL Cloud: safe	unknown
https://ww(w.v	file.exe	false	Avira URL Cloud: safe	unknown
http://ocsp.t	file.exe	false	Avira URL Cloud: safe	unknown
http://ts-ocsp.ws.s	file.exe	false	Avira URL Cloud: safe	unknown
http://121.40.100.23:12616/down/ZWLu16Av5FGr.txt	file.exe	false	Avira URL Cloud: safe	unknown
http://121.40.100.23:12616/down/2b4pI1hCJx7p.exe	file.exe	false	Avira URL Cloud: malware	unknown
http://ts-ocsp.ws.symantec.	file.exe	false	Avira URL Cloud: safe	unknown
http://sf.symc	file.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518425
Start date and time:	2024-09-25 17:27:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@1/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\4db659.tmp	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	FZ6oyLoqGM.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1A_54.exe	Get hash	malicious	Bdaejec	Browse
	LisectAVT_2403002A_186.exe	Get hash	malicious	Unknown	Browse
	zde6gdIB73.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.DropperX-gen.25624.11389.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen19.27544.4289.6649.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\4db5eb.tmp	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	BCNFNjvJNq.exe	Get hash	malicious	ADWIND, Lokibot, Ramnit, Sality	Browse
	cnlg48.exe	Get hash	malicious	Unknown	Browse
	Lisect_AVT_24003_G1A_54.exe	Get hash	malicious	Bdaejec	Browse
	LisectAVT_2403002A_186.exe	Get hash	malicious	Unknown	Browse
	zde6gdIB73.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.DropperX-gen.25624.11389.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\4db5eb.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1699896
Entropy (8bit):	6.290547513916722
Encrypted:	false
SSDEEP:	24576:0Na0qyFU/vb313JPCGucMBbruVALdpNQHKl3y9UfSj6HYZY8zCixcq:kFU3b3HucMBbrb/qj98deCNq
MD5:	5564A98A4692BA8B2D25770FB834D5F6
SHA1:	129D030D817F6B25D1FDEF2CAD33EB81DE1DEA8B
SHA-256:	28AB9A0F5F50FD5398324B5EC099F5C53C6FAA701C3F6D8B0B3DA47A76C56230
SHA-512:	D803E2E3425095E170910103A4470C598FD4A9A10C1217A006A6393CD1ECA06D1C628E845F6FD1071F1C92778D481F47E4E5F175005FEC2CB0A7519C90992858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: BCNFNjvJNq.exe, Detection: malicious, Browse Filename: cnlg48.exe, Detection: malicious, Browse Filename: Lisect_AVT_24003_G1A_54.exe, Detection: malicious, Browse Filename: LisectAVT_2403002A_186.exe, Detection: malicious, Browse Filename: zde6gdIB73.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.DropperX-gen.25624.11389.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-.=FizS.izS.izS.2.P.jzS.}.S.hzS.}.P./zS.}.].q{S.}.V.rzS.}.W..zS.}...hzS.}.Q.hzS.RichizS.........................PE..L..................!.........................0....(K.........................@......,.....@A............................U...............................8`.......Q..0z..p............................................................................text...%........................... ..`RT.................................. ..`PAGE....:.... ...................... ..`.data....Z...0......................@....mrdata.x#.......$..................@....00cfg...............:..............@..@.rsrc................<..............@..@.reloc...Q.......R...>..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4db659.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1679648
Entropy (8bit):	5.3288490918902225
Encrypted:	false
SSDEEP:	24576:nB79uCigstmh6JVZ3et1NtJJBwuCx59U4IgL5pc6:JXh2LeXJBwuOTU4I56
MD5:	2E8AB67DC55089DFBCBFA7710BD15B07
SHA1:	159434853CE512029314C6B70070220D251A924A
SHA-256:	2BCC4FD8A4D3C4033A81702E1B685860BE78D6F1A7E980F2E7593C59656F2706
SHA-512:	7898B7B48685A2079BC77210464C448025E5BECB25EDDF3FB612A320B627FDB45AFF12D4913ADA98524E2C4718D74E911CE007F4DE6E3F2BB7184CDFAC5A0E5F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: FZ6oyLoqGM.exe, Detection: malicious, Browse Filename: Lisect_AVT_24003_G1A_54.exe, Detection: malicious, Browse Filename: LisectAVT_2403002A_186.exe, Detection: malicious, Browse Filename: zde6gdIB73.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.28674.10592.dll, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.DropperX-gen.25624.11389.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen19.27544.4289.6649.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l=..(\.H(\.H(\.H!$4Hd\.H<7.I!\.H(\.H)X.H<7.I)\.H<7.I!\.H<7.I.\.H<7.I'\.H<7XH)\.H<7.I)\.HRich(\.H........PE..L...-..?...........!.....0...:...............@.....i................................=.....@A............................(s..X...\.... ...............B.. _...@..$g.. Q..T...............................................L...<........................text...8/.......0.................. ..`.data....2...@.......4..............@....idata..`............<..............@..@.didat..x...........................@....rsrc........ ......................@..@.reloc..$g...@...h..................@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.332202119447142
TrID:	Win32 Executable (generic) a (10002005/4) 99.26% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Visual Basic Script (13500/0) 0.13% Generic Win/DOS Executable (2004/3) 0.02%
File name:	file.exe
File size:	5'603'328 bytes
MD5:	7a1336cb114d90e0f64b7d29f29bbda8
SHA1:	c8fe455d1bc2e8117236b58c952fd920cc87f166
SHA256:	ec92d229701dbcc7e54bc124c94e917c05adc13bdaba3a67e3e00180735ff888
SHA512:	9376a69c1cc17d478baa49a191e86a33a190397eba3ca7e11a772786c60d819ba70282dc1abc050d0680002cc8f2ac0eb98335cf266e74bcce214254164b1aa8
SSDEEP:	98304:mKgVAhl+8ewKd249PMCVe9kCh7bT8Y5D3dV4JM8jUCYHMR1HLqZBYMg:mKgVAhl+8id249PMCVe9kCh7bT8Y5D3m
TLSH:	B1464A23B152C061E50515B015A0DB382E763AB86C7E86AFFBF0DDA57DB08B1C7B261D
File Content Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.......a...%..F%..F%..FJ..F,..FJ..F#..F^..F+..Fs..F...F...F'..F...F...F%..F...FG..F...F#..F$..F#..Fq..F...F$..F...FP..F6..F,..F...F...

File Icon


Icon Hash:	66c4c44a6c668c72

Static PE Info

General

Entrypoint:	0x750540
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x66E98455 [Tue Sep 17 13:29:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	14ac16b6ab41482a6dec812b524ddab4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 008674A0h
push 00753EE4h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [0077B200h]
xor edx, edx
mov dl, ah
mov dword ptr [009BF180h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [009BF17Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [009BF178h], ecx
shr eax, 10h
mov dword ptr [009BF174h], eax
push 00000001h
call 00007FD14CB220A4h
pop ecx
test eax, eax
jne 00007FD14CB1A6CAh
push 0000001Ch
call 00007FD14CB1A788h
pop ecx
call 00007FD14CB21E4Fh
test eax, eax
jne 00007FD14CB1A6CAh
push 00000010h
call 00007FD14CB1A777h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007FD14CB21C7Dh
call dword ptr [0077B448h]
mov dword ptr [009C4944h], eax
call 00007FD14CB21B3Bh
mov dword ptr [009BF0E0h], eax
call 00007FD14CB218E4h
call 00007FD14CB21826h
call 00007FD14CB1EC76h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [0077B2ACh]
call 00007FD14CB217B7h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007FD14CB1A6C8h
movzx eax, word ptr [ebp+00h]

Rich Headers

Programming Language:

[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168
[ C ] VS98 (6.0) build 8168
[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x474058	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5c5000	0x8aa8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x37b000	0x878	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37944e	0x37a000	379a58168dfffa03660d8471fd03c823	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37b000	0xfbcf8	0xfc000	f796a927937884ac8f7f460d90cd8d4f	False	0.5729941716269841	data	6.5988962951107135	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x477000	0x14d94a	0xd8000	1c0120b524d300df6e961b24013b1b9c	False	0.5099973325376157	data	5.576805928304713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5c5000	0x8aa8	0x9000	7a253bdaf65e2c2df38c6fcf55188ed0	False	0.4484320746527778	data	5.885356181019409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
TEXTINCLUDE	0x5c5f88	0xb	ASCII text, with no line terminators	Chinese	China	1.7272727272727273
TEXTINCLUDE	0x5c5f94	0x16	data	Chinese	China	1.3636363636363635
TEXTINCLUDE	0x5c5fac	0x151	C source, ASCII text, with CRLF line terminators	Chinese	China	0.6201780415430267
WAVE	0x5c6100	0x1448	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 22050 Hz	Chinese	China	0.8330123266563945
RT_CURSOR	0x5c7548	0x134	data	Chinese	China	0.5811688311688312
RT_CURSOR	0x5c767c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	Chinese	China	0.37662337662337664
RT_CURSOR	0x5c77b0	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	Chinese	China	0.4805194805194805
RT_CURSOR	0x5c78e4	0xb4	Targa image data - Map 32 x 65536 x 1 +16 "\001"	Chinese	China	0.7
RT_CURSOR	0x5c7998	0x134	AmigaOS bitmap font "(", fc_YSize 4294967292, 3840 elements, 2nd "\377\370\017\377\377\374\037\377\377\376?\377\377\377\177\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.32792207792207795
RT_CURSOR	0x5c7acc	0x134	AmigaOS bitmap font "(", fc_YSize 4294967288, 3840 elements, 2nd "\377\370\037\377\377\370\037\377\377\370\037\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377\377", 3rd	Chinese	China	0.3246753246753247
RT_CURSOR	0x5c7c00	0x134	data	Italian	Italy	0.37012987012987014
RT_CURSOR	0x5c7d34	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	Italian	Italy	0.5097402597402597
RT_CURSOR	0x5c7e68	0x134	data	Italian	Italy	0.487012987012987
RT_BITMAP	0x5c7f9c	0x1002	Device independent bitmap graphic, 104 x 13 x 24, image size 4058, resolution 2834 x 2834 px/m	Chinese	China	0.349194729136164
RT_BITMAP	0x5c8fa0	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.3598901098901099
RT_BITMAP	0x5c910c	0x248	Device independent bitmap graphic, 64 x 15 x 4, image size 480	Chinese	China	0.3407534246575342
RT_BITMAP	0x5c9354	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.4444444444444444
RT_BITMAP	0x5c9498	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.26453488372093026
RT_BITMAP	0x5c95f0	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2616279069767442
RT_BITMAP	0x5c9748	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2441860465116279
RT_BITMAP	0x5c98a0	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.24709302325581395
RT_BITMAP	0x5c99f8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240, resolution 3780 x 3780 px/m	Chinese	China	0.2238372093023256
RT_BITMAP	0x5c9b50	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.19476744186046513
RT_BITMAP	0x5c9ca8	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.20930232558139536
RT_BITMAP	0x5c9e00	0x158	Device independent bitmap graphic, 20 x 20 x 4, image size 240	Chinese	China	0.18895348837209303
RT_BITMAP	0x5c9f58	0x5e4	Device independent bitmap graphic, 70 x 39 x 4, image size 1404	Chinese	China	0.34615384615384615
RT_BITMAP	0x5ca53c	0xb8	Device independent bitmap graphic, 12 x 10 x 4, image size 80	Chinese	China	0.44565217391304346
RT_BITMAP	0x5ca5f4	0x16c	Device independent bitmap graphic, 39 x 13 x 4, image size 260	Chinese	China	0.28296703296703296
RT_BITMAP	0x5ca760	0x144	Device independent bitmap graphic, 33 x 11 x 4, image size 220	Chinese	China	0.37962962962962965
RT_ICON	0x5ca8a4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Chinese	China	0.26344086021505375
RT_ICON	0x5cab8c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Chinese	China	0.41216216216216217
RT_ICON	0x5cacb4	0xc44	Device independent bitmap graphic, 32 x 62 x 24, image size 3100, resolution 2835 x 2835 px/m			0.9168789808917197
RT_MENU	0x5cb8f8	0xc	data	Chinese	China	1.5
RT_MENU	0x5cb904	0x284	data	Chinese	China	0.5
RT_DIALOG	0x5cbb88	0x98	data	Chinese	China	0.7171052631578947
RT_DIALOG	0x5cbc20	0x17a	data	Chinese	China	0.5185185185185185
RT_DIALOG	0x5cbd9c	0xfa	data	Chinese	China	0.696
RT_DIALOG	0x5cbe98	0xea	data	Chinese	China	0.6239316239316239
RT_DIALOG	0x5cbf84	0x8ae	data	Chinese	China	0.39603960396039606
RT_DIALOG	0x5cc834	0xb2	data	Chinese	China	0.7359550561797753
RT_DIALOG	0x5cc8e8	0xcc	data	Chinese	China	0.7647058823529411
RT_DIALOG	0x5cc9b4	0xb2	data	Chinese	China	0.6629213483146067
RT_DIALOG	0x5cca68	0xe2	data	Chinese	China	0.6637168141592921
RT_DIALOG	0x5ccb4c	0x18c	data	Chinese	China	0.5227272727272727
RT_STRING	0x5cccd8	0x50	data	Chinese	China	0.85
RT_STRING	0x5ccd28	0x2c	data	Chinese	China	0.5909090909090909
RT_STRING	0x5ccd54	0x78	data	Chinese	China	0.925
RT_STRING	0x5ccdcc	0x1c4	data	Chinese	China	0.8141592920353983
RT_STRING	0x5ccf90	0x12a	data	Chinese	China	0.5201342281879194
RT_STRING	0x5cd0bc	0x146	data	Chinese	China	0.6288343558282209
RT_STRING	0x5cd204	0x40	data	Chinese	China	0.65625
RT_STRING	0x5cd244	0x64	data	Chinese	China	0.73
RT_STRING	0x5cd2a8	0x1d8	data	Chinese	China	0.6758474576271186
RT_STRING	0x5cd480	0x114	data	Chinese	China	0.6376811594202898
RT_STRING	0x5cd594	0x24	data	Chinese	China	0.4444444444444444
RT_GROUP_CURSOR	0x5cd5b8	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x5cd5cc	0x14	data	Chinese	China	1.4
RT_GROUP_CURSOR	0x5cd5e0	0x14	data	Italian	Italy	1.4
RT_GROUP_CURSOR	0x5cd5f4	0x14	data	Italian	Italy	1.4
RT_GROUP_CURSOR	0x5cd608	0x14	data	Italian	Italy	1.4
RT_GROUP_CURSOR	0x5cd61c	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x5cd630	0x14	Lotus unknown worksheet or configuration, revision 0x1	Chinese	China	1.25
RT_GROUP_CURSOR	0x5cd644	0x22	Lotus unknown worksheet or configuration, revision 0x2	Chinese	China	1.0294117647058822
RT_GROUP_ICON	0x5cd668	0x14	data			1.25
RT_GROUP_ICON	0x5cd67c	0x14	data	Chinese	China	1.2
RT_GROUP_ICON	0x5cd690	0x14	data	Chinese	China	1.25
RT_VERSION	0x5cd6a4	0x234	data	Chinese	China	0.5301418439716312
RT_MANIFEST	0x5cd8d8	0x1cd	XML 1.0 document, ASCII text, with very long lines (461), with no line terminators			0.5878524945770065

Imports

DLL	Import
MSVFW32.dll	DrawDibDraw
AVIFIL32.dll	AVIStreamGetFrame, AVIStreamInfoA
iphlpapi.dll	GetAdaptersInfo
WINMM.dll	waveOutRestart, midiStreamRestart, midiStreamClose, midiOutReset, midiStreamStop, PlaySoundA, waveOutUnprepareHeader, waveOutPrepareHeader, waveOutWrite, waveOutPause, waveOutReset, waveOutClose, midiStreamOut, midiOutPrepareHeader, midiStreamProperty, midiStreamOpen, midiOutUnprepareHeader, waveOutOpen, waveOutGetNumDevs
WS2_32.dll	inet_addr, inet_ntoa, gethostbyname, WSAStartup, WSACleanup, select, send, closesocket, htons, socket, setsockopt, recvfrom, ioctlsocket, WSAAsyncSelect, connect, recv, getpeername, ntohl, WSAGetLastError, ntohs, getservbyname, shutdown, accept
RASAPI32.dll	RasGetConnectStatusA, RasHangUpA
KERNEL32.dll	GetTimeZoneInformation, GetLocaleInfoA, GetVersion, TerminateThread, CreateMutexA, ReleaseMutex, SuspendThread, InterlockedIncrement, InterlockedDecrement, MapViewOfFile, UnmapViewOfFile, GetSystemInfo, IsProcessorFeaturePresent, lstrcmpiA, SetNamedPipeHandleState, WaitNamedPipeA, OpenFileMappingA, OpenEventA, TlsAlloc, TlsFree, TlsSetValue, TlsGetValue, LocalFree, FileTimeToLocalFileTime, lstrcpynA, DuplicateHandle, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, GlobalDeleteAtom, GlobalFindAtomA, GlobalAddAtomA, GlobalGetAtomNameA, lstrcmpA, LocalAlloc, GlobalHandle, LocalReAlloc, GetFileTime, GetCurrentThread, GlobalFlags, SetErrorMode, GetProcessVersion, GetCPInfo, GetOEMCP, GetStartupInfoA, RtlUnwind, GetSystemTime, GetLocalTime, RaiseException, HeapSize, GetACP, SetStdHandle, GetFileType, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, SetEnvironmentVariableW, SetEnvironmentVariableA, LCMapStringA, LCMapStringW, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, IsValidLocale, IsValidCodePage, EnumSystemLocalesA, CompareStringA, CompareStringW, IsBadReadPtr, IsBadCodePtr, GetLocaleInfoW, SetLastError, TerminateProcess, GetFileSize, SetFilePointer, GetCurrentProcess, GetWindowsDirectoryA, GetSystemDirectoryA, CreateSemaphoreA, ResumeThread, ReleaseSemaphore, EnterCriticalSection, LeaveCriticalSection, GetProfileStringA, WriteFile, WaitForMultipleObjects, CreateFileA, SetEvent, FindResourceA, LoadResource, LockResource, ReadFile, GetModuleFileNameA, WideCharToMultiByte, MultiByteToWideChar, GetCurrentThreadId, ExitProcess, GlobalSize, GlobalFree, DeleteCriticalSection, InitializeCriticalSection, lstrcatA, lstrlenA, WinExec, lstrcpyA, FindNextFileA, GetDriveTypeA, GlobalReAlloc, HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetUserDefaultLCID, GetFullPathNameA, FreeLibrary, LoadLibraryA, GetLastError, GetVersionExA, WritePrivateProfileStringA, GetPrivateProfileStringA, CreateThread, CreateEventA, Sleep, ExpandEnvironmentStringsA, GlobalAlloc, GlobalLock, GlobalUnlock, FindFirstFileA, FindClose, GetFileAttributesA, DeleteFileA, GetCurrentDirectoryA, SetCurrentDirectoryA, GetVolumeInformationA, GetModuleHandleA, GetProcAddress, MulDiv, GetCommandLineA, GetTickCount, CreateProcessA, WaitForSingleObject, CloseHandle, InterlockedExchange, FileTimeToSystemTime
USER32.dll	GetSysColorBrush, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, CheckMenuItem, IsDialogMessageA, ScrollWindowEx, SendDlgItemMessageA, MapWindowPoints, AdjustWindowRectEx, GetScrollPos, RegisterClassA, GetClassLongA, RemovePropA, GetMessageTime, GetLastActivePopup, RegisterWindowMessageA, GetWindowPlacement, EndDialog, CreateDialogIndirectParamA, DestroyWindow, EndPaint, BeginPaint, CharUpperA, GetWindowTextLengthA, GetDlgItem, GetClassNameA, GetDesktopWindow, UnregisterHotKey, RegisterHotKey, CreateWindowExA, GetWindowTextA, SetWindowTextA, GetMenuItemCount, GetMenuItemID, GetMenuStringA, GetMenuState, GetTabbedTextExtentA, GrayStringA, TabbedTextOutA, WindowFromDC, EnumChildWindows, GetWindowDC, UnhookWindowsHookEx, CallNextHookEx, SetWindowsHookExA, GetPropA, MoveWindow, CallWindowProcA, SetPropA, DrawTextA, GetCursor, DrawStateA, FrameRect, GetNextDlgTabItem, GetForegroundWindow, LoadIconA, TranslateMessage, DrawFrameControl, DrawEdge, DrawFocusRect, WindowFromPoint, GetMessageA, DispatchMessageA, SetRectEmpty, CreateIconFromResourceEx, CreateIconFromResource, DrawIconEx, CreatePopupMenu, AppendMenuA, ModifyMenuA, CreateMenu, CreateAcceleratorTableA, GetDlgCtrlID, GetSubMenu, EnableMenuItem, ClientToScreen, EnumDisplaySettingsA, LoadImageA, SystemParametersInfoA, ShowWindow, IsWindowEnabled, TranslateAcceleratorA, GetKeyState, CopyAcceleratorTableA, PostQuitMessage, IsZoomed, GetClassInfoA, DefWindowProcA, GetSystemMenu, DeleteMenu, GetMenu, SetMenu, PeekMessageA, IsIconic, SetFocus, GetActiveWindow, GetWindow, DestroyAcceleratorTable, SetWindowRgn, GetMessagePos, ScreenToClient, ChildWindowFromPointEx, CopyRect, LoadBitmapA, WinHelpA, KillTimer, SetTimer, ReleaseCapture, GetCapture, SetCapture, GetScrollRange, SetScrollRange, SetScrollPos, SetRect, InflateRect, IntersectRect, DestroyIcon, PtInRect, OffsetRect, EnableWindow, RedrawWindow, GetWindowLongA, SetWindowLongA, GetSysColor, SetActiveWindow, SetCursorPos, LoadCursorA, SetCursor, GetDC, FillRect, IsRectEmpty, ReleaseDC, IsChild, TrackPopupMenu, DestroyMenu, SetForegroundWindow, GetWindowRect, EqualRect, UpdateWindow, ValidateRect, InvalidateRect, GetClientRect, GetFocus, GetParent, GetTopWindow, PostMessageA, IsWindow, SetParent, DestroyCursor, SendMessageA, SetWindowPos, MessageBoxA, GetCursorPos, GetSystemMetrics, EmptyClipboard, SetClipboardData, OpenClipboard, GetClipboardData, CloseClipboard, wsprintfA, WaitForInputIdle, LoadStringA, RegisterClipboardFormatA, IsWindowVisible, UnregisterClassA
GDI32.dll	FillRgn, CreateRectRgn, CombineRgn, PatBlt, CreatePen, SelectObject, CreatePatternBrush, CreateBitmap, CreateBrushIndirect, CreateDCA, CreateCompatibleBitmap, GetPolyFillMode, GetStretchBltMode, GetROP2, GetBkColor, GetBkMode, GetTextColor, CreateRoundRectRgn, CreateEllipticRgn, PathToRegion, EndPath, BeginPath, GetWindowOrgEx, GetViewportOrgEx, GetWindowExtEx, ExtTextOutA, Escape, TranslateCharsetInfo, CreateSolidBrush, SetPolyFillMode, SetROP2, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, GetClipBox, ExcludeClipRect, CreateFontIndirectA, MoveToEx, LineTo, ExtSelectClipRgn, GetViewportExtEx, GetTextMetricsA, CreateFontA, SetDIBitsToDevice, SetTextColor, SetBkMode, TextOutA, SetBkColor, CreateRectRgnIndirect, CreateDIBSection, SetPixel, SetStretchBltMode, GetClipRgn, CreatePolygonRgn, SelectClipRgn, DeleteObject, CreateDIBitmap, GetSystemPaletteEntries, CreatePalette, StretchBlt, SelectPalette, RealizePalette, GetDIBits, RectVisible, PtVisible, CreatePenIndirect, RestoreDC, Ellipse, Rectangle, LPtoDP, DPtoLP, GetCurrentObject, RoundRect, SaveDC, SetWindowOrgEx, GetStockObject, GetObjectA, EndPage, EndDoc, DeleteDC, StartDocA, StartPage, BitBlt, GetPixel, CreateCompatibleDC, GetTextExtentPoint32A, SetPixelV, GetDeviceCaps
MSIMG32.dll	GradientFill
WINSPOOL.DRV	OpenPrinterA, DocumentPropertiesA, ClosePrinter
comdlg32.dll	ChooseColorA, GetOpenFileNameA, GetSaveFileNameA, GetFileTitleA
ADVAPI32.dll	RegCreateKeyExA, RegOpenKeyA, RegQueryValueA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegEnumValueA
SHELL32.dll	SHGetFileInfoA, DragAcceptFiles, DragFinish, ShellExecuteA, Shell_NotifyIconA, DragQueryFileA
ole32.dll	ReleaseStgMedium, RevokeDragDrop, RegisterDragDrop, OleUninitialize, CLSIDFromString, CoCreateInstance, OleInitialize
OLEAUT32.dll	RegisterTypeLib, LoadTypeLib, UnRegisterTypeLib
COMCTL32.dll	ImageList_DragLeave, ImageList_DragEnter, ImageList_Destroy, ImageList_Create, ImageList_BeginDrag, ImageList_Add, ImageList_DragMove, ImageList_Draw, _TrackMouseEvent, ImageList_SetBkColor, ImageList_GetImageCount, ImageList_GetImageInfo, ImageList_GetIcon, ImageList_DragShowNolock, ImageList_EndDrag, ImageList_Read, ImageList_DrawIndirect, ImageList_AddMasked, ImageList_Duplicate
WLDAP32.dll
WININET.dll	InternetSetOptionA, InternetCrackUrlA, HttpOpenRequestA, HttpSendRequestA, HttpQueryInfoA, InternetReadFile, InternetOpenA, InternetCloseHandle, InternetConnectA, InternetCanonicalizeUrlA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
Italian	Italy

Target ID:	0
Start time:	11:27:51
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	5'603'328 bytes
MD5 hash:	7A1336CB114D90E0F64B7D29F29BBDA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	110
Total number of Limit Nodes:	8

Executed Functions

Function 005F509E Relevance: 1.8, Strings: 1, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

vC_, xrefs: 005F514E, 005F5160, 005F5748, 005F5428, 005F5431, 005F546D, 005F547E, 005F548F, 005F5670, 005F56BF, 005F5163, 005F574B, 005F574F, 005F5752

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: vC_
API String ID: 0-2411568467
Opcode ID: 1c4dda3368cdca0c89a98bb64a06a57f86725e935613fc8f95a55cf08c70be4c
Instruction ID: 8681a458051ee2a07c642eea8abbf43eb4025d26925c681c52277016a0bc552d
Opcode Fuzzy Hash: 1c4dda3368cdca0c89a98bb64a06a57f86725e935613fc8f95a55cf08c70be4c
Instruction Fuzzy Hash: 2D1241B1A4134ADBEF10CF98DCC17A9BBB1FF19324F280465D615AB341E378A951CB62

Function 00401206 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c673c911b44b72776cfcf8a89ebfcd91a3f6c350f2bbc2778d8ce28c94b059d5
Instruction ID: 6afd92ac2057d4cb10981bfa3c39769624b99d9aab4f6c66045804a2187ca17d
Opcode Fuzzy Hash: c673c911b44b72776cfcf8a89ebfcd91a3f6c350f2bbc2778d8ce28c94b059d5
Instruction Fuzzy Hash: 90510F74E40309EBEF51AFD0D847BAEBB71EF04701F10406AF6047A2E1D6B91A54DB9A

Function 007717BC Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(009BED40,009BED14,00000000,?,009BED24,009BED24,00771B57,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516,?,00000000), ref: 007717CB
GlobalAlloc.KERNELBASE(00002002,00000000,?,?,009BED24,009BED24,00771B57,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516,?,00000000), ref: 00771820
GlobalHandle.KERNEL32(00AE2DB8), ref: 00771829
GlobalUnlock.KERNEL32(00000000), ref: 00771832
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00771844
GlobalHandle.KERNEL32(00AE2DB8), ref: 0077185B
GlobalLock.KERNEL32(00000000), ref: 00771862
LeaveCriticalSection.KERNEL32(00750620,?,?,009BED24,009BED24,00771B57,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516,?,00000000), ref: 00771868
GlobalLock.KERNEL32(00000000), ref: 00771877
LeaveCriticalSection.KERNEL32(?), ref: 007718C0

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: b9aa6e98fee352e717c27d858536b08f66c8ace75c97368fedfd459b2cb24533
Instruction ID: c49e031babc9136f64bd2345eebc661b91d504934a9c67b0278a701aa60983c2
Opcode Fuzzy Hash: b9aa6e98fee352e717c27d858536b08f66c8ace75c97368fedfd459b2cb24533
Instruction Fuzzy Hash: 9831D5716003099FDB248F28DC89A2AB7E9FF44355F40892DF85AC7661E779E884CB21

Function 005F316C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?,?,?), ref: 005F329A

Strings

odul, xrefs: 005F322E
Load, xrefs: 005F31BA
dleA, xrefs: 005F323E
eHan, xrefs: 005F3236

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: Load$dleA$eHan$odul
API String ID: 1029625771-1617681351
Opcode ID: cbb446ad3e450375899919343118c7f7fd091695d447855841496772320d1268
Instruction ID: 5ce97deee42d2b7698d2c173231c33487013e37c7e503550defc180d348c21e5
Opcode Fuzzy Hash: cbb446ad3e450375899919343118c7f7fd091695d447855841496772320d1268
Instruction Fuzzy Hash: 6D5184B06093469FDB25CF19C880B2FBBE0BF80354F44582DF9868B250DB74DA04CB96

Function 005F300C Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ualA, xrefs: 005F3033
lloc, xrefs: 005F303B
Virt, xrefs: 005F302B

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: Virt$lloc$ualA
API String ID: 0-1619206022
Opcode ID: fc702225be9061ec86dcb6acbd893243b6e9044b5065bc4ab79030e5725022ff
Instruction ID: 9a99a7794db38981c7177ba74c7b69accb4b8c7669952ec6ce5fd681933fef81
Opcode Fuzzy Hash: fc702225be9061ec86dcb6acbd893243b6e9044b5065bc4ab79030e5725022ff
Instruction Fuzzy Hash: 49F0817170031123E3306A2D5C05B6BBE9CEBC0761F50482AFF48D6281E63DD60846F5

Function 005C9DB4 Relevance: 5.3, APIs: 4, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb8a685bf1bd5e33466207a3a456ce10b593972edef8410563dcc0edac835a5
Instruction ID: e14131765db79b148059ffd3850410ea0d40e9c0d83a74ed04f621a44fd0b8c5
Opcode Fuzzy Hash: 5bb8a685bf1bd5e33466207a3a456ce10b593972edef8410563dcc0edac835a5
Instruction Fuzzy Hash: 7DC166716043059FDB24CF68C888B6ABBE5FF88754F18882DFA55CB290D775E805CB62

Function 005CA164 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,00000008,?,00000000), ref: 005CA244

Strings

@, xrefs: 005CA1BD
, xrefs: 005CA1B5

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: $@
API String ID: 544645111-1077428164
Opcode ID: 915545cbe567c01626b14eff9675be2d98f27318c9a73fb88666fa9e01ed22a5
Instruction ID: eae3bf03d236b7073bb0c84048a6b110391ce6ca5129a973bfe9d2f8d8d40abd
Opcode Fuzzy Hash: 915545cbe567c01626b14eff9675be2d98f27318c9a73fb88666fa9e01ed22a5
Instruction Fuzzy Hash: 1131C0755043058FE704CF94C498B6BBFE9FBC4308F448A0CE9455B284D776E944CB92

Function 0076C251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0076C264
SetWindowsHookExA.USER32(000000FF,VO,00000000,00000000), ref: 0076C274

Part of subcall function 00771BB8: __EH_prolog.LIBCMT ref: 00771BBD

Strings

VO, xrefs: 0076C26D

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentH_prologHookThreadWindows
String ID: VO
API String ID: 2183259885-4150196836
Opcode ID: 57f650f7e585001c336e4a294202df92b676dca91492bffa1b1dc83e2423ee58
Instruction ID: e9172fc2dc0ac7580df4be5c050946394d0610003ebc2f5463f2bc425aa47a79
Opcode Fuzzy Hash: 57f650f7e585001c336e4a294202df92b676dca91492bffa1b1dc83e2423ee58
Instruction Fuzzy Hash: AEF0A7715003109FDF352BF4AC0EB793690BB057A0F898658B55B964E2C72C9D808752

Function 00772447 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000000,00000000,0076D535,00000000,00000000,00000000,00000000,?,00000000,?,00763A96,00000000,00000000,00000000,00000000,00750620), ref: 00772450
SetErrorMode.KERNELBASE(00000000,?,00000000,?,00763A96,00000000,00000000,00000000,00000000,00750620,00000000), ref: 00772457

Part of subcall function 007724AA: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?), ref: 007724DB
Part of subcall function 007724AA: lstrcpyA.KERNEL32(?,.HLP,?,?,00000104), ref: 0077257C
Part of subcall function 007724AA: lstrcatA.KERNEL32(?,.INI,?,?,00000104), ref: 007725A9

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorMode$FileModuleNamelstrcatlstrcpy
String ID:
API String ID: 3389432936-0
Opcode ID: 3623cad081243b3c66c58aad6fbad77096c9c33826dff9fcaf6ead10b2707044
Instruction ID: 82a7f5d04bc0a90b124bc3b0cec6b3a9fd30204bea6f9e39a50b38b030625f2d
Opcode Fuzzy Hash: 3623cad081243b3c66c58aad6fbad77096c9c33826dff9fcaf6ead10b2707044
Instruction Fuzzy Hash: 89F037759142108FDB18AF24D448F297BA4AF88760F05C88AF4499B2A3CB78D841CB96

Function 00757F7D Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0075059E,00000001), ref: 00757F8E

Part of subcall function 00757E35: GetVersionExA.KERNEL32 ref: 00757E54

HeapDestroy.KERNEL32 ref: 00757FCD

Part of subcall function 0075B983: HeapAlloc.KERNEL32(00000000,00000140,00757FB6,000003F8), ref: 0075B990

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: a6d687685ebefb8dcf4b78ddbdf39f882f6894ead71bba44944e11cb29aff8d0
Instruction ID: 3a961f8ca6454bb1ee31ed2a7149d5caec7bed5471ce4434a50b784157c728eb
Opcode Fuzzy Hash: a6d687685ebefb8dcf4b78ddbdf39f882f6894ead71bba44944e11cb29aff8d0
Instruction Fuzzy Hash: 51F06570A2D302DEEB68AB317C49FA92699AB447D7F10C425FD08C40E0EBE8C58AD951

Function 007521B5 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 0075229C

Part of subcall function 0075A644: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0075317B,00000009,00000000,00000000,00000001,00757DC6,00000001,00000074,?,?,00000000,00000001), ref: 0075A681
Part of subcall function 0075A644: EnterCriticalSection.KERNEL32(?,?,?,0075317B,00000009,00000000,00000000,00000001,00757DC6,00000001,00000074,?,?,00000000,00000001), ref: 0075A69C

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 8b1a38f6247eb6d989a324e387eef41563d8299022cbc165e05318b10eb6c76b
Instruction ID: 89836a18855e309195d420436ac383a4585d67152af6e16aa7399bed35332ad2
Opcode Fuzzy Hash: 8b1a38f6247eb6d989a324e387eef41563d8299022cbc165e05318b10eb6c76b
Instruction Fuzzy Hash: 3121F736A04245EBDB10EFA4DC46BD9B764FB02725F258215FC10EB1C2D7FC99468A94

Function 0076D07D Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

LoadStringA.USER32(?,?,?,?), ref: 0076D094

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 8d2714907eb33461673dc6a833bbdf2c3baf700afe89b1b8dd87067bb9e2281a
Instruction ID: 38b32b7efd3a52654790100cb9fd2c265daa55d0349f89a5c7c26ac8ad6f4fb2
Opcode Fuzzy Hash: 8d2714907eb33461673dc6a833bbdf2c3baf700afe89b1b8dd87067bb9e2281a
Instruction Fuzzy Hash: 20D0A7725093A19BCB11DF609C08D5FBBA8BF94360B044C0DF48843112C324C854C762

Non-executed Functions

Function 005062DB Relevance: 41.4, Strings: 27, Instructions: 7603COMMON

Download Yara Rule

Strings

C&x, xrefs: 0050A1AB
}Ex, xrefs: 005069C0
C&x, xrefs: 00509596
C&x, xrefs: 0050ABF6
DEx, xrefs: 005064EE
C&x, xrefs: 00508A84
4a811e-020202, xrefs: 005082F1, 00508D28
1&x, xrefs: 00507EE3
C&x, xrefs: 00506335
1&x, xrefs: 0050960A
9Fx, xrefs: 0050C6C9
C&x, xrefs: 0050B8FA
C&x, xrefs: 0050ACD1
C&x, xrefs: 005094BB
101010, xrefs: 00506490, 00506602, 00508047, 0050976E, 0050AEBD, 0050C66B
C&x, xrefs: 0050A286
1&x, xrefs: 00506955
8214ad-010101, xrefs: 0050B167, 0050BB9E
C&x, xrefs: 00507D94
C&x, xrefs: 0050C331
C&x, xrefs: 00507E6F
1&x, xrefs: 0050AD59
C&x, xrefs: 00507424
b7a996-020202, xrefs: 00506BB6, 00507601
C&x, xrefs: 00507349
C&x, xrefs: 0050ACE5
30759d-020202, xrefs: 00509A18, 0050A463

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: 1&x$1&x$1&x$1&x$101010$30759d-020202$4a811e-020202$8214ad-010101$9Fx$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$C&x$DEx$b7a996-020202$}Ex
API String ID: 0-2393341226
Opcode ID: ad6643a92dd7ab9e5f532b8deace2c4f4f5d114a2288e7b82bcb649b99a2e952
Instruction ID: 7f412e534860c4cfb1579fee09ee139da1bd90e6beae0eff424f6b640fc5987f
Opcode Fuzzy Hash: ad6643a92dd7ab9e5f532b8deace2c4f4f5d114a2288e7b82bcb649b99a2e952
Instruction Fuzzy Hash: 7BD36CB1A44309AFEB10DF94ECC2F9D7BB1FF59700F104069F609BA2D1E6B56A508B25

Function 007609D3 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,00758137,?,Microsoft Visual C++ Runtime Library,00012010,?,008679A4,?,008679F4,?,?,?,Runtime Error!Program: ), ref: 007609E5
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 007609FD
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00760A0E
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00760A1B

Strings

user32.dll, xrefs: 007609E0
GetLastActivePopup, xrefs: 00760A10
GetActiveWindow, xrefs: 00760A08
MessageBoxA, xrefs: 007609F7

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 0691b7163e2130e390614f77b0be366d4e9388bff6f859a782786667624bcb9e
Instruction ID: e774663a543914b91d96a7b80568993c9c23a57e803acd931409df54f469abde
Opcode Fuzzy Hash: 0691b7163e2130e390614f77b0be366d4e9388bff6f859a782786667624bcb9e
Instruction Fuzzy Hash: F401A731754302AF87118FF59D88A2B3AE9FB587D1304553AF90ED2271DBB8C854ABA0

Function 00772830 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,007728D3,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6,0076C241,0076D516), ref: 00772843
InitializeCriticalSection.KERNEL32(009BEEE8,?,007728D3,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6,0076C241), ref: 00772868

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalInitializeSectionVersion
String ID:
API String ID: 385228656-0
Opcode ID: ca1ae8a4aeae3f3236a4157168da6fdaff7decafc00250da78d3a70d97a49c82
Instruction ID: 047a495eea8cd375023acff7cae086e4089853058f3c4ae16423a51d4e71c4bd
Opcode Fuzzy Hash: ca1ae8a4aeae3f3236a4157168da6fdaff7decafc00250da78d3a70d97a49c82
Instruction Fuzzy Hash: F8E04F30568110CBE7116B1EBE1D7983290A300375F10C129F01D90177D37A54839F5D

Function 00758013 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00758080
GetStdHandle.KERNEL32(000000F4,008679A4,00000000,00000000,00000000,?), ref: 00758156
WriteFile.KERNEL32(00000000), ref: 0075815D

Strings

..., xrefs: 007580D2
<program name unknown>, xrefs: 00758090
Runtime Error!Program: , xrefs: 007580E6
Microsoft Visual C++ Runtime Library, xrefs: 0075812C

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 4a418568294aae3835e0f729fc5ce3856f14a7e7ebc9592928e03922f9cb69fd
Instruction ID: 44f622d4468b80d98e23e9a24e75c0deb8205fa352d95fb89a8a0289b911ba55
Opcode Fuzzy Hash: 4a418568294aae3835e0f729fc5ce3856f14a7e7ebc9592928e03922f9cb69fd
Instruction Fuzzy Hash: 2731FC72A00208AFDF20D660CD49FEE73ACEF45345F500556F955E6091EBBCEA898B52

Function 00757A4C Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,007505D6), ref: 00757A67
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,007505D6), ref: 00757A7B
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,007505D6), ref: 00757AA7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,007505D6), ref: 00757ADF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,007505D6), ref: 00757B01
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,007505D6), ref: 00757B1A
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,007505D6), ref: 00757B2D
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00757B6B

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 6250da8d714141b913b6368297f7e7e76414937a03895072b1486378cc25c962
Instruction ID: 3d309e1480c501acbe32c8ede31e6c109b649d0e977c391e5435de9cc83bc79b
Opcode Fuzzy Hash: 6250da8d714141b913b6368297f7e7e76414937a03895072b1486378cc25c962
Instruction Fuzzy Hash: D33153F250C2556FD7243B7C7C888BFB69CEB45396B140629FD45C3102EBA88C89C2A0

Function 0077192B Relevance: 9.1, APIs: 6, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(009BED24,009BED14,00000000,?,009BED24,?,00771B93,009BED14,00000000,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516), ref: 00771936
EnterCriticalSection.KERNEL32(009BED40,00000010,?,009BED24,?,00771B93,009BED14,00000000,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516), ref: 00771985
LeaveCriticalSection.KERNEL32(009BED40,00000000,?,009BED24,?,00771B93,009BED14,00000000,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516), ref: 00771998
LocalAlloc.KERNEL32(00000000,00000004,?,009BED24,?,00771B93,009BED14,00000000,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516), ref: 007719AE
LocalReAlloc.KERNEL32(?,00000004,00000002,?,009BED24,?,00771B93,009BED14,00000000,?,00000000,007715AA,00770EA4,007715C6,0076C241,0076D516), ref: 007719C0
TlsSetValue.KERNEL32(009BED24,00000000), ref: 007719FC

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterLeave
String ID:
API String ID: 4117633390-0
Opcode ID: 88b5661ead41c3b53950aad7ac59e45f8e1eb19f8f27409ae64a6f1363f8cc08
Instruction ID: f4dbfdad62db97a9eea36dcefb3f67ecff522756c77eb6db9f164fe90a6befbd
Opcode Fuzzy Hash: 88b5661ead41c3b53950aad7ac59e45f8e1eb19f8f27409ae64a6f1363f8cc08
Instruction Fuzzy Hash: BC316971200609EFDB24CF28C899F6AB7A8FB44394F40C529E56AC7650EB78F855CF60

Function 00757B7E Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00757BDC
GetFileType.KERNEL32(?,?,00000000), ref: 00757C87
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00757CEA
GetFileType.KERNEL32(00000000,?,00000000), ref: 00757CF8
SetHandleCount.KERNEL32 ref: 00757D2F

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 04bf7840eb71f9048b8ec920288f57f076af60804794a682183ffdd5f0e1fcac
Instruction ID: 88d7edcaa56588c8c0153b8ea9d41963432afe48834d10ab0d0b2de8e0a3ed19
Opcode Fuzzy Hash: 04bf7840eb71f9048b8ec920288f57f076af60804794a682183ffdd5f0e1fcac
Instruction Fuzzy Hash: A85109719082458BC724CF28D888BE977E4BB01366F248658D896CB2E1D7B9D94DD760

Function 0075C028 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,0075BDF0,00000000,00000000,00000000,00752203,00000000,00000000,?,00000000,00000000,00000000), ref: 0075C050
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,0075BDF0,00000000,00000000,00000000,00752203,00000000,00000000,?,00000000,00000000,00000000), ref: 0075C084
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 0075C09E
HeapFree.KERNEL32(00000000,?), ref: 0075C0B5

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 5ff03c8a3faaf99d86643a8f910b2e9522047135eba8673f797fc390b6a2a287
Instruction ID: 12af076eed6dd39cd68cb1aa337f9dab9af9530b0ef86a9563476cce8591e152
Opcode Fuzzy Hash: 5ff03c8a3faaf99d86643a8f910b2e9522047135eba8673f797fc390b6a2a287
Instruction Fuzzy Hash: 061116706143809FC7219F18EC45EA67BB6FB84759750CA1EF55AC71F0D3B09A49EB04

Function 007728C3 Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(009BEEE8,?,00000000,?,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6), ref: 007728FE
InitializeCriticalSection.KERNEL32(00000000,?,00000000,?,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6), ref: 00772910
LeaveCriticalSection.KERNEL32(009BEEE8,?,00000000,?,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6), ref: 00772919
EnterCriticalSection.KERNEL32(00000000,00000000,?,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6,0076C241), ref: 0077292B

Part of subcall function 00772830: GetVersion.KERNEL32(?,007728D3,?,00771BD9,00000010,?,00000000,?,?,?,007715C0,00771623,00770EA4,007715C6,0076C241,0076D516), ref: 00772843

Memory Dump Source

Source File: 00000000.00000002.3370582862.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3370559684.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.000000000077B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370826186.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370907049.0000000000877000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370918975.0000000000879000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370930490.000000000087B000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370943729.0000000000885000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370955000.0000000000886000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370967594.000000000088B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3370978602.000000000088C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371033228.000000000094A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371046114.000000000094D000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000094E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.000000000095B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009BD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371058161.00000000009C3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3371114594.00000000009C5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalSection$Enter$InitializeLeaveVersion
String ID:
API String ID: 1193629340-0
Opcode ID: aed0af17f987a8a4052743a95b299a315400a4defa484e051895384984c7b515
Instruction ID: 6415215e0ed5e9aed6d9ebee17b600aae9e4ec7ce97b3f281d611122eaf5a4a6
Opcode Fuzzy Hash: aed0af17f987a8a4052743a95b299a315400a4defa484e051895384984c7b515
Instruction Fuzzy Hash: 28F0623101420ADFCB10DF64ED88996B3ADFB14366F40893AE21E92027D738B496DFA5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\4db5eb.tmp

C:\Users\user\AppData\Local\Temp\4db659.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: file.exePID: 5956, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 5956, Parent PID: 4004COMMON

Windows Analysis Report
file.exe

Function 005F509E Relevance: 1.8, Strings: 1, Instructions: 544
COMMON

Function 007717BC Relevance: 15.1, APIs: 10, Instructions: 99
memoryCOMMON

Function 005F316C Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 166
libraryCOMMON

Function 005F300C Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 45
COMMON

Function 005C9DB4 Relevance: 5.3, APIs: 4, Instructions: 338
COMMON

Function 005CA164 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83
memoryCOMMON

Function 0076C251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27
threadCOMMON

Function 00772447 Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Function 00757F7D Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Function 007521B5 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON