Edit tour

Windows Analysis Report
Yu4oufkUC8.exe

Overview

General Information

Sample name:	Yu4oufkUC8.exe renamed because original name is a hash value
Original sample name:	28d2c70bb31fc2be17ff15f5c07eea5f373563970ec210b3af343444222ef167.exe
Analysis ID:	1543065
MD5:	a15f95b58098883533e018a0f90564bb
SHA1:	4f09e4c7171ee03f47c0954dd24335d19412aca8
SHA256:	28d2c70bb31fc2be17ff15f5c07eea5f373563970ec210b3af343444222ef167
Tags:	exegurt-duna-uauser-JAMESWT_MHT
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

PE file contains an invalid checksum

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Yu4oufkUC8.exe (PID: 5640 cmdline: "C:\Users\user\Desktop\Yu4oufkUC8.exe" MD5: A15F95B58098883533E018A0F90564BB)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Yu4oufkUC8.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Yu4oufkUC8.exe

ReversingLabs: Detection: 32%

Source: Yu4oufkUC8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Yu4oufkUC8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: dccw.pdbGCTL source: Yu4oufkUC8.exe
Source:	Binary string: dccw.pdb source: Yu4oufkUC8.exe

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F3EDC2 GetObjectW,GetLastError,GetWindowRect,GetLastError,GetDC,GetLastError,CreateCompatibleDC,GetLastError,SelectObject,CreateCompatibleDC,GetLastError,SetStretchBltMode,GetLastError,CreateCompatibleBitmap,GetLastError,SelectObject,StretchBlt,GetLastError,SendMessageW,DeleteObject,ReleaseDC,DeleteDC,DeleteDC,DeleteObject,

0_2_00F3EDC2

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Code function: 0_2_00F36166		0_2_00F36166
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Code function: 0_2_00F35245		0_2_00F35245

Source: Yu4oufkUC8.exe	Binary or memory string: OriginalFilename vs Yu4oufkUC8.exe
Source: Yu4oufkUC8.exe, 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedccw.exej% vs Yu4oufkUC8.exe
Source: Yu4oufkUC8.exe, 00000000.00000000.1397182904.0000000000F43000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedccw.exej% vs Yu4oufkUC8.exe
Source: Yu4oufkUC8.exe	Binary or memory string: OriginalFilenamedccw.exej% vs Yu4oufkUC8.exe

Source: Yu4oufkUC8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@1/0@0/0

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F4002C FormatMessageW,LocalFree,GetLastError,

0_2_00F4002C

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F40138 CoCreateInstance,SysAllocString,WinSqmAddToStream,SysFreeString,

0_2_00F40138

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F3596D LoadLibraryExW,FindResourceExW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

0_2_00F3596D

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\DCCW Startup Mutex

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Command line argument: strg

0_2_00F33BBD

Source: Yu4oufkUC8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Yu4oufkUC8.exe

ReversingLabs: Detection: 32%

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: dxva2.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Section loaded: textshaping.dll	Jump to behavior

Source: Yu4oufkUC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Yu4oufkUC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Yu4oufkUC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Yu4oufkUC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Yu4oufkUC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Yu4oufkUC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Yu4oufkUC8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: Yu4oufkUC8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: dccw.pdbGCTL source: Yu4oufkUC8.exe
Source:	Binary string: dccw.pdb source: Yu4oufkUC8.exe

Source: Yu4oufkUC8.exe

Static PE information: real checksum: 0x2100c should be: 0x71b58

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Code function: 0_2_00F40DD1 push ecx; ret		0_2_00F40DE4
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Code function: 0_2_00F31D0C pushad ; retf		0_2_00F31D0D

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

API coverage: 5.2 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F3F7EE mov esi, dword ptr fs:[00000030h]

0_2_00F3F7EE

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F3F8CD GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00F3F8CD

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Code function: 0_2_00F40A80 SetUnhandledExceptionFilter,		0_2_00F40A80
Source: C:\Users\user\Desktop\Yu4oufkUC8.exe	Code function: 0_2_00F407FD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00F407FD

Source: C:\Users\user\Desktop\Yu4oufkUC8.exe

Code function: 0_2_00F40CC9 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00F40CC9

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Yu4oufkUC8.exe	32%	ReversingLabs	Win32.Trojan.Cerbu
Yu4oufkUC8.exe	100%	Avira	TR/Drop.Agent.hgoel

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543065
Start date and time:	2024-10-27 07:36:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Yu4oufkUC8.exe renamed because original name is a hash value
Original Sample Name:	28d2c70bb31fc2be17ff15f5c07eea5f373563970ec210b3af343444222ef167.exe
Detection:	MAL
Classification:	mal56.winEXE@1/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: Yu4oufkUC8.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.325656675016633
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Yu4oufkUC8.exe
File size:	454'452 bytes
MD5:	a15f95b58098883533e018a0f90564bb
SHA1:	4f09e4c7171ee03f47c0954dd24335d19412aca8
SHA256:	28d2c70bb31fc2be17ff15f5c07eea5f373563970ec210b3af343444222ef167
SHA512:	c3b565ca12801a7e82963bc6727cdb801b04807647f9ab577158f7d20abbda22defba6f7a39d91d2f9d4d44090c1d0601f38d035a923d4652fa5039fe559cf9a
SSDEEP:	6144:NLj3gPQYfLQzXGkr1lpLj3gPQYfLQzXGkr1lMLj3gPQYfLQzXGkr1lAUaLj3gPQ9:ht9t+tstRt
TLSH:	A9A4F652754A00E3DAE7177A7DAFBD34E2BD96350790F4C3132486C6D8922C19EB07EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[..a...a...a.......a...b...a...e...a...d...a...`...a...`.[.a...i...a.......a...c...a.Rich..a.........PE..L.....g............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x410670
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x1B679987 [Fri Jul 27 11:05:43 1984 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	491393967a8d093caa31d224e1563ec2

Entrypoint Preview

Instruction
call 00007FD5B8E723E9h
jmp 00007FD5B8E71B04h
int3
int3
int3
int3
int3
int3
cmp ecx, dword ptr [00412074h]
jne 00007FD5B8E71D95h
retn 0000h
jmp 00007FD5B8E71F32h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push dword ptr [ebp+14h]
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
push 00410680h
push 00412074h
call 00007FD5B8E724C0h
add esp, 18h
pop ebp
ret
int3
int3
int3
int3
int3
int3
jmp dword ptr [004133B4h]
int3
int3
int3
int3
int3
int3
push 00000014h
push 00411010h
call 00007FD5B8E7243Eh
and dword ptr [ebp-24h], 00000000h
mov eax, dword ptr [004128DCh]
mov dword ptr [ebp-1Ch], eax
cmp eax, FFFFFFFFh
jne 00007FD5B8E71DA8h
push dword ptr [ebp+08h]
mov esi, dword ptr [00413350h]
mov ecx, esi
call dword ptr [004133DCh]
call esi
pop ecx
jmp 00007FD5B8E71DE6h
push 00000008h
call 00007FD5B8E7247Bh
pop ecx
and dword ptr [ebp-04h], 00000000h
mov eax, dword ptr [004128DCh]
mov dword ptr [ebp-1Ch], eax
mov eax, dword ptr [004128D8h]
mov dword ptr [ebp-20h], eax
lea eax, dword ptr [ebp-20h]
push eax
lea eax, dword ptr [ebp-1Ch]
push eax
push dword ptr [ebp+08h]
call 00007FD5B8E7246Eh
add esp, 00000000h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x133e4	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0xad8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0x1100	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x36ec	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1a18	0xc0	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10074	0x10200	a0f29a9cfdb6ce8a5e5b661d4c75fddd	False	0.4699763808139535	data	6.213626139783662	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0x940	0x600	e13e04f6d2fb4da4268ddcbfffc6f9ca	False	0.2903645833333333	data	2.5070998695029845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13000	0x1a88	0x1c00	d1d54d4ebc4341b577fa01ca1ae5cd84	False	0.41322544642857145	data	5.362229922857188	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0xad8	0xc00	f6912cbbd83d4fc3adab01bc338a72ff	False	0.396484375	data	4.422366166757536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0x1100	0x1200	3f96f8b6178ac65c1972f0c44dfe3d56	False	0.7999131944444444	data	6.534591735538366	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
MUI	0x159d0	0x108	data	English	United States	0.5681818181818182
RT_VERSION	0x15640	0x390	data	English	United States	0.46600877192982454
RT_MANIFEST	0x150f0	0x54b	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4154981549815498

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegQueryInfoKeyW, RegEnumKeyExW, RegOpenKeyExW, RegSetValueExW, RegCreateKeyExW, RegDeleteValueW, EventRegister, EventUnregister, EventWrite, RegQueryValueExW
KERNEL32.dll	CreateMutexW, HeapSetInformation, InitializeCriticalSection, GetModuleFileNameW, FindResourceExW, LoadResource, SizeofResource, WaitForSingleObject, lstrcmpiW, GetModuleHandleW, LoadLibraryExW, GetProcAddress, FreeLibrary, GetLastError, ReleaseMutex, CloseHandle, CreateFileW, GetCurrentProcessId, LockResource, FindResourceW, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, LocalFree, FormatMessageW, GetSystemDirectoryW, WriteFile, WideCharToMultiByte, GetSystemTime, CopyFileW, MultiByteToWideChar, EnterCriticalSection, LeaveCriticalSection, RaiseException, DeleteCriticalSection, GetSystemTimeAsFileTime, GetCurrentThreadId, GetTickCount, OutputDebugStringA, TerminateProcess, SetUnhandledExceptionFilter, HeapFree, VirtualFree, GetCurrentProcess, VirtualAlloc, LoadLibraryExA, EncodePointer, HeapAlloc, DecodePointer, IsProcessorFeaturePresent, GetProcessHeap, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, Sleep, GetStartupInfoW, UnhandledExceptionFilter, QueryPerformanceCounter
GDI32.dll	StretchBlt, CreateCompatibleBitmap, SetStretchBltMode, SelectObject, CreateCompatibleDC, GetObjectW, GetTextExtentPoint32W, SetDeviceGammaRamp, GetDeviceGammaRamp, GetStockObject, SetBkMode, SetBkColor, SetTextColor, CreateSolidBrush, GetDeviceCaps, CreateDCW, DeleteDC, DeleteObject
USER32.dll	LoadStringW, GetWindow, ShowWindow, MessageBoxW, ReleaseDC, GetWindowTextW, GetWindowTextLengthW, GetDC, KillTimer, SetTimer, SetWindowTextW, PostMessageW, MapDialogRect, EnumChildWindows, DisplayConfigGetDeviceInfo, QueryDisplayConfig, GetDisplayConfigBufferSizes, EnumDisplayDevicesW, ShowCursor, LoadCursorW, SetCursor, GetMonitorInfoW, EnumDisplayMonitors, MonitorFromWindow, GetParent, InvalidateRect, MapWindowPoints, GetWindowRect, GetDlgItem, DefWindowProcW, SendMessageW, CallWindowProcW, SetWindowPos, SetForegroundWindow, OpenIcon, SetWindowLongW, GetWindowLongW, MonitorFromRect, SendMessageTimeoutW, AllowSetForegroundWindow, GetWindowThreadProcessId, FindWindowW, RegisterWindowMessageW, GetActiveWindow, GetSystemMetrics, CharNextW, DestroyWindow, UnregisterClassA, MoveWindow
msvcrt.dll	_ftol2, memcpy, _controlfp, ?terminate@@YAXXZ, realloc, _errno, _onexit, __dllonexit, _unlock, _lock, _except_handler4_common, _wcmdln, _initterm, __setusermatherr, __p__fmode, _cexit, _exit, exit, __set_app_type, __wgetmainargs, _amsg_exit, __p__commode, _XcptFilter, _callnewh, swscanf_s, wcsstr, _wcsupr, _purecall, memcpy_s, malloc, wcsncpy_s, free, _ftol2_sse, _vsnwprintf, towlower, iswupper, _CIpow, memset
ntdll.dll	WinSqmAddToStream
dxva2.dll	GetNumberOfPhysicalMonitorsFromHMONITOR, GetPhysicalMonitorsFromHMONITOR, DestroyPhysicalMonitors, GetMonitorBrightness, SetMonitorBrightness, GetMonitorContrast, SetMonitorContrast, GetVCPFeatureAndVCPFeatureReply, SetVCPFeature
mscms.dll	GetColorProfileFromHandle, UninstallColorProfileW, WcsCreateIccProfile, GetColorDirectoryW, InstallColorProfileW, CloseColorProfile, DccwSetDisplayProfileAssociationList, WcsGetUsePerUserProfiles, WcsGetDefaultColorProfile, WcsOpenColorProfileW, DccwGetGamutSize, DccwCreateDisplayProfileAssociationList, DccwGetDisplayProfileAssociationList, WcsGetCalibrationManagementState, SetColorProfileElement, SetColorProfileElementSize, DccwReleaseDisplayProfileAssociationList, WcsDisassociateColorProfileFromDevice, WcsSetCalibrationManagementState, WcsSetDefaultColorProfile
SHELL32.dll	ShellExecuteW
GDIPLUS.dll	GdipCreateHBITMAPFromBitmap, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipFree, GdipCreateLineBrushI, GdipFillRectangleI, GdipCloneBrush, GdipAlloc, GdipDeleteBrush, GdipCreateSolidFill, GdipDeleteGraphics, GdipCreateFromHDC, GdiplusShutdown, GdiplusStartup
COMCTL32.dll	TaskDialogIndirect, DestroyPropertySheetPage, CreatePropertySheetPageW, PropertySheetW
OLEAUT32.dll	SysFreeString, VarUI4FromStr, SysAllocString
api-ms-win-core-com-l1-1-0.dll	CoTaskMemRealloc, CoTaskMemFree, CreateStreamOnHGlobal, CoTaskMemAlloc, StringFromCLSID, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	02:37:02
Start date:	27/10/2024
Path:	C:\Users\user\Desktop\Yu4oufkUC8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Yu4oufkUC8.exe"
Imagebase:	0xf30000
File size:	454'452 bytes
MD5 hash:	A15F95B58098883533E018A0F90564BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.5%
Total number of Nodes:	1562
Total number of Limit Nodes:	24

Executed Functions

Function 00F36166 Relevance: 37.4, APIs: 16, Strings: 5, Instructions: 627
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(00000000,00000001,Local\DCCW Startup Mutex,00000000,00000000,00000000,?,?,?,?,?,00F33D49,00000000), ref: 00F36185
GetLastError.KERNEL32(?,?,?,?,?,00F33D49,00000000), ref: 00F36194
WaitForSingleObject.KERNEL32(00002710,?,?,?,?,?,00F33D49,00000000), ref: 00F361AC
RegisterWindowMessageW.USER32(Microsoft.Windows.ICM.DCCW.Activate,?,?,?,?,?,00F33D49,00000000), ref: 00F361B7
FindWindowW.USER32(NativeHWNDHost,00F428C8), ref: 00F361E8
GetWindowThreadProcessId.USER32(00000000,00F33D49), ref: 00F361FC
AllowSetForegroundWindow.USER32(00F33D49), ref: 00F36205
SendMessageTimeoutW.USER32(00000000,00000000,00000000,00000002,00002710,?), ref: 00F36221
RegisterWindowMessageW.USER32(00F323E8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F367CB
GetLastError.KERNEL32 ref: 00F367EC
WcsGetCalibrationManagementState.MSCMS(?), ref: 00F36808
GetLastError.KERNEL32 ref: 00F36812
WcsSetCalibrationManagementState.MSCMS(00000000), ref: 00F3683D
GetLastError.KERNEL32 ref: 00F36847
ReleaseMutex.KERNEL32(000001D0), ref: 00F3687A
CloseHandle.KERNEL32 ref: 00F36886

Part of subcall function 00F402FE: malloc.MSVCRT ref: 00F40316

Part of subcall function 00F3C11C: CreateSolidBrush.GDI32(00787878), ref: 00F3C179

Part of subcall function 00F402FE: _callnewh.MSVCRT ref: 00F40309

Part of subcall function 00F3A74B: memset.MSVCRT ref: 00F3A772
Part of subcall function 00F3A74B: CreateSolidBrush.GDI32(00AAAAAA), ref: 00F3A80B

Strings

Microsoft.Windows.ICM.DCCW.Activate, xrefs: 00F361B2
Local\DCCW Startup Mutex, xrefs: 00F36175
dccw, xrefs: 00F3622B
NativeHWNDHost, xrefs: 00F361E3
strg, xrefs: 00F361CD

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$ErrorLast$CreateMessage$BrushCalibrationManagementMutexRegisterSolidState$AllowCloseFindForegroundHandleObjectProcessReleaseSendSingleThreadTimeoutWait_callnewhmallocmemset
String ID: Local\DCCW Startup Mutex$Microsoft.Windows.ICM.DCCW.Activate$NativeHWNDHost$dccw$strg
API String ID: 2331678428-2660824010
Opcode ID: b4aff9a1daf8bbe3fd7ddd227c084a9eeaf26111a8c47d8a33bb96237656d8d7
Instruction ID: d010e033e792c7b99d4bbf7cf732a7a81564d704089ded3b7961e417a675e71c
Opcode Fuzzy Hash: b4aff9a1daf8bbe3fd7ddd227c084a9eeaf26111a8c47d8a33bb96237656d8d7
Instruction Fuzzy Hash: 2402B532F81A3677EB291A648C56F3E79519B45B70F05822DBE02FB2C1DEA89D0077D1

Function 00F33BBD Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 171
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00F33BD7

Part of subcall function 00F35F21: GetCurrentThreadId.KERNEL32 ref: 00F35F5D

EventRegister.ADVAPI32(00F31F40,00000000,00000000,00F42858), ref: 00F33BF3
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00F33C14
GetSystemMetrics.USER32(00001000), ref: 00F33C92
memset.MSVCRT ref: 00F33CDC

Part of subcall function 00F4002C: FormatMessageW.KERNEL32(00000500,?,00000000,00000000,00000137,00000000,?,67727473,?,?,?,00F33C64,?,?,00000000), ref: 00F40052
Part of subcall function 00F4002C: LocalFree.KERNEL32(00000000,00000137,?,?,?,00F33C64,?,?,00000000), ref: 00F40075

memset.MSVCRT ref: 00F33D0B
GetActiveWindow.USER32 ref: 00F33D4F
PropertySheetW.COMCTL32(?,?,?), ref: 00F33D91

Part of subcall function 00F3E8E3: EventWrite.ADVAPI32(00F31F20,00000001,?,?,00F368A9,00000000), ref: 00F3E944
Part of subcall function 00F3E8E3: MessageBoxW.USER32(00000000,00000000,00F428C8,00000010), ref: 00F3E973

GdiplusShutdown.GDIPLUS(?), ref: 00F33DBF
EventUnregister.ADVAPI32(032F6098,0000002B), ref: 00F33DD9

Strings

strg, xrefs: 00F33C2B

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Event$GdiplusMessagememset$ActiveCurrentFormatFreeHeapInformationLocalMetricsPropertyRegisterSheetShutdownStartupSystemThreadUnregisterWindowWrite
String ID: strg
API String ID: 299502029-3320446829
Opcode ID: a1bcaa843d24192e9aae1137676faac8775d58c40fea459de62dddf2d98d6ae7
Instruction ID: da410cd8636b17af24cf20f5279239fbc04dbe3f8e355f52621416eb8bf68856
Opcode Fuzzy Hash: a1bcaa843d24192e9aae1137676faac8775d58c40fea459de62dddf2d98d6ae7
Instruction Fuzzy Hash: 1F51B175908359ABC361EF64CC4595FBBE8EF80774F004A2DFC8592291DB38DE04AB92

Function 00F403E9 Relevance: 10.6, APIs: 7, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32(?,00F40FF0,00000058), ref: 00F403FE
Sleep.KERNEL32(000003E8), ref: 00F40433
_amsg_exit.MSVCRT ref: 00F40448
_initterm.MSVCRT ref: 00F4049C
__IsNonwritableInCurrentImage.LIBCMT ref: 00F404C8
exit.KERNELBASE ref: 00F4054B

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_inittermexit
String ID:
API String ID: 2849151604-0
Opcode ID: e8b8b8ec1c3b5c124040568d2292864fb7ff18458163e1bc3ad51ba96151a5d3
Instruction ID: f982244cc904207426be02da408c839175820f532e2dc4e3db88be65f958b754
Opcode Fuzzy Hash: e8b8b8ec1c3b5c124040568d2292864fb7ff18458163e1bc3ad51ba96151a5d3
Instruction Fuzzy Hash: 1E41DD7AE003198FEB69DB64AC047697AA0FB55770F68403AEF01972A0DF788840FB50

Function 00F3F064 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator,00000000,00020019,00F33CC0,00000000,00000000,00000000,?,?,?,00F33CC0), ref: 00F3F094
RegQueryValueExW.ADVAPI32(00F33CC0,UseSimulator,00000000,?,?,?,?,?,?,00F33CC0), ref: 00F3F0B5
RegCloseKey.ADVAPI32(00F33CC0,?,?,?,00F33CC0), ref: 00F3F0D6

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator, xrefs: 00F3F081
UseSimulator, xrefs: 00F3F0AD

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator$UseSimulator
API String ID: 3677997916-1182467772
Opcode ID: e04fca8b800e765c13423050bc07997bb236ad8e1f9358e3777cd6edd4c206f0
Instruction ID: 569c90e7ff2ce2fae17e3ab2d83c279cac06002ad26223fa68bc97e662b5a392
Opcode Fuzzy Hash: e04fca8b800e765c13423050bc07997bb236ad8e1f9358e3777cd6edd4c206f0
Instruction Fuzzy Hash: FF118BB6D4021CFBDB21CB999C859DEBFB8EF44724F104277F900A6052D7B08A48EA90

Function 00F3A74B Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00F3A772
CreateSolidBrush.GDI32(00AAAAAA), ref: 00F3A80B

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: BrushCreateSolidmemset
String ID:
API String ID: 1302505579-0
Opcode ID: 899007536a891ddad25acab0a43f74a9acacf6667af4c28d903aaba2a227908f
Instruction ID: 8b949d7cbbbe1aff196696ac13ccb216a09dff1d9f508b6c0ea197dd504fd624
Opcode Fuzzy Hash: 899007536a891ddad25acab0a43f74a9acacf6667af4c28d903aaba2a227908f
Instruction Fuzzy Hash: DB31E0B0A01A06BFD345CF2AD985681FBE4FF19314F50822AE968C7A51D7B0B464EBD0

Function 00F402FE Relevance: 3.0, APIs: 2, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_callnewh.MSVCRT ref: 00F40309
malloc.MSVCRT ref: 00F40316

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: _callnewhmalloc
String ID:
API String ID: 2285944120-0
Opcode ID: 827a41add3e7882cda66cdcc4134e2c9379e0503a851913f5d561a6cac6c916e
Instruction ID: d95c9fe137f9fae1cdde6fb2eb8d66c1453f1f10ea01907183e9bba6862477bd
Opcode Fuzzy Hash: 827a41add3e7882cda66cdcc4134e2c9379e0503a851913f5d561a6cac6c916e
Instruction Fuzzy Hash: 53D0A937A0122A338A212DA9EC00AAABF08CA417B03184031FF08AE166DE39CC00B2C0

Function 00F3FE77 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F402FE: malloc.MSVCRT ref: 00F40316

LoadStringW.USER32(00F361E0,?,00000000,00000400), ref: 00F3FE9A

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: LoadStringmalloc
String ID:
API String ID: 905986743-0
Opcode ID: 89718e697548feed4913527672ad6b74b06d4ed4a38415b777a86be925f35740
Instruction ID: e7243fff710e2cfcdb4a8d9fa55fa7009255de98467fba87835db571d796a401
Opcode Fuzzy Hash: 89718e697548feed4913527672ad6b74b06d4ed4a38415b777a86be925f35740
Instruction Fuzzy Hash: B8012633B410547BDB242528AC0AE2F7E489B813B0F14813EFF0ACF5E2DD64C880B1A4

Function 00F403B0 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00F403D4

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: a5ee632212a8dcf6fef7ade4e9261f2aa91f131dfd595a7831c21fc73fbe16cf
Instruction ID: b4be94632a8c2735e2a2ef528a3b2cb7796999d5cd715d81a648bc5e10c1143c
Opcode Fuzzy Hash: a5ee632212a8dcf6fef7ade4e9261f2aa91f131dfd595a7831c21fc73fbe16cf
Instruction Fuzzy Hash: E1D0E9B8A41208AB87C4AF64AD268263EB0AA667067CD0179FC015117AE6629750FF57

Non-executed Functions

Function 00F3EDC2 Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 227
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetObjectW.GDI32(?,00000018,?), ref: 00F3EE1B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EE33
GetWindowRect.USER32(?,?), ref: 00F3EE55
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EE78
GetDC.USER32(?), ref: 00F3EE96
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EEA5
CreateCompatibleDC.GDI32(00000000), ref: 00F3EEC3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EECF
SelectObject.GDI32(00000000,?), ref: 00F3EEF0
CreateCompatibleDC.GDI32(?), ref: 00F3EF01
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EF0E
SetStretchBltMode.GDI32(00000000,00000003), ref: 00F3EF31
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EF3B
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00F3EF61
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EF6D
SelectObject.GDI32(?,00000000), ref: 00F3EF8A
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00F3EFB6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F3767F,?), ref: 00F3EFC0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00F3EFE4
DeleteObject.GDI32(00000000), ref: 00F3EFFE
ReleaseDC.USER32(?,?), ref: 00F3F00F
DeleteDC.GDI32(00000000), ref: 00F3F01A
DeleteDC.GDI32(?), ref: 00F3F028
DeleteObject.GDI32(00000000), ref: 00F3F037

Strings

SendMessage(STM_SETIMAGE, 0x%08x) returned 0x%08x, xrefs: 00F3EFEC

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast$Object$Delete$CompatibleCreate$SelectStretch$BitmapMessageModeRectReleaseSendWindow
String ID: SendMessage(STM_SETIMAGE, 0x%08x) returned 0x%08x
API String ID: 1596057509-2907994607
Opcode ID: 0b9b73e8478c4b96c9da05ea2495ab50a9a6ae4cd7cb4d1c7d81de179cb426b4
Instruction ID: 4327b874f91a55eb4da3f85bcbb7d4e04b9a01afbc510124c8cb6314f0717ccd
Opcode Fuzzy Hash: 0b9b73e8478c4b96c9da05ea2495ab50a9a6ae4cd7cb4d1c7d81de179cb426b4
Instruction Fuzzy Hash: D671A87AD002299BDB258FADDD44AAEBEB4AF58730F110134FD05F7251DB34DD00AAA0

Function 00F35245 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 457
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F35132
Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3514F
Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F35162
Part of subcall function 00F350F7: CharNextW.USER32(00000027,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3516D

lstrcmpiW.KERNEL32(?,Delete,?,?,00000000,00000000,?,00F35944,?,00000000,00000000,00000000,?), ref: 00F352B8
lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000,00000000,?,00F35944,?,00000000,00000000,00000000,?), ref: 00F352CD
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,00F35944,?,00000000,00000000,00000000,?), ref: 00F3536B
lstrcmpiW.KERNEL32(?,NoRemove,?,?,00000000,00000000,?,00F35944,?,00000000,00000000,00000000,?), ref: 00F35392
lstrcmpiW.KERNEL32(?,Val,?,00000000,00000000,?,00F35944,?,00000000,00000000,00000000,?), ref: 00F353B6
RegDeleteValueW.ADVAPI32(?,?,?,00000000,00020006,?,?), ref: 00F35482
RegCloseKey.ADVAPI32(?), ref: 00F3549A
RegCreateKeyExW.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,00020019,?,?,0002001F), ref: 00F3551F
RegCloseKey.ADVAPI32(?,?,00000000,00000000,?,00F35944,?,00000000,00000000,00000000,?), ref: 00F35535
wcsncpy_s.MSVCRT ref: 00F35628

Part of subcall function 00F35245: RegCloseKey.ADVAPI32(?,?,?), ref: 00F3572E
Part of subcall function 00F35245: RegCloseKey.ADVAPI32(?,?,00000000,00020006,?,?), ref: 00F357AA

Strings

ForceRemove, xrefs: 00F352C0
Val, xrefs: 00F353B0
Delete, xrefs: 00F352AA
NoRemove, xrefs: 00F3538C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Close$CharNextlstrcmpi$CreateDeleteValuewcsncpy_s
String ID: Delete$ForceRemove$NoRemove$Val
API String ID: 670805417-1781481701
Opcode ID: 9f4ad957a861a09925564f3bdfb17ec5d84c8586d9e559574d96949b3a56e2fa
Instruction ID: d344781aa9f2e1d4528f212e9fdabb80376869a92ce4c47ddf148d9fb19944b6
Opcode Fuzzy Hash: 9f4ad957a861a09925564f3bdfb17ec5d84c8586d9e559574d96949b3a56e2fa
Instruction Fuzzy Hash: FDE1AC71A08B129BC7249F24C895A2FB7E8AFC4F74F04492DF94597241EB74DD40EBA2

Function 00F3596D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00000022), ref: 00F359A8
FindResourceExW.KERNEL32(00000000,?,?,00000000), ref: 00F359C5
FreeLibrary.KERNEL32(00000000), ref: 00F35A89

Part of subcall function 00F34658: GetLastError.KERNEL32(00F359D6), ref: 00F34658

Strings

REGISTRY, xrefs: 00F35CA3
Module_Raw, xrefs: 00F35C77
Module, xrefs: 00F35C57

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Library$ErrorFindFreeLastLoadResource
String ID: Module$Module_Raw$REGISTRY
API String ID: 3418355812-549000027
Opcode ID: 4d28a4d2755a112b6bb682af8b08d65b82d5720044c4205a31a4c6acb525a7c0
Instruction ID: 4e3ab6b5f78cb4badd0e045eb139b3c3fece0c2b3d2cd25309767c1085efbf46
Opcode Fuzzy Hash: 4d28a4d2755a112b6bb682af8b08d65b82d5720044c4205a31a4c6acb525a7c0
Instruction Fuzzy Hash: 5131C7B590051DABCF24DF14CC85BAE76B8DF95B70F1042A9FA05A7240DB349E81BBA4

Function 00F40138 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61commemoryCOMMON

Download Yara Rule

APIs

CoCreateInstance.API-MS-WIN-CORE-COM-L1-1-0(00F33658,00000000,00000017,00F33668,?,?,00000001), ref: 00F4015B
SysAllocString.OLEAUT32(mshelp://windows/?id=27a2764a-ad05-4a52-96f4-eac32ae3c9e1), ref: 00F4016C
WinSqmAddToStream.NTDLL(00000000,0000038F,00000001,00000053), ref: 00F40199
SysFreeString.OLEAUT32(00000000), ref: 00F401CD

Strings

COLOR_MANAGEMENT_CALIBRATE_DISPLAY, xrefs: 00F40182
mshelp://windows/?id=27a2764a-ad05-4a52-96f4-eac32ae3c9e1, xrefs: 00F40167

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: String$AllocCreateFreeInstanceStream
String ID: COLOR_MANAGEMENT_CALIBRATE_DISPLAY$mshelp://windows/?id=27a2764a-ad05-4a52-96f4-eac32ae3c9e1
API String ID: 148082582-1466657646
Opcode ID: bc093a112dbd0dfda0d218cbc56b13d0c41e400df1820818ba817a78582079d5
Instruction ID: c5e8d830dd40e5307822141c0a3d24843bdd4d9ff40b9ca772f8ff76d9394a82
Opcode Fuzzy Hash: bc093a112dbd0dfda0d218cbc56b13d0c41e400df1820818ba817a78582079d5
Instruction Fuzzy Hash: F9115135B40218BFD7109B949C49E6E7BF8DB99B61F204059FD05A7290CFB09E00AB51

Function 00F40CC9 Relevance: 7.6, APIs: 5, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00F40CF6
GetCurrentProcessId.KERNEL32 ref: 00F40D05
GetCurrentThreadId.KERNEL32 ref: 00F40D0E
GetTickCount.KERNEL32 ref: 00F40D17
QueryPerformanceCounter.KERNEL32(?), ref: 00F40D2C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 3e43234ad3b8bc5380b71e6fffb110ee1da13940d5884bc3009fd15790e3a647
Instruction ID: 2b6905cc4ebd9dfd6bd514a759297860eb9a14f4d9083719792a2c4e64cb2b23
Opcode Fuzzy Hash: 3e43234ad3b8bc5380b71e6fffb110ee1da13940d5884bc3009fd15790e3a647
Instruction Fuzzy Hash: 2D11EC75D01218EBDB14DFF8EA4869EBBF4EFA9311F610565ED01E7250EA309B04EB40

Function 00F3F7EE Relevance: 7.5, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00F3F721,00000000,00000000,00F3F911,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F7F0
GetProcessHeap.KERNEL32(00000008,00000008,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F816
HeapAlloc.KERNEL32(00000000,?,00000000,?,00F36DFD,?), ref: 00F3F81D
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F838
HeapFree.KERNEL32(00000000,?,00000000,?,00F36DFD,?), ref: 00F3F83F

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreePresentProcessor
String ID:
API String ID: 53968077-0
Opcode ID: f7f9329e44bd304cce319582fc51744938fdd940ecb66e03f459ca2a8f5739fb
Instruction ID: 312ad0845bd966d0dddddc9ce87a99c559fd65691362b15934e54f700c3abed1
Opcode Fuzzy Hash: f7f9329e44bd304cce319582fc51744938fdd940ecb66e03f459ca2a8f5739fb
Instruction Fuzzy Hash: 10F03079E512069BEB549F799C08B1637A9BFA6725F048438FE85C7294EB30C840EB50

Function 00F407FD Relevance: 6.0, APIs: 4, Instructions: 13COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00F40939,00F31004), ref: 00F40804
UnhandledExceptionFilter.KERNEL32(00F40939,?,00F40939,00F31004), ref: 00F4080D
GetCurrentProcess.KERNEL32(C0000409,?,00F40939,00F31004), ref: 00F40818
TerminateProcess.KERNEL32(00000000,?,00F40939,00F31004), ref: 00F4081F

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: d95f6cc759eb77a0727898af8f7f8e6e826d9b31067cfb77ae187139d7e2869e
Instruction ID: ad1007c3364f31f71ab8d47f383af6bca2bfc200b54355a4fe6aaf6533742e52
Opcode Fuzzy Hash: d95f6cc759eb77a0727898af8f7f8e6e826d9b31067cfb77ae187139d7e2869e
Instruction Fuzzy Hash: 5DD0123680020CBBCB002BF1ED0CA097F28FBD6312F584000FB0982021CF325601AB65

Function 00F3F8CD Relevance: 5.0, APIs: 4, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,00F37016,?,00000000,?,00F36DFD,?), ref: 00F3F8D4
HeapAlloc.KERNEL32(00000000,?,00000000,?,00F36DFD,?), ref: 00F3F8DB
GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F91B
HeapFree.KERNEL32(00000000,?,00000000,?,00F36DFD,?), ref: 00F3F922

Part of subcall function 00F3F711: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,00000000,00F3F911,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F733
Part of subcall function 00F3F711: HeapAlloc.KERNEL32(00000000,?,00000000,?,00F36DFD,?), ref: 00F3F73A

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: dbf84f3ea75b535b5e4eae192e9a295286ff5ba1359f68d6fda89e3bf90cf8de
Instruction ID: 13bd32bca4c65155ea407b64c9ecab90834dcd6e6f09d282232e878f40d4ac6b
Opcode Fuzzy Hash: dbf84f3ea75b535b5e4eae192e9a295286ff5ba1359f68d6fda89e3bf90cf8de
Instruction Fuzzy Hash: 4AF0BE77E0561567DB612BB87C0CB6A3A68AFE2BB1F114038F94AC7244DF34C809B750

Function 00F4002C Relevance: 4.5, APIs: 3, Instructions: 42windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000500,?,00000000,00000000,00000137,00000000,?,67727473,?,?,?,00F33C64,?,?,00000000), ref: 00F40052
LocalFree.KERNEL32(00000000,00000137,?,?,?,00F33C64,?,?,00000000), ref: 00F40075
GetLastError.KERNEL32(?,?,?,00F33C64,?,?,00000000), ref: 00F4007D

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: 4258625ccc577a26486b4f197826b004297b45c6d1d17b8ee630d1d2ae33d2e6
Instruction ID: 71d080c88dc70c74b598b7976f8dad9ea68f9d381e01283989ea27a2d9e03eed
Opcode Fuzzy Hash: 4258625ccc577a26486b4f197826b004297b45c6d1d17b8ee630d1d2ae33d2e6
Instruction Fuzzy Hash: 2E01FB76C01128FBDB209B95CD09A9EBEB8EF45761F114166FD05A6150EA719F00EAE0

Function 00F40A80 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010A30), ref: 00F40A85

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ca3a5f43e89ec14964dc2afa0d44b6cbbdc34eed9f6debec3cd8e7b733bc05b8
Instruction ID: f7c2be4cf334b61c5ba2d05414571db05d49ac476accf04d0a265de7b2793cd1
Opcode Fuzzy Hash: ca3a5f43e89ec14964dc2afa0d44b6cbbdc34eed9f6debec3cd8e7b733bc05b8
Instruction Fuzzy Hash: 829002646612044646001B709D1990679905BA9602B950550A942C4055DF749100B512

Function 00F3BD3D Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F3A9ED: MapDialogRect.USER32(?,?), ref: 00F3AA1C
Part of subcall function 00F3A9ED: GetWindowRect.USER32(?,?), ref: 00F3AA42
Part of subcall function 00F3A9ED: EnumChildWindows.USER32(?,00F3AD30), ref: 00F3AABD
Part of subcall function 00F3A9ED: InvalidateRect.USER32(?,00000000,00000001), ref: 00F3AAC9

GetDlgItem.USER32(?,sx}), ref: 00F3BDB1

Part of subcall function 00F3EC08: GlobalAlloc.KERNEL32(00000002,?,?,?,?,00000000,?), ref: 00F3EC3C
Part of subcall function 00F3EC08: GetLastError.KERNEL32(?,00000000,?), ref: 00F3EC48
Part of subcall function 00F3EC08: GlobalLock.KERNEL32(00000000), ref: 00F3EC66
Part of subcall function 00F3EC08: GetLastError.KERNEL32(?,00000000,?), ref: 00F3EC72
Part of subcall function 00F3EC08: memcpy.MSVCRT(00000000,?,?,?,00000000,?), ref: 00F3EC96
Part of subcall function 00F3EC08: CreateStreamOnHGlobal.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000001,00000000,?,00000000,?), ref: 00F3ECA5
Part of subcall function 00F3EC08: GlobalUnlock.KERNEL32(00000000), ref: 00F3ECB2
Part of subcall function 00F3EC08: GlobalFree.KERNEL32(00000000), ref: 00F3ECB9

GetWindowRect.USER32(?,?), ref: 00F3BDEB
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3BE00
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 00F3BE08
_ftol2_sse.MSVCRT ref: 00F3BE6B
MoveWindow.USER32(?,?,?,?,?,00000000,?,00000005,?,?,00000001,?), ref: 00F3BE86
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 00F3BE90
InvalidateRect.USER32(?,00000000,00000000,?,?,00000005,?,?,00000001,?), ref: 00F3BECD
GetDlgItem.USER32(?,00000064), ref: 00F3BEDA
GetWindowRect.USER32(00000000,?), ref: 00F3BEE7
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3BEFC
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 00F3BF04
MoveWindow.USER32(00000000,?,?,?,?,00000001,?,00000005,?,?,00000001,?), ref: 00F3BF40
GetLastError.KERNEL32(?,00000005,?,?,00000001,?), ref: 00F3BF4A
DeleteObject.GDI32(00000000), ref: 00F3BF5C

Strings

}, xrefs: 00F3BD8B
n, xrefs: 00F3BDA0
i, xrefs: 00F3BD99
d, xrefs: 00F3BD92
sx}, xrefs: 00F3BDAA
x, xrefs: 00F3BD84

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$ErrorLastRect$Global$InvalidateItemMovePoints$AllocChildCreateDeleteDialogEnumFreeLockObjectStreamUnlockWindows_ftol2_ssememcpy
String ID: d$i$n$sx}$x$}
API String ID: 3487292329-3487999874
Opcode ID: 970bc4d4dbf6abbdf070924d56c2244a955d2466901508942a6763e0ffc67fcf
Instruction ID: e4e5cd226e601e8efb2110ab727ccccee10021c3b3f63b61c05c23210567293f
Opcode Fuzzy Hash: 970bc4d4dbf6abbdf070924d56c2244a955d2466901508942a6763e0ffc67fcf
Instruction Fuzzy Hash: 17712835E00219EFEB009FE4CD48BADBBB9FF44760F004015EA05AB264CB749A55EF60

Function 00F38AC0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 181
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F39D26: GetSystemTime.KERNEL32(?,000001F5,?,00000000), ref: 00F39DEA

WcsCreateIccProfile.MSCMS(?,00000000,?,?), ref: 00F38B0C
GetLastError.KERNEL32 ref: 00F38B1C
GetColorProfileFromHandle.MSCMS(00000000,00000000,?,?,?), ref: 00F38B51
GetLastError.KERNEL32 ref: 00F38B5B
GetColorProfileFromHandle.MSCMS(00000000,00000000,?), ref: 00F38BAC
GetLastError.KERNEL32 ref: 00F38BB6
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00F38BEF
GetLastError.KERNEL32 ref: 00F38BFC
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00F38C26
GetLastError.KERNEL32 ref: 00F38C41
CloseHandle.KERNEL32(00000000), ref: 00F38C5B
InstallColorProfileW.MSCMS(00000000,?), ref: 00F38C6D
GetLastError.KERNEL32 ref: 00F38C77
CloseHandle.KERNEL32(00000000), ref: 00F38CAE
CloseColorProfile.MSCMS(00000000,?,?), ref: 00F38CBF
CloseColorProfile.MSCMS(?,?,?), ref: 00F38CCE

Strings

strg, xrefs: 00F38C30

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLastProfile$Color$CloseHandle$CreateFileFrom$InstallSystemTimeWrite
String ID: strg
API String ID: 3772428985-3320446829
Opcode ID: 33392285533e0227b9530759b55e53afcecd0670deec1895a6b384cec1e2fb5d
Instruction ID: e74d16eea12e4342a57974a5e4db876e53cbb1e12d9fe40992046208f5477633
Opcode Fuzzy Hash: 33392285533e0227b9530759b55e53afcecd0670deec1895a6b384cec1e2fb5d
Instruction Fuzzy Hash: F151237A5043129BD3119F248D44B5BBAA6AFD43F0F210528FD55C7291EF38CA02BAB1

Function 00F3A1B6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000080,?,000000FF,00000000,00000000,00000000,00000000,00F30000,000001F7,00000000,00000000,00000000), ref: 00F3A253
GetLastError.KERNEL32 ref: 00F3A262

Part of subcall function 00F3FE77: LoadStringW.USER32(00F361E0,?,00000000,00000400), ref: 00F3FE9A

WideCharToMultiByte.KERNEL32(0000FDE9,00000080,?,000000FF,00000000,00000000,00000000,00000000), ref: 00F3A2A9
GetLastError.KERNEL32 ref: 00F3A2B3
memset.MSVCRT ref: 00F3A33A
memcpy.MSVCRT(00000004,?,?,00000000,00000000,?,00F30000,000001F7,00000000,00000000,00000000), ref: 00F3A35C
SetColorProfileElementSize.MSCMS(?,64657363,?,?,00F30000,000001F7,00000000,00000000,00000000), ref: 00F3A441
GetLastError.KERNEL32(?,00F30000,000001F7,00000000,00000000,00000000), ref: 00F3A44B
SetColorProfileElement.MSCMS(?,64657363,00000000,?,00000000,?,00F30000,000001F7,00000000,00000000,00000000), ref: 00F3A47A
GetLastError.KERNEL32(?,00F30000,000001F7,00000000,00000000,00000000), ref: 00F3A484

Strings

strg, xrefs: 00F3A37C, 00F3A3C4, 00F3A39B
strg, xrefs: 00F3A200
strg, xrefs: 00F3A21E
strg, xrefs: 00F3A1D8

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast$ByteCharColorElementMultiProfileWide$LoadSizeStringmemcpymemset
String ID: strg$strg$strg$strg
API String ID: 139363455-4050408924
Opcode ID: e0b78afcd72de1c5d8f0b4779ca36f7c1fd2977fdc7993c1ef3c2f6670a303c0
Instruction ID: 39ca4e8937cfef5edbdc7abd4dd70bb11db440880cbacb2393f8c30755de200b
Opcode Fuzzy Hash: e0b78afcd72de1c5d8f0b4779ca36f7c1fd2977fdc7993c1ef3c2f6670a303c0
Instruction Fuzzy Hash: DBA1D275E0021A9BCB04DFA9CC81AEEBBF5FF48320F144129E941B7361DB759941EB91

Function 00F39D26 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 235
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTime.KERNEL32(?,000001F5,?,00000000), ref: 00F39DEA
_CIpow.MSVCRT ref: 00F39ED5

Part of subcall function 00F3FE77: LoadStringW.USER32(00F361E0,?,00000000,00000400), ref: 00F3FE9A

_CIpow.MSVCRT ref: 00F39EF3
_CIpow.MSVCRT ref: 00F39F11
WcsOpenColorProfileW.MSCMS(00000002,?,00000000,00000001,00000001,00000003,00000000,</cdm:Calibration></cdm:ColorDeviceModel>), ref: 00F39FC7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F39FD6

Strings

D65.camp, xrefs: 00F39FA4
strg, xrefs: 00F39F8F
</cdm:Calibration></cdm:ColorDeviceModel>, xrefs: 00F39F60
strg, xrefs: 00F39D4C
<?xml version="1.0" encoding="utf-16"?><cdm:ColorDeviceModel%txmlns:cdm="http://schemas.microsoft.com/windows/2005/02/color/Colo, xrefs: 00F39E37
%4d-%02d-%02dT%02d:%02d:%02d, xrefs: 00F39E11
strg, xrefs: 00F39E71
<cal:AdapterGammaConfiguration><cal:ParameterizedCurves><wcs:RedTRC Gamma="%f" Gain="%f" Offset1="0.0"/><wcs:GreenT, xrefs: 00F39F2C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Ipow$ColorErrorLastLoadOpenProfileStringSystemTime
String ID: </cdm:Calibration></cdm:ColorDeviceModel>$<cal:AdapterGammaConfiguration><cal:ParameterizedCurves><wcs:RedTRC Gamma="%f" Gain="%f" Offset1="0.0"/><wcs:GreenT$%4d-%02d-%02dT%02d:%02d:%02d$<?xml version="1.0" encoding="utf-16"?><cdm:ColorDeviceModel%txmlns:cdm="http://schemas.microsoft.com/windows/2005/02/color/Colo$D65.camp$strg$strg$strg
API String ID: 1408563361-1103866935
Opcode ID: 0974120e9dfd2de7a3f45366f74e7bad180bba9e88d3d21f2553527b75fbe5eb
Instruction ID: 0b91586b7b7871a52af5f91ab9def98bad1b4658b5692db753281fd8f07d2573
Opcode Fuzzy Hash: 0974120e9dfd2de7a3f45366f74e7bad180bba9e88d3d21f2553527b75fbe5eb
Instruction Fuzzy Hash: E2916631D01219EBCB01EFA4D8859EEBFB5EF48320F110069F940BB265DB759D25EBA0

Function 00F391D3 Relevance: 24.2, APIs: 16, Instructions: 245COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F02), ref: 00F391F9
SetCursor.USER32(00000000), ref: 00F39200
ShowCursor.USER32(00000001), ref: 00F39208
GetNumberOfPhysicalMonitorsFromHMONITOR.DXVA2(?,?), ref: 00F39266
ShowCursor.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,00F37BA6,00000000), ref: 00F394AC
LoadCursorW.USER32(00000000,00007F00), ref: 00F394BA
SetCursor.USER32(00000000,?,?,?,?,?,?,?,?,?,?,?,00F37BA6,00000000), ref: 00F394C1

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Cursor$LoadShow$FromMonitorsNumberPhysical
String ID:
API String ID: 1684749270-0
Opcode ID: e8217179904455da15cc731133afab9341bcb1030e2f2389522ec63f80d5355e
Instruction ID: c9a3463bc82ae9945455859bf60eeb057d8d904b57a9d892e670d81b024be85a
Opcode Fuzzy Hash: e8217179904455da15cc731133afab9341bcb1030e2f2389522ec63f80d5355e
Instruction Fuzzy Hash: 9381E276A046229BC711CF74DC44A6EBBA5BF48730F15462AED02A7390DBF4ED01ABD1

Function 00F3EC08 Relevance: 22.6, APIs: 15, Instructions: 149memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3F117: FindResourceW.KERNEL32(00F30000,?,000001F4,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F13C
Part of subcall function 00F3F117: GetLastError.KERNEL32(?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F14B
Part of subcall function 00F3F117: LoadResource.KERNEL32(00F30000,00000000,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F166
Part of subcall function 00F3F117: GetLastError.KERNEL32(?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F172
Part of subcall function 00F3F117: SizeofResource.KERNEL32(00F30000,?,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F18F
Part of subcall function 00F3F117: LockResource.KERNEL32(00000000,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F19B

GlobalAlloc.KERNEL32(00000002,?,?,?,?,00000000,?), ref: 00F3EC3C
GetLastError.KERNEL32(?,00000000,?), ref: 00F3EC48
GlobalLock.KERNEL32(00000000), ref: 00F3EC66
GetLastError.KERNEL32(?,00000000,?), ref: 00F3EC72
memcpy.MSVCRT(00000000,?,?,?,00000000,?), ref: 00F3EC96
CreateStreamOnHGlobal.API-MS-WIN-CORE-COM-L1-1-0(00000000,00000001,00000000,?,00000000,?), ref: 00F3ECA5
GlobalUnlock.KERNEL32(00000000), ref: 00F3ECB2
GlobalFree.KERNEL32(00000000), ref: 00F3ECB9
GlobalUnlock.KERNEL32(00000000), ref: 00F3ECC5
GetLastError.KERNEL32(?,00000000,?), ref: 00F3ECCF
GdipAlloc.GDIPLUS(00000010,?,00000000,?), ref: 00F3ECF0
GdipCreateBitmapFromStream.GDIPLUS(00000000,?,?,00000000,?), ref: 00F3ED12
GdipCreateHBITMAPFromBitmap.GDIPLUS(00000000,00000110,FF000000,?,00000000,?), ref: 00F3ED2D
GetObjectW.GDI32(00000110,00000018,?), ref: 00F3ED68
GetLastError.KERNEL32(?,00000000,?), ref: 00F3ED86

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorGlobalLast$Resource$CreateGdip$AllocBitmapFromLockStreamUnlock$FindFreeLoadObjectSizeofmemcpy
String ID:
API String ID: 4269010864-0
Opcode ID: 9e9c75e978a089fff32df3017b6c7ea06d4dca55e857eb0c02723707ff8e0915
Instruction ID: 1661d3215e345b862b096b0f20ed471ac692f463cda9c018aff1ee4c25c2ffb2
Opcode Fuzzy Hash: 9e9c75e978a089fff32df3017b6c7ea06d4dca55e857eb0c02723707ff8e0915
Instruction Fuzzy Hash: FC51707BD0062AABC7219B9AC9447AEBBB8BF54771F114114ED55F7280DB34DE00ABA0

Function 00F3DC75 Relevance: 21.2, APIs: 14, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F37505
Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F3751D
Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F37535
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3754E
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3755F
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F37570
Part of subcall function 00F374D3: _ftol2_sse.MSVCRT ref: 00F37602

GetWindowRect.USER32(?,?), ref: 00F3DCB6
GetWindowRect.USER32(?,?), ref: 00F3DCCE
GetWindowRect.USER32(?,?), ref: 00F3DCE6
_ftol2_sse.MSVCRT ref: 00F3DD2C
_ftol2_sse.MSVCRT ref: 00F3DD4B
_ftol2_sse.MSVCRT ref: 00F3DD5F
_ftol2_sse.MSVCRT ref: 00F3DD87
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 00F3DDA0
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 00F3DDB6
_ftol2_sse.MSVCRT ref: 00F3DDCB
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 00F3DDED
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 00F3DE06
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 00F3DE27
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,00000001,?,?), ref: 00F3DE3D

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$MoveRect_ftol2_sse$Points
String ID:
API String ID: 4142400812-0
Opcode ID: 60b64b61222d26a1709b4534525d1cbd3155479191b5654670fe682d6e3be8e9
Instruction ID: ef9814b0cd1bf528c31639647530738e7f2d6ba7fa8e5bbbe476a3f694e8ab42
Opcode Fuzzy Hash: 60b64b61222d26a1709b4534525d1cbd3155479191b5654670fe682d6e3be8e9
Instruction Fuzzy Hash: E8513672E00208FFCB119FA0EC49AADBFBAEF48720F154528F505A2264DB715A61EF50

Function 00F394E3 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,00000068), ref: 00F39519
GetLastError.KERNEL32(?,?,?), ref: 00F39523
EnumDisplayDevicesW.USER32(?,00000000,?,00000000), ref: 00F39557
GetLastError.KERNEL32(?,?,?), ref: 00F39561
StringFromCLSID.API-MS-WIN-CORE-COM-L1-1-0(00F3343C,?,?,?,?), ref: 00F3958A
_wcsupr.MSVCRT ref: 00F3959D
wcsstr.MSVCRT ref: 00F395B0
swscanf_s.MSVCRT ref: 00F395FB
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(00000000,?,?,?), ref: 00F3961D

Strings

%04d, xrefs: 00F395F2
h, xrefs: 00F394FD

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast$DevicesDisplayEnumFreeFromInfoMonitorStringTask_wcsuprswscanf_swcsstr
String ID: %04d$h
API String ID: 4201562086-3314846054
Opcode ID: 5d9ccf1bdbc0b22a285243571476b7e622a2d6a63704ecc1f936967eee74e0fb
Instruction ID: 982ef7c97020646eb1fb68bb28d595598d1a2e60717a09a8dee69e01e5b3a916
Opcode Fuzzy Hash: 5d9ccf1bdbc0b22a285243571476b7e622a2d6a63704ecc1f936967eee74e0fb
Instruction Fuzzy Hash: 2031917AC052289BCB229F64DC49AADB7B8FF44724F0501A9ED05E7204DBB0DF45DB90

Function 00F374D3 Relevance: 18.2, APIs: 12, Instructions: 169COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F37505
GetWindowRect.USER32(?,?), ref: 00F3751D
GetWindowRect.USER32(?,?), ref: 00F37535
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3754E
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3755F
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F37570
_ftol2_sse.MSVCRT ref: 00F37602
_ftol2_sse.MSVCRT ref: 00F37617
_ftol2_sse.MSVCRT ref: 00F3762E
MoveWindow.USER32(?,?,?,-00000001,?,00000000,?,00000001,?), ref: 00F37661
InvalidateRect.USER32(?,00000000,00000000,?,?,00000001,?), ref: 00F37689
InvalidateRect.USER32(?,00000000,00000001,?,00000001,?), ref: 00F376B3

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$Rect$Points_ftol2_sse$Invalidate$Move
String ID:
API String ID: 3848721580-0
Opcode ID: c1f823d832c2bcaa54607033b90152def89bc002f91660361759d85c9ce9601a
Instruction ID: f34c98088187bc1f101b299737fed495d3db78d3b22dea2509155ab8249340a1
Opcode Fuzzy Hash: c1f823d832c2bcaa54607033b90152def89bc002f91660361759d85c9ce9601a
Instruction Fuzzy Hash: C2616871E00208EFCB149FA4DD89BEDBFB9FF48310F058068E905AA2A5DB709955DF60

Function 00F401E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

iswupper.MSVCRT ref: 00F40217
towlower.MSVCRT ref: 00F40226
iswupper.MSVCRT ref: 00F40234
towlower.MSVCRT ref: 00F40240
iswupper.MSVCRT ref: 00F40278
towlower.MSVCRT ref: 00F40287
iswupper.MSVCRT ref: 00F40295
towlower.MSVCRT ref: 00F402A1

Strings

{4D36E96E-E325-11CE-BFC1-08002BE10318}, xrefs: 00F401FC, 00F4020B

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: iswuppertowlower
String ID: {4D36E96E-E325-11CE-BFC1-08002BE10318}
API String ID: 2404469642-206008433
Opcode ID: d1e16aa32c62e3d0cb72032a6226222131eaa6d7d17eae429ad45ce9f7a412d8
Instruction ID: f2ff0a2dd335157a680083c309cf887524842046b795ae76549299442cc02059
Opcode Fuzzy Hash: d1e16aa32c62e3d0cb72032a6226222131eaa6d7d17eae429ad45ce9f7a412d8
Instruction Fuzzy Hash: 84316B76D002159B8B259FA9D8485BA7BF5EBA9321314006AFD81D72C0EEB4CF40F760

Function 00F35046 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(API-MS-Win-Core-LocalRegistry-L1-1-0.dll,?,00000000,?,?,00F34FD9,?), ref: 00F35061
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00F35071
LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000000,?,00F34FD9,?), ref: 00F35083
GetProcAddress.KERNEL32(00000000,RegDeleteKeyW), ref: 00F35093
GetLastError.KERNEL32(?,00000000,?,?,00F34FD9,?), ref: 00F350CE

Strings

API-MS-Win-Core-LocalRegistry-L1-1-0.dll, xrefs: 00F3505C
advapi32.dll, xrefs: 00F3507E
RegDeleteKeyExW, xrefs: 00F3506B
RegDeleteKeyW, xrefs: 00F3508D

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: AddressProc$ErrorHandleLastLibraryLoadModule
String ID: API-MS-Win-Core-LocalRegistry-L1-1-0.dll$RegDeleteKeyExW$RegDeleteKeyW$advapi32.dll
API String ID: 856554993-2654589138
Opcode ID: f939e8c07fb93d4375fa5ba7c7ed8cc1dcdb094a791c39017287875bfc1f916e
Instruction ID: 5e07d05bc77830a5f747beae56c3245957b3d8563d00f468791dab91adde8d35
Opcode Fuzzy Hash: f939e8c07fb93d4375fa5ba7c7ed8cc1dcdb094a791c39017287875bfc1f916e
Instruction Fuzzy Hash: 1911CCB5A0470AEF97346F64DC4592BBB6DFBD1FB47244029F84692120DA72DC00FB60

Function 00F3B6C3 Relevance: 15.2, APIs: 10, Instructions: 153COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F3B6F5
GetWindowRect.USER32(?,?), ref: 00F3B70D
GetWindowRect.USER32(?,?), ref: 00F3B725
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00F3B778
_ftol2_sse.MSVCRT ref: 00F3B796
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00F3B7D3
MoveWindow.USER32(?,?,?,00000010,?,00000001), ref: 00F3B7ED
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 00F3B82A
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 00F3B854
InvalidateRect.USER32(?,00000000,00000001), ref: 00F3B861

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$Move$Rect$Invalidate_ftol2_sse
String ID:
API String ID: 1052920605-0
Opcode ID: e4f1f606ef4d486468808425aa794dc482c9becfbc9d93d3e1d2b71bb6135f78
Instruction ID: 0b536255115d7612c4bdba21ee6a7efe1b04fadae8da2da8be985587648fbecf
Opcode Fuzzy Hash: e4f1f606ef4d486468808425aa794dc482c9becfbc9d93d3e1d2b71bb6135f78
Instruction Fuzzy Hash: A3514E75B00619AFDB148FB9DC89BEDBBB9FF04310F044228F919E22A4DB71A951DB50

Function 00F39B02 Relevance: 15.1, APIs: 10, Instructions: 119COMMON

Download Yara Rule

APIs

WcsSetCalibrationManagementState.MSCMS(00000001,?,?,00000000), ref: 00F39B18
GetLastError.KERNEL32(?,?,00000000), ref: 00F39B22
WcsSetDefaultColorProfile.MSCMS(00000000,?,00000000,00000004,00000000,?,?,?,00000000), ref: 00F39B64
GetLastError.KERNEL32(?,?,00000000), ref: 00F39B6E
WcsGetUsePerUserProfiles.MSCMS(?,6D6E7472,?,?,?,00000000), ref: 00F39B9C
GetLastError.KERNEL32(?,?,00000000), ref: 00F39BA6
WcsSetDefaultColorProfile.MSCMS(00000001,?,00000000,00000004,00000000,?,?,?,00000000), ref: 00F39BEF
GetLastError.KERNEL32(?,?,00000000), ref: 00F39BF9
WcsSetCalibrationManagementState.MSCMS(00000000,?,?,00000000), ref: 00F39C15
GetLastError.KERNEL32(?,?,00000000), ref: 00F39C1F

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast$CalibrationColorDefaultManagementProfileState$ProfilesUser
String ID:
API String ID: 2534168751-0
Opcode ID: a01864d1caea308ae10121c07517dfca361bce025ff652a19172097df6b53fb7
Instruction ID: 8b42d546dca7da10847be5a5f7b0374d923f0b08f42e7cf57ce2af2d8f3814ee
Opcode Fuzzy Hash: a01864d1caea308ae10121c07517dfca361bce025ff652a19172097df6b53fb7
Instruction Fuzzy Hash: 9E31083BE041369BD7205F799C4477BBAA4AF90770F158128ED45EB240EAF4DE00A6E0

Function 00F3FC10 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(1C2474FF,?,00F3F9CB,?,00000000,?,00F36D51,00000000,?,00000000,00F3615B,00000000,00000000,00000000,?,?), ref: 00F3FC25
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,00F33DB7,1C2474FF,?,00F3F9CB,?,00000000,?,00F36D51,00000000,?,00000000,00F3615B,00000000), ref: 00F3FC3A
DecodePointer.KERNEL32(00F428AC,00F428B0,00F428B4,00F428BC,?,00F3F9CB,?,00000000,?,00F36D51,00000000,?,00000000,00F3615B,00000000,00000000), ref: 00F3FCAF

Strings

AtlThunk_AllocateData, xrefs: 00F3FC4B
atlthunk.dll, xrefs: 00F3FC35
AtlThunk_DataToCode, xrefs: 00F3FC75
AtlThunk_FreeData, xrefs: 00F3FC8A
AtlThunk_InitData, xrefs: 00F3FC60

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 0bb93ba149bf73692774446a1078464bb2c6cd698b9f4c3366e29d7d3395a6bb
Instruction ID: 0009a3a552efa1d62840d446137a4ff5b0ebd56dc257ac1213167c6714392cd4
Opcode Fuzzy Hash: 0bb93ba149bf73692774446a1078464bb2c6cd698b9f4c3366e29d7d3395a6bb
Instruction Fuzzy Hash: 2E01D235E4025C2FDB5A97209D07A6D7A418FA27B4F944079BC4157391CB64CE09B286

Function 00F3F9FA Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00F3F8A5,?,00000000,00000000,?,00F3702D,?,?,00000000,00000000,?,00000000,?,00F36DFD), ref: 00F3FA0F
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00F3F8A5,?,00000000,00000000,?,00F3702D,?,?,00000000,00000000), ref: 00F3FA24
DecodePointer.KERNEL32(00F428AC,00F428B0,00F428B4,00F428BC,?,?,00F3F8A5,?,00000000,00000000,?,00F3702D,?,?,00000000,00000000), ref: 00F3FA99

Strings

AtlThunk_AllocateData, xrefs: 00F3FA35
atlthunk.dll, xrefs: 00F3FA1F
AtlThunk_DataToCode, xrefs: 00F3FA5F
AtlThunk_FreeData, xrefs: 00F3FA74
AtlThunk_InitData, xrefs: 00F3FA4A

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: a3fdca628a4ca4d432703d01ecfdf317a85615921fecd03db697bdc73a4cefa1
Instruction ID: b0cdc48f2e0708c47a545cfb8b3a10b9476b20d9a100ee0f01316e64687511ee
Opcode Fuzzy Hash: a3fdca628a4ca4d432703d01ecfdf317a85615921fecd03db697bdc73a4cefa1
Instruction Fuzzy Hash: 78019224F402587FEF59D7109C07A5D3E418B92778F14007DBC0967392CB68CE0EB686

Function 00F3FAAC Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00F3F8F1,00000000,?,00000000,?,00F36DFD,?), ref: 00F3FAC1
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,00000000,?,?,00F3F8F1,00000000,?,00000000,?,00F36DFD,?), ref: 00F3FAD6
DecodePointer.KERNEL32(00F428AC,00F428B0,00F428B4,00F428BC,?,?,00F3F8F1,00000000,?,00000000,?,00F36DFD,?), ref: 00F3FB4B

Strings

AtlThunk_AllocateData, xrefs: 00F3FAE7
atlthunk.dll, xrefs: 00F3FAD1
AtlThunk_DataToCode, xrefs: 00F3FB11
AtlThunk_FreeData, xrefs: 00F3FB26
AtlThunk_InitData, xrefs: 00F3FAFC

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: e91d9cfea5433146c8a110b62e04d365060d6606925940ecf7bde842618cdbd8
Instruction ID: 49c9b0d5430bc1ac9805f6326b4f33105850e990c5b79fb7a29a31993c76b040
Opcode Fuzzy Hash: e91d9cfea5433146c8a110b62e04d365060d6606925940ecf7bde842618cdbd8
Instruction Fuzzy Hash: 5E019260E042496FEB599720DC17A5D7E428BD2778F18807DBD0957392CA68CA09B296

Function 00F3FB5E Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00F3F980,00000000,00000000,?,00F37025,?,00000000,00000000,?,00000000,?,00F36DFD,?), ref: 00F3FB73
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00F3F980,00000000,00000000,?,00F37025,?,00000000,00000000,?,00000000), ref: 00F3FB88
DecodePointer.KERNEL32(00F428AC,00F428B0,00F428B4,00F428BC,?,00F3F980,00000000,00000000,?,00F37025,?,00000000,00000000,?,00000000), ref: 00F3FBFD

Strings

AtlThunk_AllocateData, xrefs: 00F3FB99
atlthunk.dll, xrefs: 00F3FB83
AtlThunk_DataToCode, xrefs: 00F3FBC3
AtlThunk_FreeData, xrefs: 00F3FBD8
AtlThunk_InitData, xrefs: 00F3FBAE

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 8f499a7a5085d046f20950d818077f48b8ac8c0cbde7b8f877825d5b7f23a5ed
Instruction ID: 25a7b579429bbfa200aeae0da735890efc192ae6a2f7e2cca3ff3629c2ff46f4
Opcode Fuzzy Hash: 8f499a7a5085d046f20950d818077f48b8ac8c0cbde7b8f877825d5b7f23a5ed
Instruction Fuzzy Hash: 1101F560F4024E2FEB5997208D0BB5D3E418B92774F14003DBC02173D2DB64CE0AB286

Function 00F3A4CC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 00F401E0: iswupper.MSVCRT ref: 00F40217
Part of subcall function 00F401E0: towlower.MSVCRT ref: 00F40226
Part of subcall function 00F401E0: iswupper.MSVCRT ref: 00F40234
Part of subcall function 00F401E0: towlower.MSVCRT ref: 00F40240
Part of subcall function 00F401E0: iswupper.MSVCRT ref: 00F40278
Part of subcall function 00F401E0: towlower.MSVCRT ref: 00F40287
Part of subcall function 00F401E0: iswupper.MSVCRT ref: 00F40295
Part of subcall function 00F401E0: towlower.MSVCRT ref: 00F402A1

GetDisplayConfigBufferSizes.USER32(00000002,?,?), ref: 00F3A522

Strings

T, xrefs: 00F3A5F1

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: iswuppertowlower$BufferConfigDisplaySizes
String ID: T
API String ID: 3551102313-3187964512
Opcode ID: aff1209e6d1590d6e33094b3b6e26c8e322c6708f06d506ddbe435752c06bf63
Instruction ID: 577c60e04482ad5d59e9f76f733c2f856207f9dce337579633d723c866aad4e7
Opcode Fuzzy Hash: aff1209e6d1590d6e33094b3b6e26c8e322c6708f06d506ddbe435752c06bf63
Instruction Fuzzy Hash: 2251B472E003199FDB25DF65CC45BAEB7BCAF45320F0441AAAA49E7180EB749F40AF51

Function 00F38AA1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

WcsCreateIccProfile.MSCMS(?,00000000,?,?), ref: 00F38B0C
GetLastError.KERNEL32 ref: 00F38B1C
GetColorProfileFromHandle.MSCMS(00000000,00000000,?,?,?), ref: 00F38B51
GetLastError.KERNEL32 ref: 00F38B5B
CloseColorProfile.MSCMS(00000000,?,?), ref: 00F38CBF
CloseColorProfile.MSCMS(?,?,?), ref: 00F38CCE

Strings

strg, xrefs: 00F38ACF

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Profile$Color$CloseErrorLast$CreateFromHandle
String ID: strg
API String ID: 2314085371-3320446829
Opcode ID: 4b4562a2d35bfd0bc290fa69cc3489edf71d6b548ea6956052aaf12cf95f313b
Instruction ID: 7f9ba2c1aad3c270cc3b9121123af0d0f987430ef2c7046ed6b5541c5a5d8936
Opcode Fuzzy Hash: 4b4562a2d35bfd0bc290fa69cc3489edf71d6b548ea6956052aaf12cf95f313b
Instruction Fuzzy Hash: 962106765043029BC3009F289D4555BBBE9AFD53F0F10052EFC54C2251EF78CA06ABA2

Function 00F36A60 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39synchronizationwindowCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(000001D0), ref: 00F36A72
CloseHandle.KERNEL32 ref: 00F36A7E
OpenIcon.USER32(?), ref: 00F36A98
SetForegroundWindow.USER32(?), ref: 00F36AA1
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000003), ref: 00F36AB1
CallWindowProcW.USER32(?,?,?,?), ref: 00F36ACE

Strings

dccw, xrefs: 00F36AB7

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$CallCloseForegroundHandleIconMutexOpenProcRelease
String ID: dccw
API String ID: 1295780963-1595938506
Opcode ID: a82c7fcb1e0955c995926932f488266652d0ea0391b9fd8190da1e4b0a9551dd
Instruction ID: 90e803a2a65ab25da533410a6aaf8bacc2d2de8dbb665c998d6b35846cd43c8b
Opcode Fuzzy Hash: a82c7fcb1e0955c995926932f488266652d0ea0391b9fd8190da1e4b0a9551dd
Instruction Fuzzy Hash: 7EF0E73A50421CFBDF119F95EC0899A7FA9FB6A351B448022FD0595230C7718A60FBA0

Function 00F3905D Relevance: 12.1, APIs: 8, Instructions: 119COMMON

Download Yara Rule

APIs

WcsGetUsePerUserProfiles.MSCMS(?,6D6E7472,?,?,?,?), ref: 00F3909A
GetLastError.KERNEL32(?,?,?), ref: 00F390A4
WcsGetDefaultColorProfile.MSCMS(00000000,?,00000001,00000004,00000000,00000208,?,?,?,?), ref: 00F390E7
GetLastError.KERNEL32(?,?,?), ref: 00F390F1
WcsOpenColorProfileW.MSCMS(?,00000000,00000000,00000001,00000001,00000003,00000000,?,?,?), ref: 00F3913B
GetLastError.KERNEL32(?,?,?), ref: 00F39147
DccwGetGamutSize.MSCMS(00000000,?,?,?,?), ref: 00F39168
CloseColorProfile.MSCMS(00000000,?,?,?), ref: 00F391B6

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ColorErrorLastProfile$CloseDccwDefaultGamutOpenProfilesSizeUser
String ID:
API String ID: 1332131993-0
Opcode ID: edcad4bb96c44dbbb960f5382e001bc87202e6a383733a4dd305fa4e466c8299
Instruction ID: ea4027a251ae4a780b99fe37dd0d52380026cc2b504616e29be88a847e2995c4
Opcode Fuzzy Hash: edcad4bb96c44dbbb960f5382e001bc87202e6a383733a4dd305fa4e466c8299
Instruction Fuzzy Hash: 51411876D4023E9BD7309B64DC4CBABBAB4AF54730F0202A9ED05F7251DBB0DE409A90

Function 00F34A7B Relevance: 10.8, APIs: 7, Instructions: 264registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F35132
Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3514F
Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F35162
Part of subcall function 00F350F7: CharNextW.USER32(00000027,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3516D

lstrcmpiW.KERNEL32(?,00000000,?,?,?,?,00F3542A,?,?,?,?,?), ref: 00F34AE0
CharNextW.USER32(00000000), ref: 00F34BBA
CharNextW.USER32(00000000), ref: 00F34BD4
VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 00F34C4B
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,?,-00000008,?,?,00F3542A,?,?,?,?,?), ref: 00F34DB3

Part of subcall function 00F350F7: CharNextW.USER32(?,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F351CA
Part of subcall function 00F350F7: CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F351EE

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CharNext$FromValuelstrcmpi
String ID:
API String ID: 2221274522-0
Opcode ID: d848935c634cf278c128a56dd8ce2f1e23c0b6cbc31eceeab33ac56bffdba6c4
Instruction ID: d106df28e2f83b0a7a12dc2a0addc23f099f8b28676bb8fceb94bf5c6e1f0e43
Opcode Fuzzy Hash: d848935c634cf278c128a56dd8ce2f1e23c0b6cbc31eceeab33ac56bffdba6c4
Instruction Fuzzy Hash: 32A1B475E002298BDB249F24CC89AE9B7B5EF65360F0541E9EB09A7250D770BEC1EF50

Function 00F3DE5A Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

GdipCreateSolidFill.GDIPLUS(FF787878,00000000,00000001,?,?), ref: 00F3DEAF
GdipCreateFromHDC.GDIPLUS(?,00000000,?,?), ref: 00F3DEC0
GdipFillRectangleI.GDIPLUS(00000000,00000000,00000000,?,00000001,?,?,?), ref: 00F3DEE3
GdipFillRectangleI.GDIPLUS(00000000,?,00000005,?,?,?,?,?,?,FFFF0000), ref: 00F3DF6B
GdipDeleteBrush.GDIPLUS(?), ref: 00F3DF74
GdipDeleteGraphics.GDIPLUS(00000000), ref: 00F3DF7B
GdipDeleteBrush.GDIPLUS(00000000), ref: 00F3DF84

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Gdip$DeleteFill$BrushCreateRectangle$FromGraphicsSolid
String ID:
API String ID: 2116296181-0
Opcode ID: 3505db35d468543c2c1d8dfe91ae74ee527828bf6cd5436778152eecd68eb863
Instruction ID: 9b4d170c2ac1ce8cfd004535f2fe534dce7b0fec2004cffcaf213de03c208e56
Opcode Fuzzy Hash: 3505db35d468543c2c1d8dfe91ae74ee527828bf6cd5436778152eecd68eb863
Instruction Fuzzy Hash: BC416D72900609EFCB20CFA8CD88AAEBBF9FF58314F004619E546E7654D730AA45DB50

Function 00F3C710 Relevance: 10.6, APIs: 7, Instructions: 104COMMON

Download Yara Rule

APIs

GdipCreateFromHDC.GDIPLUS(?,?,?,?,00000001), ref: 00F3C779
GdipCreateSolidFill.GDIPLUS(FF000000,00000093,?,?,00000001), ref: 00F3C78C
GdipFillRectangleI.GDIPLUS(?,00000093,00000000,?,00000001,?,?,?,00000001), ref: 00F3C7AC

Part of subcall function 00F3C8B1: GdipCreateLineBrushI.GDIPLUS(?,?,?,?,00000000,00000000,?,?,?,00F3C7E2,?,00000000,?,?,?,?), ref: 00F3C8E2

GdipFillRectangleI.GDIPLUS(?,?,00000005,?,?,?,?,00000000,?,?,?,?,00000001), ref: 00F3C806
GdipDeleteBrush.GDIPLUS(?,?,?,00000001), ref: 00F3C80F
GdipDeleteBrush.GDIPLUS(00000093,?,?,00000001), ref: 00F3C818
GdipDeleteGraphics.GDIPLUS(?,?,?,00000001), ref: 00F3C81F

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Gdip$BrushCreateDeleteFill$Rectangle$FromGraphicsLineSolid
String ID:
API String ID: 1713370201-0
Opcode ID: c0c79bfdfeb7f29cf499e9aff4f9fef519312926a1dd6e1184d594a114184b34
Instruction ID: 42fbda0867c9db320edb076c19664831126d5e2b2d143a9efd2b2837d3939965
Opcode Fuzzy Hash: c0c79bfdfeb7f29cf499e9aff4f9fef519312926a1dd6e1184d594a114184b34
Instruction Fuzzy Hash: 7541EA7690051AEFCB05DFA8D984CAEBBB9FF18314B004269E906E3610DB30EA15DF91

Function 00F36EB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,00000024,?), ref: 00F36F30
GetWindowLongW.USER32(?,000000FC), ref: 00F36F40
CallWindowProcW.USER32(?,?,00000082,00000024,?), ref: 00F36F59
GetWindowLongW.USER32(?,000000FC), ref: 00F36F72
SetWindowLongW.USER32(?,000000FC,?), ref: 00F36F84

Strings

$, xrefs: 00F36EEB

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 509e39ea2cd2c3f8d827fb32b2f9ea0b3fbaae986b0daa96ad62200f2c126bad
Instruction ID: c1e52e4e7d67babb3666f5ace3fa81778219d448276faf90ce95fb8ae467b976
Opcode Fuzzy Hash: 509e39ea2cd2c3f8d827fb32b2f9ea0b3fbaae986b0daa96ad62200f2c126bad
Instruction Fuzzy Hash: 47411D75A0051AFFCB05CF68D9849ADFBB5FF58320F108219E915E3660D771AA60EF90

Function 00F3E9DC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001100,00000000,00F368A9,00000000,00F30000,00000000,00000000), ref: 00F3EA5C
FormatMessageW.KERNEL32(00002500,?,00000000,00000000,?,00000000,?,00F30000,-0000012A), ref: 00F3EAC2
LocalFree.KERNEL32(00000000), ref: 00F3EAE2
LocalFree.KERNEL32(00000000,00F30000,-0000012A), ref: 00F3EAF3

Part of subcall function 00F3E8E3: EventWrite.ADVAPI32(00F31F20,00000001,?,?,00F368A9,00000000), ref: 00F3E944
Part of subcall function 00F3E8E3: MessageBoxW.USER32(00000000,00000000,00F428C8,00000010), ref: 00F3E973

Strings

strg, xrefs: 00F3EA8F
strg, xrefs: 00F3EA82

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Message$FormatFreeLocal$EventWrite
String ID: strg$strg
API String ID: 3780319976-3117884289
Opcode ID: 4f781d32d6a1b017b57de484302f6d048c11bb9d510802d973bdff6eacf10184
Instruction ID: 25ac244c783db1cd00ba322df138fd9d068686e6b5072de7661dad56871e685a
Opcode Fuzzy Hash: 4f781d32d6a1b017b57de484302f6d048c11bb9d510802d973bdff6eacf10184
Instruction Fuzzy Hash: B8319C71A08301ABE700DF64DC45B6FBBE8EFC4764F00092DF991922A1D774D948EBA2

Function 00F3F3B0 Relevance: 10.6, APIs: 7, Instructions: 82windowCOMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00F3F3C9
EnumDisplayMonitors.USER32(00000000,00000000,Function_0000F100,00000000), ref: 00F3F3E1
ReleaseDC.USER32(?,00000000), ref: 00F3F3E9
GetLastError.KERNEL32 ref: 00F3F3F1
GetParent.USER32(00000000), ref: 00F3F43B
PostMessageW.USER32(00000000,00000470,00000000,00000003), ref: 00F3F44B
ShowWindow.USER32(00000000,00000003,?), ref: 00F3F460

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DisplayEnumErrorLastMessageMonitorsParentPostReleaseShowWindow
String ID:
API String ID: 3937410996-0
Opcode ID: afb9b85b0dcfcb6a1d527d82f7adc75e4fb00a511b5597a51380df54ef008703
Instruction ID: 1bed438151c4ee8d3b0396c207a722042c60bbe654150e56a99b633f1c4b7da9
Opcode Fuzzy Hash: afb9b85b0dcfcb6a1d527d82f7adc75e4fb00a511b5597a51380df54ef008703
Instruction Fuzzy Hash: 0F21B035B00215AFDB10AB65DC49B6E7BA8EF45771F104065F901EB2A0CB74EE09AB61

Function 00F3AF80 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000095), ref: 00F3AFD1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00F3AFE1
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00F3AFF9
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F3B044

Strings

open, xrefs: 00F3B03E
CTTune.exe, xrefs: 00F3B01D

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DirectoryExecuteItemMessageSendShellSystem
String ID: CTTune.exe$open
API String ID: 2938676387-2528619867
Opcode ID: 20b061f65f19f379ccf9add952ac609a3e019cafe44047e24a7566e790da3d23
Instruction ID: 1e97cdb11f526b1af1dbd85f514dbf18f59920a1bd584a94a64ddd9152a57897
Opcode Fuzzy Hash: 20b061f65f19f379ccf9add952ac609a3e019cafe44047e24a7566e790da3d23
Instruction Fuzzy Hash: CE2129B5B01228A7CB349B24DC5DE6B7768DF81B30F110165FE11E7281CB74DE00AA90

Function 00F3F711 Relevance: 10.6, APIs: 7, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,00000000,00F3F911,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F733
HeapAlloc.KERNEL32(00000000,?,00000000,?,00F36DFD,?), ref: 00F3F73A

Part of subcall function 00F3F7EE: IsProcessorFeaturePresent.KERNEL32(0000000C,00F3F721,00000000,00000000,00F3F911,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F7F0

InterlockedPopEntrySList.KERNEL32(00000000,00000000,00000000,00F3F911,00000000,?,00000000,?,00F36DFD,?), ref: 00F3F743
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,?,00F36DFD,?), ref: 00F3F766
InterlockedPopEntrySList.KERNEL32(?,00000000,?,00F36DFD,?), ref: 00F3F77E
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,00F36DFD,?), ref: 00F3F792

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$FeatureFreePresentProcessProcessor
String ID:
API String ID: 3687752540-0
Opcode ID: ca9eb3cc8cef7a52c43192e832a56620cf77b868c8d00c3c2fb59422c5e01228
Instruction ID: 3fe03699dd55bd1ef2a040fe0976ec1fcc1b70d163f24cd3b940ba6b44db35e1
Opcode Fuzzy Hash: ca9eb3cc8cef7a52c43192e832a56620cf77b868c8d00c3c2fb59422c5e01228
Instruction Fuzzy Hash: 2411043AF00602BBE760177CED08B2A3B95AF96772F540431FE45D62A0DB20CC09BB60

Function 00F3BC83 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00F3A94C: GetWindowLongW.USER32(?,000000EC), ref: 00F3A956
Part of subcall function 00F3A94C: EnumChildWindows.USER32(?,00F3AC60), ref: 00F3A994
Part of subcall function 00F3A94C: EnumChildWindows.USER32(?,00F3AC80), ref: 00F3A9CC

GetDlgItem.USER32(?,din), ref: 00F3BD04
SetWindowTextW.USER32(00000000,00F428C8), ref: 00F3BD0E

Strings

i, xrefs: 00F3BCCB
strg, xrefs: 00F3BCE0
n, xrefs: 00F3BCD2
din, xrefs: 00F3BCFD

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ChildEnumWindowWindows$ItemLongText
String ID: din$i$n$strg
API String ID: 2822888986-2104475465
Opcode ID: 880c8d5dbd0f312d825cb40dbc51fc9dad0f268c1c3a7bbe71773ff651f8f768
Instruction ID: 1939c1f7bfe4d36bc8343cd35a6e450c83b94ec4b984ef21b05fc311ef9dcfdc
Opcode Fuzzy Hash: 880c8d5dbd0f312d825cb40dbc51fc9dad0f268c1c3a7bbe71773ff651f8f768
Instruction Fuzzy Hash: 57118F75E00209ABDF14EFA5ED44AAEBBB6FF58314F01412DEA1563210CB759A14EFA0

Function 00F3A94C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00F3A956
EnumChildWindows.USER32(?,00F3AC60), ref: 00F3A994
EnumChildWindows.USER32(?,00F3AC80), ref: 00F3A9CC

Strings

false, xrefs: 00F3A96E, 00F3A973
true, xrefs: 00F3A967
IDD = %d: m_bIsRtl = %s, xrefs: 00F3A977

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ChildEnumWindows$LongWindow
String ID: IDD = %d: m_bIsRtl = %s$false$true
API String ID: 92254136-2899959848
Opcode ID: 9021594b28fa7e72cd86eafebb1e420d4a124a55f7747b8414aed8fa542fba28
Instruction ID: 386acdf475e593d131edd57b078e7ed5448b4b1cee9d5c91f8c9a40eb4dc4c6a
Opcode Fuzzy Hash: 9021594b28fa7e72cd86eafebb1e420d4a124a55f7747b8414aed8fa542fba28
Instruction Fuzzy Hash: 5101DE32A02710AFD7219B38CC0AB57BBA4EF14371F01892DF5E6C41E2CAA0E904B711

Function 00F34793 Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

CoTaskMemAlloc.API-MS-WIN-CORE-COM-L1-1-0(?,00000000,?,00000000), ref: 00F34805
CharNextW.USER32(00000000,?,?,00000001,?,00000000), ref: 00F34838
wcsncpy_s.MSVCRT ref: 00F34879
CharNextW.USER32(00000000,00000000,?,?,?,00000001,?,00000000), ref: 00F348C6
CharNextW.USER32(?,?,00000001,?,00000000), ref: 00F348E5
CoTaskMemFree.API-MS-WIN-CORE-COM-L1-1-0(?,00000000,?,00000000), ref: 00F34922

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CharNext$Task$AllocFreewcsncpy_s
String ID:
API String ID: 3890462556-0
Opcode ID: 92d2611d41723fa3961f8a8b126ca8fe579b77d5947c129bfebecc2b52a3a61d
Instruction ID: 27956f5881c389821a1a746f223e851fe7190f5d550c4cfe7639d3ebf494fe88
Opcode Fuzzy Hash: 92d2611d41723fa3961f8a8b126ca8fe579b77d5947c129bfebecc2b52a3a61d
Instruction Fuzzy Hash: 7D51F339A012198BCF159F68CC94B6EB7B5EF45730F244129E902DB294EB70FE41EB50

Function 00F350F7 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 00F357ED: CharNextW.USER32(?,00000000,00F35107,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3580C

CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F35132
CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3514F
CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F35162
CharNextW.USER32(00000027,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F3516D
CharNextW.USER32(?,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F351CA
CharNextW.USER32(00000000,?,00000000,00000000,?,?,00F35878,?,00000000,?,00000000,00000000,00000000), ref: 00F351EE

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 29d9df78bbcb585f097a78d18cf445c89b46d21af46b69ae1f67a00c0d6c80e7
Instruction ID: 91d6e0e58aa2201d7a3d3275d2769be6bd31672fbaf51b7712e9c53fdd5bf4e8
Opcode Fuzzy Hash: 29d9df78bbcb585f097a78d18cf445c89b46d21af46b69ae1f67a00c0d6c80e7
Instruction Fuzzy Hash: 1C41E639A005128FCB24AF78C88457AF7B1FFE8B30B65441AD84287254FB70DE44E710

Function 00F39C43 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

WcsDisassociateColorProfileFromDevice.MSCMS(00000000,?,?,?,00000000,00000000,?,?,?,00F38D76,?,?,?), ref: 00F39C7E
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00F38D76,?,?,?), ref: 00F39C88
WcsGetUsePerUserProfiles.MSCMS(?,6D6E7472,?,?,00000000,00000000,?,?,?,00F38D76,?,?,?), ref: 00F39CBB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00F38D76,?,?,?), ref: 00F39CC5
WcsDisassociateColorProfileFromDevice.MSCMS(00000001,?,?,?,00000000,00000000,?,?,?,00F38D76,?,?,?), ref: 00F39CEA
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00F38D76,?,?,?), ref: 00F39CF4

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast$ColorDeviceDisassociateFromProfile$ProfilesUser
String ID:
API String ID: 2382097621-0
Opcode ID: ed52dc53f25b3af59bba55a7932fdca860c08bd39a5ebced0f140a15886d39dc
Instruction ID: 2a90e968749e23b184bea95eff2886b19b679662a6d8b63ea57fe446b233fedd
Opcode Fuzzy Hash: ed52dc53f25b3af59bba55a7932fdca860c08bd39a5ebced0f140a15886d39dc
Instruction Fuzzy Hash: 21210437D081239BD7300B5D8849B67BAA8EF917B0F294125EC41DB121E6E4CC40F6E0

Function 00F3DFA0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00F3DFB3
GetWindowTextLengthW.USER32(?), ref: 00F3DFC1
GetWindowTextW.USER32(?,00000000,?), ref: 00F3DFF3
GetTextExtentPoint32W.GDI32(00000000,00000000,?,?), ref: 00F3E002
MoveWindow.USER32(?,00000000,?,?,?,00000001), ref: 00F3E028
ReleaseDC.USER32(?,00000000), ref: 00F3E03C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: TextWindow$ExtentLengthMovePoint32Release
String ID:
API String ID: 516594899-0
Opcode ID: 6e0fca41926fbb6749a6853e4e6f45d7238f5c463f4a965642bbdedb4daf3c83
Instruction ID: 8c304fe34f3b819f4876d2f54dcf87dddbb4af8e6a768e7473eea7b582336ce6
Opcode Fuzzy Hash: 6e0fca41926fbb6749a6853e4e6f45d7238f5c463f4a965642bbdedb4daf3c83
Instruction Fuzzy Hash: 6411A776600209FFDB159FB4EC4EE9F7FBDEB85311F104029FA42C50A0DA719A00AB20

Function 00F3F117 Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00F30000,?,000001F4,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F13C
GetLastError.KERNEL32(?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F14B
LoadResource.KERNEL32(00F30000,00000000,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F166
GetLastError.KERNEL32(?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F172
SizeofResource.KERNEL32(00F30000,?,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F18F
LockResource.KERNEL32(00000000,?,00000000,?,?,?,00F3EC29,?,?,?,00000000,?), ref: 00F3F19B

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Resource$ErrorLast$FindLoadLockSizeof
String ID:
API String ID: 518650369-0
Opcode ID: 627130f9448be9cde380a4021a5f56ba6475919e5d03e3de4df3604c82df06f4
Instruction ID: 5babd40a0e66e643cf1bc6960c2fcefda1eee2bb559c1a2d2c11aa3945e23ffb
Opcode Fuzzy Hash: 627130f9448be9cde380a4021a5f56ba6475919e5d03e3de4df3604c82df06f4
Instruction Fuzzy Hash: B311737BD00234EBC7119FA9ED4495ABAB8AB99770B114125FD45D7350D630CD00E7E0

Function 00F3D96E Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00F37443: GetDlgItem.USER32(?,00000091), ref: 00F3745F
Part of subcall function 00F37443: GetDlgItem.USER32(?,00000087), ref: 00F374B2

GetDlgItem.USER32(?,000000C8), ref: 00F3D98D
GetDlgItem.USER32(?,000000CD), ref: 00F3D9A1
GetDlgItem.USER32(?,000000D2), ref: 00F3D9B5
GetDlgItem.USER32(?,000000D7), ref: 00F3D9C9
GetDlgItem.USER32(?,000000DC), ref: 00F3D9DD
GetDlgItem.USER32(?,000000E1), ref: 00F3D9F1

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Item
String ID:
API String ID: 3207170592-0
Opcode ID: 5e93e8489ed2175cbd7784cefac4c67bf1fe8079363c38afd678bd2000643766
Instruction ID: 1e7f3dafbc37e9d53ba041329a8a78f719bde0c685c551604a14d43d89791318
Opcode Fuzzy Hash: 5e93e8489ed2175cbd7784cefac4c67bf1fe8079363c38afd678bd2000643766
Instruction Fuzzy Hash: 1711E234811B00EFEB305B61DD05B96BAE0FF10721F008A2FE96E96160C7715980EB10

Function 00F33FBE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 00F3434F: InitializeCriticalSection.KERNEL32(?,00F40FD0,0000000C,00F34017), ref: 00F34361

GetModuleFileNameW.KERNEL32(00F30000,?,00000104), ref: 00F34073
GetModuleHandleW.KERNEL32(00000000,?), ref: 00F340C6

Strings

REGISTRY, xrefs: 00F34198
Module_Raw, xrefs: 00F3415F
Module, xrefs: 00F3413F

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Module$CriticalFileHandleInitializeNameSection
String ID: Module$Module_Raw$REGISTRY
API String ID: 3195065971-549000027
Opcode ID: 98a707bbd52b77e5c23027b8bd4ecd56eb698732e744f80c52aace771d093879
Instruction ID: 0942bdf14c68aa4b8a9841e3d664367915a4496df770f62e3766904dd2442ad6
Opcode Fuzzy Hash: 98a707bbd52b77e5c23027b8bd4ecd56eb698732e744f80c52aace771d093879
Instruction Fuzzy Hash: BF51C676B003299BCB24DF24CD40A9AB7B9AF55320F054099EE05A7240EB35BF44EF61

Function 00F3963A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetColorDirectoryW.MSCMS(00000000,?,?,00000000), ref: 00F3966C
GetLastError.KERNEL32 ref: 00F39676

Strings

CalibratedDisplayProfile-%d-Temp.icc, xrefs: 00F396E1
%s\%s, xrefs: 00F396BB, 00F396C7, 00F39706
CalibratedDisplayProfile-%d.icc, xrefs: 00F3969C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ColorDirectoryErrorLast
String ID: %s\%s$CalibratedDisplayProfile-%d-Temp.icc$CalibratedDisplayProfile-%d.icc
API String ID: 3534830153-2182247336
Opcode ID: 410ba916182eb71dc666fb73331da7dfdeb83e3bb8cbce288e2adae5158686ee
Instruction ID: 1d3deb73518778045fcee0e09c081dc5f11b829e3268220d61fecbdc01fb5d18
Opcode Fuzzy Hash: 410ba916182eb71dc666fb73331da7dfdeb83e3bb8cbce288e2adae5158686ee
Instruction Fuzzy Hash: B221D271A00309A7DB209B318C49FD7B7FCEB54314F00456AAD59D6042EAB1E605AAA0

Function 00F3E7A1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator,00000000,00020019,?), ref: 00F3E7C4
RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F3E7E6
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?), ref: 00F3E814
RegCloseKey.ADVAPI32(?), ref: 00F3E829

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator, xrefs: 00F3E7B7

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator
API String ID: 1586453840-1252446219
Opcode ID: 597946c542d0da0aaa36708b82b9cfa77cb8aea2ce1ab2d87795127b5814b8ec
Instruction ID: ebcbb67f84c3208038e6d6f70712f745922ef6fe00e7f00e1de4a858178503b2
Opcode Fuzzy Hash: 597946c542d0da0aaa36708b82b9cfa77cb8aea2ce1ab2d87795127b5814b8ec
Instruction Fuzzy Hash: 8A11F67AD00118BBCB21DF89D844EAEBBB8EF94760F108165FC04A6150D3309E50EBA0

Function 00F38D00 Relevance: 7.6, APIs: 5, Instructions: 113fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,00000000), ref: 00F38D29
GetLastError.KERNEL32 ref: 00F38D33
WcsSetCalibrationManagementState.MSCMS(00000001,?,?,?,?), ref: 00F38D99
GetLastError.KERNEL32 ref: 00F38DA3
EventWrite.ADVAPI32(00F31F80,00000002,?), ref: 00F38E47

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast$CalibrationCopyEventFileManagementStateWrite
String ID:
API String ID: 4173155175-0
Opcode ID: ceac9eb84ff7d63400e58d7896d3404e17d17991ffc9c6ff66e7b8da620e5eb7
Instruction ID: 9b3db23319f7d106062b024280e7fe8b0f083cacc280a519a7960e309b9d4bb9
Opcode Fuzzy Hash: ceac9eb84ff7d63400e58d7896d3404e17d17991ffc9c6ff66e7b8da620e5eb7
Instruction Fuzzy Hash: C541D636E007169BCB199FA888516AEFBB1FF94760F15412DED0667380DF34AD42AB90

Function 00F3C605 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F37505
Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F3751D
Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F37535
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3754E
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3755F
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F37570
Part of subcall function 00F374D3: _ftol2_sse.MSVCRT ref: 00F37602

GetWindowRect.USER32(?,?), ref: 00F3C643
GetWindowRect.USER32(?,?), ref: 00F3C65B
GetWindowRect.USER32(?,?), ref: 00F3C673
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000,?,?,00000001), ref: 00F3C6DB
MoveWindow.USER32(?,-00000010,?,00000010,?,00000001,?,00000000,00000000,?,?,00000001), ref: 00F3C6F3

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$Rect$Points$Move$_ftol2_sse
String ID:
API String ID: 3053001243-0
Opcode ID: 11ce29a033455e3bcb0b0b4a52ba0bbdcf0d3df125e79c3d658f95033119f76c
Instruction ID: 55da97a9ce4cd45147e02c59d2c4ea2d9227ad388d910dc78e510272149b54f9
Opcode Fuzzy Hash: 11ce29a033455e3bcb0b0b4a52ba0bbdcf0d3df125e79c3d658f95033119f76c
Instruction Fuzzy Hash: 37316171A0010AAFDB14CF78DC49FEEBBBAEF48314F044229F919E2160DB71A955DB90

Function 00F368BE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

MonitorFromRect.USER32(?,00000002), ref: 00F36949
MonitorFromRect.USER32(?,00000002), ref: 00F36A0B

Strings

Current display is 0x%08x, xrefs: 00F369DC
New rect (%d, %d, %d, %d) is on display 0x%08x, xrefs: 00F3695E, 00F36A1E

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: FromMonitorRect
String ID: Current display is 0x%08x$New rect (%d, %d, %d, %d) is on display 0x%08x
API String ID: 2578442757-1896848492
Opcode ID: ec7598c4482d6e98c88619a62be1c411b1382378132b12c0f0b816ac1a8f6ed8
Instruction ID: 4227694fd54d02187e8c6ae3f5f091668dfeb6d191a28ecdde0afb6051b8c5db
Opcode Fuzzy Hash: ec7598c4482d6e98c88619a62be1c411b1382378132b12c0f0b816ac1a8f6ed8
Instruction Fuzzy Hash: 9F513A79B00219AFCF05DF98C8859BEBBB5AF88320F14805AE905A7351CB74EE11DF91

Function 00F3E84A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator,00000000,00020006,00000000,?,?,?,00F3E16E,Brightness,00000004,00000004,?), ref: 00F3E86A
RegSetValueExW.ADVAPI32(00000000,?,00000000,?,?,?,?,?,?,00F3E16E,Brightness,00000004,00000004,?), ref: 00F3E886
RegCloseKey.ADVAPI32(00000000,?,?,?,00F3E16E,Brightness,00000004,00000004,?), ref: 00F3E897

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator, xrefs: 00F3E860

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CloseOpenValue
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\DCCW\Simulator
API String ID: 779948276-1252446219
Opcode ID: b930dee419e7897eafdd5aad94dc77c98da94608467caa4f7803d394daa8bb97
Instruction ID: ad06e2cc9ed4524883f45fc713cb89a4f5306fe37901b735e7fdf32b703dfbbd
Opcode Fuzzy Hash: b930dee419e7897eafdd5aad94dc77c98da94608467caa4f7803d394daa8bb97
Instruction Fuzzy Hash: 4DF04936D00228FBDB218F849D09F9E7A79EF04765F104160FD01A61A0C3728E10FBA1

Function 00F38540 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

_ftol2.MSVCRT ref: 00F385A1
GetLastError.KERNEL32 ref: 00F385BC
_ftol2.MSVCRT ref: 00F385FF
GetLastError.KERNEL32 ref: 00F3861C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ErrorLast_ftol2
String ID:
API String ID: 3138094797-0
Opcode ID: e6584b0cc8b1b809f9a751a4afa562db4313ca6003b90723a508129361e3f3f7
Instruction ID: 2aa14b51a93df9755e8835a4b5954611d711f94286a4e24741250a395fc40f00
Opcode Fuzzy Hash: e6584b0cc8b1b809f9a751a4afa562db4313ca6003b90723a508129361e3f3f7
Instruction Fuzzy Hash: 6B5181397006248FCB019F24D854B6D7BA2AF897B0F1600A9ED06DB395DF74ED06DB91

Function 00F3D780 Relevance: 6.2, APIs: 4, Instructions: 152windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F3E04F: SendMessageW.USER32(?,00000406,00000001,?), ref: 00F3E06C

SendMessageW.USER32(?,00000415,00000000,00000000), ref: 00F3D7E7

Part of subcall function 00F3E07C: SendMessageW.USER32(?,00000405,00000001,?), ref: 00F3E08E

SendMessageW.USER32(?,00000415,00000000,00000000), ref: 00F3D87A
SendMessageW.USER32(?,00000415,00000000,00000000), ref: 00F3D910
SetTimer.USER32(?,00000001,00000032,00000000), ref: 00F3D952

Part of subcall function 00F3AB40: GetParent.USER32(?), ref: 00F3AB48
Part of subcall function 00F3AB40: PostMessageW.USER32(00000000,00000470,00000000,00000003), ref: 00F3AB58
Part of subcall function 00F3AB40: GetParent.USER32(?), ref: 00F3AB61
Part of subcall function 00F3AB40: SendMessageW.USER32(00000000,00000489,00000000,00F31FA0), ref: 00F3AB74

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Message$Send$Parent$PostTimer
String ID:
API String ID: 1672226202-0
Opcode ID: 320c74509e482720f8633cc2edb3d3935881db6ca50cf9537bfc1c7d481fe0c3
Instruction ID: 0830489fc8e2321d542662713264d277174f82360f4d7d309975d2b652c26b25
Opcode Fuzzy Hash: 320c74509e482720f8633cc2edb3d3935881db6ca50cf9537bfc1c7d481fe0c3
Instruction Fuzzy Hash: 27513B35600116EFDF059F54DC84FA87BA6FF49310F1940B5EE09AB2A6CB71AE11AF60

Function 00F3A030 Relevance: 6.1, APIs: 4, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

DestroyPhysicalMonitors.DXVA2(00000001,00000014,00000000,00000000,00000000,?,00F37B14,00000000,00000000,00F33D1A), ref: 00F3A054
DeleteDC.GDI32(?), ref: 00F3A06C
DccwReleaseDisplayProfileAssociationList.MSCMS(?,00000000,00000000,00000000,?,00F37B14,00000000,00000000,00F33D1A), ref: 00F3A14D
DccwReleaseDisplayProfileAssociationList.MSCMS(?,?,00F37B14,00000000,00000000,00F33D1A), ref: 00F3A159

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: AssociationDccwDisplayListProfileRelease$DeleteDestroyMonitorsPhysical
String ID:
API String ID: 896183022-0
Opcode ID: 98f74680f88e1e59656554d51eb5a1c87f5a7e7830acd729a3495bb9e20de0f7
Instruction ID: e0450ea71ca9a179e56024cf8eccfbcc247b0cd87dd35b946e17d89692f4d003
Opcode Fuzzy Hash: 98f74680f88e1e59656554d51eb5a1c87f5a7e7830acd729a3495bb9e20de0f7
Instruction Fuzzy Hash: 8941AAB1805B009FD3719F2A9894AD3FBE4FF4A320F90492EE5AE82210DB356944DF91

Function 00F3A9ED Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

MapDialogRect.USER32(?,?), ref: 00F3AA1C
GetWindowRect.USER32(?,?), ref: 00F3AA42
EnumChildWindows.USER32(?,00F3AD30), ref: 00F3AABD
InvalidateRect.USER32(?,00000000,00000001), ref: 00F3AAC9

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Rect$ChildDialogEnumInvalidateWindowWindows
String ID:
API String ID: 102734436-0
Opcode ID: 59534c05ac0c1996699c389c837b6eddafbfc0b8b71b14a935370bce4641619a
Instruction ID: ae4b9700534ecd24481de0077f6a0e1b25b4669cf8a01672e6b312a9ee77f20a
Opcode Fuzzy Hash: 59534c05ac0c1996699c389c837b6eddafbfc0b8b71b14a935370bce4641619a
Instruction Fuzzy Hash: 10316D31A0060A9FDB14CF7CC945BAEBBF6FB45311F044528A59AD6150DBB4A908DB51

Function 00F3C047 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F37505
Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F3751D
Part of subcall function 00F374D3: GetWindowRect.USER32(?,?), ref: 00F37535
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3754E
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F3755F
Part of subcall function 00F374D3: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00F37570
Part of subcall function 00F374D3: _ftol2_sse.MSVCRT ref: 00F37602

GetWindowRect.USER32(?,?), ref: 00F3C085
GetWindowRect.USER32(?,?), ref: 00F3C099
GetWindowRect.USER32(?,?), ref: 00F3C0AD
MoveWindow.USER32(?,00000000,?,?,?,00000001,?,00000000,00000000), ref: 00F3C0FF

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Window$Rect$Points$Move_ftol2_sse
String ID:
API String ID: 4240149109-0
Opcode ID: 9365928529aa31f4c0b0ad460500c5f3f03c496c2ec86cd733827aa0172779ff
Instruction ID: d9e5e4deb4d8c6f906aac4d8b2c9c923b8f9520747027f3812adf042a7f5830b
Opcode Fuzzy Hash: 9365928529aa31f4c0b0ad460500c5f3f03c496c2ec86cd733827aa0172779ff
Instruction Fuzzy Hash: 0C217175A00209AFDB10EF78CD49BEEBBB9EF48324F054129F916E2195DB30E944DB60

Function 00F3B9B0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00F3BA20
SetTextColor.GDI32(?,00000000), ref: 00F3BA32
SetBkMode.GDI32(?,00000001), ref: 00F3BA3C
GetStockObject.GDI32(00000005), ref: 00F3BA44

Part of subcall function 00F3BAD1: GetDlgItem.USER32(?,000000AA), ref: 00F3BB07

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ColorItemLongModeObjectStockTextWindow
String ID:
API String ID: 3442870416-0
Opcode ID: 791dca1a6aceefe5baa58ea578bf8fbd91265ba3aa32d869075aa708006fafcc
Instruction ID: 9fad91f8b4a0294a990228707e4fe43a02a2f513e238c073a5b431d1692d44ed
Opcode Fuzzy Hash: 791dca1a6aceefe5baa58ea578bf8fbd91265ba3aa32d869075aa708006fafcc
Instruction Fuzzy Hash: 46116D3250466DABDF255F19DC18B9E7B65EB05735F004126FE1586260C7789D20EFA0

Function 00F3AEE0 Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F3AEEA
PostMessageW.USER32(00000000,00000470,00000000,00000005), ref: 00F3AEFB
GetDlgItem.USER32(?,00000095), ref: 00F3AF17
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00F3AF26

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: Message$ItemParentPostSend
String ID:
API String ID: 3857695281-0
Opcode ID: f750fc16bf95bb60fad391a61b55e64e23e4369d3711abcb140320b0f33ad10c
Instruction ID: 4ac5a51f5def954116ef4ea93478e823024f9e36f1b8c266fb7128e81955cee4
Opcode Fuzzy Hash: f750fc16bf95bb60fad391a61b55e64e23e4369d3711abcb140320b0f33ad10c
Instruction Fuzzy Hash: 5301A139700211AFDB105F318C48A6B3F65EB85BA1F044071FD05DB291CB709A01ABA0

Function 00F40340 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00F40B1A: GetModuleHandleW.KERNEL32(00000000), ref: 00F40B21

__set_app_type.MSVCRT ref: 00F40352
__p__fmode.MSVCRT ref: 00F40368
__p__commode.MSVCRT ref: 00F40376
__setusermatherr.MSVCRT ref: 00F40397

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 55823a0f01b9ccd7c28221311005744c016ad340aaa5c4b064a3253b36cf6783
Instruction ID: 14044702c3b1b9213e0f68c530e6161f666bab0b62465b4b94c379d1ba1cfeb0
Opcode Fuzzy Hash: 55823a0f01b9ccd7c28221311005744c016ad340aaa5c4b064a3253b36cf6783
Instruction Fuzzy Hash: 26F0F87854430C8FD7686F70AC4A6287BA1FB62321B50062AFC52863F1CF3A9184FA01

Function 00F3F360 Relevance: 6.0, APIs: 4, Instructions: 21windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F3F368
PostMessageW.USER32(00000000,00000470,00000000,00000002), ref: 00F3F378
GetParent.USER32(?), ref: 00F3F381
SendMessageW.USER32(00000000,00000489,00000000,00F31FA0), ref: 00F3F394

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: MessageParent$PostSend
String ID:
API String ID: 2241083247-0
Opcode ID: 71fece270a7c4ddcb9373575ac2984f9f4938fec0f5f239df4f624da11622544
Instruction ID: d2575e3bf5f23e478fe7ed913e1da3ec4d229570cc2e250309d23d772122e164
Opcode Fuzzy Hash: 71fece270a7c4ddcb9373575ac2984f9f4938fec0f5f239df4f624da11622544
Instruction Fuzzy Hash: 39E01276684744BFE6202B70EC0FF463A68EB55B15F118550B756E90F0CBF0AA40AB44

Function 00F3AB40 Relevance: 6.0, APIs: 4, Instructions: 21windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F3AB48
PostMessageW.USER32(00000000,00000470,00000000,00000003), ref: 00F3AB58
GetParent.USER32(?), ref: 00F3AB61
SendMessageW.USER32(00000000,00000489,00000000,00F31FA0), ref: 00F3AB74

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: MessageParent$PostSend
String ID:
API String ID: 2241083247-0
Opcode ID: d8a46cc8e3c69221443030047e584bc20fa75a696288687c6e426be0fe688c1d
Instruction ID: 3e952dee53bc8d88531b68099173f91bc193c8063d9d873e6f5c542f44ae9da5
Opcode Fuzzy Hash: d8a46cc8e3c69221443030047e584bc20fa75a696288687c6e426be0fe688c1d
Instruction Fuzzy Hash: 12E01276684744BFE6202B70FC0EF463A68EB55B15F118550B756E90F0CBF0AB40AB44

Function 00F3E8E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60windowCOMMON

Download Yara Rule

APIs

EventWrite.ADVAPI32(00F31F20,00000001,?,?,00F368A9,00000000), ref: 00F3E944
MessageBoxW.USER32(00000000,00000000,00F428C8,00000010), ref: 00F3E973

Strings

strg, xrefs: 00F3E952, 00F3E955

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: EventMessageWrite
String ID: strg
API String ID: 2344367845-3320446829
Opcode ID: 3b90ad0729476ecb4b8dfa0a934eecc90f0811abd63ca37faf3dc3044e3de564
Instruction ID: 423e5cb29fb7f669dde2271c7b5dc21a3a73245ad126cbf38dea0acb14b49cbd
Opcode Fuzzy Hash: 3b90ad0729476ecb4b8dfa0a934eecc90f0811abd63ca37faf3dc3044e3de564
Instruction Fuzzy Hash: 1211C47AD0020DABDF149F69DC45AAFBBB5EF89320F00052AFD1263290D7759E45EB90

Function 00F3A6A6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F3A6CC

Part of subcall function 00F3A4CC: GetDisplayConfigBufferSizes.USER32(00000002,?,?), ref: 00F3A522

DisplayConfigGetDeviceInfo.USER32(?), ref: 00F3A70F

Strings

, xrefs: 00F3A705

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: ConfigDisplay$BufferDeviceInfoSizesmemset
String ID:
API String ID: 4257415688-3916222277
Opcode ID: 297f7c5eaf9e6d6b6704934d902c7b3dc92ec6e2813ab479173bc850020c8f74
Instruction ID: 1967e3c8d3b8c1d2b892f9a435ba8935385fcf806df1bcc1f53c2e4105021014
Opcode Fuzzy Hash: 297f7c5eaf9e6d6b6704934d902c7b3dc92ec6e2813ab479173bc850020c8f74
Instruction Fuzzy Hash: 7811C476D012298BDB10CFA5C94579EBBF4AF44720F210129DD05AB381DB78DE04DBD1

Function 00F3EB17 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00F3EB33
TaskDialogIndirect.COMCTL32(00000060,00000001,00000000,00000000,?,00000000,00000000), ref: 00F3EB79

Strings

`, xrefs: 00F3EB49

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: DialogIndirectTaskmemset
String ID: `
API String ID: 3334335582-2679148245
Opcode ID: a4f103fdd955f82b9fd4e279eb4d7cd82edcd02d7b593fd781affe6c9e970ee4
Instruction ID: 5f0b48605d65164c312de696b9403baff6658408fd8d83a59b7bced6b13d70b3
Opcode Fuzzy Hash: a4f103fdd955f82b9fd4e279eb4d7cd82edcd02d7b593fd781affe6c9e970ee4
Instruction Fuzzy Hash: 6C01E1B5900358ABDF20DF99CD49BCEBFBDEF81724F10012AE505AB280D7B45948DB50

Function 00F38FF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetMonitorInfoW.USER32(?,?), ref: 00F39020
CreateDCW.GDI32(?,?,00000000,00000000), ref: 00F39034

Strings

h, xrefs: 00F39016

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: CreateInfoMonitor
String ID: h
API String ID: 3263162237-2439710439
Opcode ID: 857acfaca7cf85f4f75ea52390f47bdc4675a016c2d62e4f3bb7afdab8bc6794
Instruction ID: 2b622b4f4406c0261f71486ae614f4bcf733aefba6a74fe42471013eef0e7bce
Opcode Fuzzy Hash: 857acfaca7cf85f4f75ea52390f47bdc4675a016c2d62e4f3bb7afdab8bc6794
Instruction Fuzzy Hash: F6F08C72514704AFC724DF34D845F577BE8AB58360F518A1DF996C3190EB74E900DBA2

Function 00F3F857 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,AtlThunk_AllocateData), ref: 00F3F85E
EncodePointer.KERNEL32(00000000,?,00F3FC57,00F428BC,?,00F3F9CB,?,00000000,?,00F36D51,00000000,?,00000000,00F3615B,00000000,00000000), ref: 00F3F86D

Strings

AtlThunk_AllocateData, xrefs: 00F3F85C

Memory Dump Source

Source File: 00000000.00000002.1399136813.0000000000F31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F30000, based on PE: true

Associated: 00000000.00000002.1399117243.0000000000F30000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399163835.0000000000F42000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1399178924.0000000000F43000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f30000_Yu4oufkUC8.jbxd

Similarity

API ID: AddressEncodePointerProc
String ID: AtlThunk_AllocateData
API String ID: 1846120836-3926079072
Opcode ID: 53d1ed338591d9c7d7472bd27bcb1e3ef20f5373d0717dc21ed0265a1b5a28e5
Instruction ID: 38ed3c31c280599fd8d75b1b3284872f7382f2d0515736f7f13d3cc429f2c65a
Opcode Fuzzy Hash: 53d1ed338591d9c7d7472bd27bcb1e3ef20f5373d0717dc21ed0265a1b5a28e5
Instruction Fuzzy Hash: EBD0A775500308BB8B144F329809A677B5CAAE37217004028FC05C3210E536D409B534

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Yu4oufkUC8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Yu4oufkUC8.exePID: 5640, Parent PID: 4084

General

Chronological Activities

Disassembly

Analysis Process: Yu4oufkUC8.exePID: 5640, Parent PID: 4084COMMON

Execution Graph

Graph

Executed Functions

Function 00F36166 Relevance: 37.4, APIs: 16, Strings: 5, Instructions: 627synchronizationwindowregistryCOMMON

Control-flow Graph

Function 00F33BBD Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 171memoryCOMMON

Control-flow Graph

Windows Analysis Report
Yu4oufkUC8.exe

Function 00F36166 Relevance: 37.4, APIs: 16, Strings: 5, Instructions: 627
synchronizationwindowregistryCOMMON

Function 00F33BBD Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 171
memoryCOMMON

Function 00F403E9 Relevance: 10.6, APIs: 7, Instructions: 138
sleepCOMMON

Function 00F3F064 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
registryCOMMON

Function 00F3A74B Relevance: 3.1, APIs: 2, Instructions: 67
COMMON

Function 00F402FE Relevance: 3.0, APIs: 2, Instructions: 20
COMMONLIBRARYCODE

Function 00F3FE77 Relevance: 1.6, APIs: 1, Instructions: 56
COMMON

Function 00F403B0 Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Function 00F3EDC2 Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 227
windowCOMMON

Function 00F35245 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 457
registrystringCOMMON

Function 00F3BD3D Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 193
COMMON

Function 00F38AC0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 181
fileCOMMON

Function 00F3A1B6 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 277
COMMON

Function 00F39D26 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 235
timeCOMMON