Edit tour

Windows Analysis Report
5ZjBJd69zi.exe

Overview

General Information

Sample name:	5ZjBJd69zi.exe renamed because original name is a hash value
Original sample name:	167508c26c39acd68d3ea5229bfde9baeb769002.exe
Analysis ID:	1546800
MD5:	f8fe4a90e412f083ba00e5a82aaacd75
SHA1:	167508c26c39acd68d3ea5229bfde9baeb769002
SHA256:	acbc0c7b6c149dc9400eaaa19991877ac86b9c3e2d6d54294fc519ad611ea981
Tags:	exeReversingLabsuser-NDA0E
Infos:

Detection

Blihan Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Blihan Stealer

Creates an autostart registry key pointing to binary in C:\Windows

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Contains functionality to dynamically determine API calls

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

PE file contains sections with non-standard names

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

5ZjBJd69zi.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\5ZjBJd69zi.exe" MD5: F8FE4A90E412F083BA00E5A82AAACD75)

microsofthelp.exe (PID: 7108 cmdline: "C:\Windows\microsofthelp.exe" MD5: 8228E31D55A982D60FF2A093FC32E36E)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
5ZjBJd69zi.exe	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\microsofthelp.exe	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
00000001.00000000.2405440885.0000000000401000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
00000000.00000000.2405041765.0000000000401000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
00000001.00000002.3663123424.0000000000406000.00000080.00000001.01000000.00000004.sdmp	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
00000000.00000002.2405773168.000000000049E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
Process Memory Space: 5ZjBJd69zi.exe PID: 7092	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
Process Memory Space: microsofthelp.exe PID: 7108	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.5ZjBJd69zi.exe.4af438.1.unpack	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
0.2.5ZjBJd69zi.exe.4af438.1.raw.unpack	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
0.2.5ZjBJd69zi.exe.400000.0.unpack	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
1.2.microsofthelp.exe.400000.0.unpack	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
1.0.microsofthelp.exe.400000.0.unpack	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
0.0.5ZjBJd69zi.exe.400000.0.unpack	JoeSecurity_BlihanStealer	Yara detected Blihan Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\microsofthelp.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\5ZjBJd69zi.exe, ProcessId: 7092, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T15:56:45.172099+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.12	49710	TCP
2024-11-01T15:57:24.219172+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.12	49717	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 5ZjBJd69zi.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\microsofthelp.exe

Avira: detection malicious, Label: TR/Downloader.Gen

Multi AV Scanner detection for submitted file

Source: 5ZjBJd69zi.exe

ReversingLabs: Detection: 92%

Machine Learning detection for dropped file

Source: C:\Windows\microsofthelp.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 5ZjBJd69zi.exe

Joe Sandbox ML: detected

Source: 5ZjBJd69zi.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_00401C80 FindFirstFileA,FindClose,

0_2_00401C80

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.12:49710
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.12:49717

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_004017C0 HeapFree,InternetOpenA,InternetSetOptionExA,InternetOpenUrlA,GetProcessHeap,InternetReadFile,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlReAllocateHeap,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_004017C0

System Summary

PE file has a writeable .text section

Source: 5ZjBJd69zi.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: microsofthelp.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	File created: C:\Windows\microsofthelp.exe			Jump to behavior
Source: C:\Windows\microsofthelp.exe	File created: C:\Windows\HidePlugin.dll			Jump to behavior

Source: 5ZjBJd69zi.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@0/0

Source: C:\Windows\microsofthelp.exe

Mutant created: \Sessions\1\BaseNamedObjects\pomdfghrt

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5ZjBJd69zi.exe

ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

File read: C:\Users\user\Desktop\5ZjBJd69zi.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\5ZjBJd69zi.exe "C:\Users\user\Desktop\5ZjBJd69zi.exe"
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Process created: C:\Windows\microsofthelp.exe "C:\Windows\microsofthelp.exe"
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Process created: C:\Windows\microsofthelp.exe "C:\Windows\microsofthelp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\microsofthelp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\microsofthelp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\microsofthelp.exe	Section loaded: wininet.dll	Jump to behavior

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_00401510 lstrcat,LoadLibraryA,GetProcAddress,

0_2_00401510

Source: 5ZjBJd69zi.exe	Static PE information: section name: .shoooo
Source: 5ZjBJd69zi.exe	Static PE information: section name: .imports
Source: microsofthelp.exe.0.dr	Static PE information: section name: .shoooo
Source: microsofthelp.exe.0.dr	Static PE information: section name: .imports

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_004041C0 push eax; ret

0_2_004041EE

Source: 5ZjBJd69zi.exe	Static PE information: section name: .shoooo entropy: 7.835447843663171
Source: microsofthelp.exe.0.dr	Static PE information: section name: .shoooo entropy: 7.835447843663171

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Executable created and started: C:\Windows\microsofthelp.exe

Jump to behavior

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

File created: C:\Windows\microsofthelp.exe

Jump to dropped file

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

File created: C:\Windows\microsofthelp.exe

Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run microsofthelp

Jump to behavior

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run microsofthelp			Jump to behavior
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run microsofthelp			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\microsofthelp.exe

File deleted: c:\users\user\desktop\5zjbjd69zi.exe

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-1662

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: GetProcessHeap,GetAdaptersInfo,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,GetAdaptersInfo,GetProcessHeap,HeapFree,

0_2_00401CC0

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_0-1702

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-1876

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_00401C80 FindFirstFileA,FindClose,

0_2_00401C80

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	API call chain: ExitProcess graph end node			graph_0-1664
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	API call chain: ExitProcess graph end node			graph_0-1895

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_00401510 lstrcat,LoadLibraryA,GetProcAddress,

0_2_00401510

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe

Code function: 0_2_00401000 EntryPoint,GetModuleFileNameA,Sleep,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,GetWindowsDirectoryA,lstrcat,lstrcmpiA,ExitProcess,Sleep,DeleteFileA,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,Sleep,CreateThread,wsprintfA,Sleep,WaitForSingleObject,

0_2_00401000

Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Code function: 0_2_00402D5E SetUnhandledExceptionFilter,		0_2_00402D5E
Source: C:\Users\user\Desktop\5ZjBJd69zi.exe	Code function: 0_2_00402D70 SetUnhandledExceptionFilter,		0_2_00402D70

Stealing of Sensitive Information

Yara detected Blihan Stealer

Source: Yara match	File source: 5ZjBJd69zi.exe, type: SAMPLE
Source: Yara match	File source: 0.2.5ZjBJd69zi.exe.4af438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ZjBJd69zi.exe.4af438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ZjBJd69zi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.microsofthelp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.microsofthelp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.5ZjBJd69zi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2405440885.0000000000401000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2405041765.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3663123424.0000000000406000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2405773168.000000000049E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5ZjBJd69zi.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: microsofthelp.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\microsofthelp.exe, type: DROPPED

Remote Access Functionality

Yara detected Blihan Stealer

Source: Yara match	File source: 5ZjBJd69zi.exe, type: SAMPLE
Source: Yara match	File source: 0.2.5ZjBJd69zi.exe.4af438.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ZjBJd69zi.exe.4af438.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.5ZjBJd69zi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.microsofthelp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.microsofthelp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.5ZjBJd69zi.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.2405440885.0000000000401000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2405041765.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3663123424.0000000000406000.00000080.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2405773168.000000000049E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5ZjBJd69zi.exe PID: 7092, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: microsofthelp.exe PID: 7108, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\microsofthelp.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	11 Registry Run Keys / Startup Folder	1 Process Injection	12 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	1 System Network Configuration Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
5ZjBJd69zi.exe	92%	ReversingLabs	Win32.Trojan.Blihan
5ZjBJd69zi.exe	100%	Avira	TR/Downloader.Gen
5ZjBJd69zi.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\microsofthelp.exe	100%	Avira	TR/Downloader.Gen
C:\Windows\microsofthelp.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546800
Start date and time:	2024-11-01 15:55:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5ZjBJd69zi.exe renamed because original name is a hash value
Original Sample Name:	167508c26c39acd68d3ea5229bfde9baeb769002.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 7 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
VT rate limit hit for: 5ZjBJd69zi.exe

Simulations

Behavior and APIs

Time	Type	Description
15:56:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run microsofthelp C:\Windows\microsofthelp.exe
15:56:50	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run microsofthelp C:\Windows\microsofthelp.exe

Process:	C:\Users\user\Desktop\5ZjBJd69zi.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	75084
Entropy (8bit):	5.734402464970277
Encrypted:	false
SSDEEP:	1536:qAo0+j2d6rnJqlIUlizbR9XwzSPamvDsdHgHSIQEvTbWh7MzdPAxHyHfOvwXIfIm:qAoVl4lX8Pvw2PamvDsdHgHSIQEvTbWD
MD5:	8228E31D55A982D60FF2A093FC32E36E
SHA1:	A545831A6E39D706758DEA6ED4C4622B790B087A
SHA-256:	A0B8B0DFA88DB6B7FA59FB16F29D6A8AE86F4EF7EC813CD117F1B3377E9644CA
SHA-512:	D26FC8BA5553711E93476949A9BE763D661F214ED7755B4ED14A019F8172092A38CF8FFB385430EBFCA0B3AB94BFA8D67C91C7582E70E02C9B90FE916D053F20
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: C:\Windows\microsofthelp.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@....2..........................................!..L.!This program cannot be run in DOS mode....$.......................................................K.....................`.......Rich....................PE..L......O.................8...8...............P....@.............................................................................x.......................PM...........................................................................................text....@.......8.......................rdata.......P.......<...................data....0...`...(...B...................shoooo..0.......(...j...................imports............................@...................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	5.74620231769737
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5ZjBJd69zi.exe
File size:	74'824 bytes
MD5:	f8fe4a90e412f083ba00e5a82aaacd75
SHA1:	167508c26c39acd68d3ea5229bfde9baeb769002
SHA256:	acbc0c7b6c149dc9400eaaa19991877ac86b9c3e2d6d54294fc519ad611ea981
SHA512:	5ed8d852eee09d6a92c9b3ffc6feb1fd32a2c0e35e436552e9b5b3d560b1bbc6032a3ed0e3db8aff527457174a202f0f759eb124f21d54ef76f9abf02d087857
SSDEEP:	1536:qAo0+j2d6rnJqlIUlizbR9XwzSPamvDsdHgHSIQEvTbWh7MzdPAxHyHfOvwXIfIE:qAoVl4lX8Pvw2PamvDsdHgHSIQEvTbW1
TLSH:	01737C53ADD88483D896243012E8EB7F6D7FBFC21E94915387D8FC1529A37C0DB2925A
File Content Preview:	MZ......................@....2..........................................!..L.!This program cannot be run in DOS mode....$.......................................................K.......................`.......Rich....................PE..L......O...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401000
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x4F179BFF [Thu Jan 19 04:28:47 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ed42d4abceb2444958dc2f2ce7063809

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push FFFFFFFFh
push 00404611h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 00000630h
push ebx
push ebp
push esi
push edi
mov ecx, 00000040h
xor eax, eax
lea edi, dword ptr [esp+0000013Dh]
mov byte ptr [esp+0000013Ch], 00000000h
rep stosd
stosw
stosb
lea eax, dword ptr [esp+0000013Ch]
push 00000104h
push eax
push 00000000h
call dword ptr [00405050h]
lea ecx, dword ptr [esp+14h]
call 00007FB1090CD17Dh
lea ecx, dword ptr [esp+0000013Ch]
push 00000000h
push ecx
lea ecx, dword ptr [esp+1Ch]
mov dword ptr [esp+00000650h], 00000000h
call 00007FB1090CD17Fh
test eax, eax
jne 00007FB1090CC3A4h
push 000003E8h
call dword ptr [0040504Ch]
lea edx, dword ptr [esp+0000013Ch]
push 00000000h
push edx
lea ecx, dword ptr [esp+1Ch]
call 00007FB1090CD15Dh
test eax, eax
je 00007FB1090CC360h
lea ecx, dword ptr [esp+14h]
call 00007FB1090CD310h
mov ebx, dword ptr [00405048h]
push eax
push 00000008h
mov dword ptr [004086E4h], eax
call ebx
push eax
call dword ptr [00405044h]
mov ecx, dword ptr [004086E4h]
mov dword ptr [004086E0h], eax

Rich Headers

Programming Language:

[C++] VS98 (6.0) SP6 build 8804
[ C ] VS98 (6.0) SP6 build 8804
[C++] VS98 (6.0) build 8168

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc000	0x78	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9800	0x4d50
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4000	0x3800	2ab7fd8c123b112cf3b5d1962a297b8d	False	0.5809849330357143	data	6.401056074083298	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5000	0x1000	0x600	28b0dcb84195a5ab4b77ee0c12902aea	False	0.45703125	data	4.732953369377026	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x6000	0x3000	0x2800	e9acbf5d01a439b581e4c01e8d2a5f39	False	0.0779296875	data	0.9614498560336738	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.shoooo	0x9000	0x3000	0x2800	a7b4ffd70e877fa95b9be758de40bb67	False	0.9544921875	data	7.835447843663171	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0xc000	0x1000	0x600	f70ebb256fe0ad244adedff7b8bda2b7	False	0.345703125	data	3.608258743690415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCreateKeyA, RegOpenKeyA, RegCloseKey
iphlpapi.dll	GetAdaptersInfo
KERNEL32.dll	GetStringTypeA, LCMapStringW, WaitForSingleObject, CreateThread, HeapFree, DeleteFileA, ExitProcess, lstrcmpiA, lstrcatA, GetWindowsDirectoryA, HeapAlloc, GetProcessHeap, Sleep, GetModuleFileNameA, CloseHandle, GetLastError, CreateMutexA, GetProcAddress, LoadLibraryA, HeapReAlloc, GetTickCount, FindClose, FindFirstFileA, TerminateProcess, CreateProcessA, CreateFileA, ReadFile, WriteFile, FlushFileBuffers, GetFileSize, LCMapStringA, GetStringTypeW, MultiByteToWideChar, GetOEMCP, GetACP, GetCPInfo, RtlUnwind, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, GetCurrentProcess, GetStdHandle, WideCharToMultiByte
WININET.dll	InternetOpenA, InternetSetOptionExA, InternetOpenUrlA, InternetCloseHandle, InternetReadFile
USER32.dll	wsprintfA

Target ID:	0
Start time:	10:56:26
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\5ZjBJd69zi.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5ZjBJd69zi.exe"
Imagebase:	0x400000
File size:	74'824 bytes
MD5 hash:	F8FE4A90E412F083BA00E5A82AAACD75
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: 00000000.00000000.2405041765.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: 00000000.00000002.2405773168.000000000049E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:56:26
Start date:	01/11/2024
Path:	C:\Windows\microsofthelp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\microsofthelp.exe"
Imagebase:	0x400000
File size:	75'084 bytes
MD5 hash:	8228E31D55A982D60FF2A093FC32E36E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: 00000001.00000000.2405440885.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: 00000001.00000002.3663123424.0000000000406000.00000080.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_BlihanStealer, Description: Yara detected Blihan Stealer, Source: C:\Windows\microsofthelp.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.2%
Total number of Nodes:	283
Total number of Limit Nodes:	3

Executed Functions

Function 00401000 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 309
memorysleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 00401049
Sleep.KERNEL32(000003E8), ref: 0040107F

Part of subcall function 00401E70: CreateFileA.KERNELBASE(?,80000000,00000000,?,00000003,00000080,00000000), ref: 00401F29

GetProcessHeap.KERNEL32(00000008,00000000), ref: 004010B3
RtlAllocateHeap.KERNEL32(00000000), ref: 004010B6
GetWindowsDirectoryA.KERNEL32(00000000,00000104,00000000,00012448), ref: 004010FA
lstrcat.KERNEL32(00000000,\microsofthelp.exe), ref: 0040110A
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040111D
ExitProcess.KERNEL32 ref: 004011AB
Sleep.KERNEL32(000007D0), ref: 004011F0
DeleteFileA.KERNEL32(004AF334), ref: 004011F7
GetProcessHeap.KERNEL32(00000008,?,00000000), ref: 004012A3
HeapFree.KERNEL32(00000000), ref: 004012A6
GetProcessHeap.KERNEL32(00000008,00000000,00000000), ref: 004012B3
HeapFree.KERNEL32(00000000), ref: 004012B6
Sleep.KERNEL32(000003E8,00000000), ref: 004012BD
CreateThread.KERNEL32(00000000,00000000,00401930,00000000,00000000,00000000), ref: 004012DF
wsprintfA.USER32 ref: 0040134F

Part of subcall function 00401D30: LoadLibraryA.KERNEL32(Shell32.dll,ShellExecuteExA,?), ref: 00401D3E
Part of subcall function 00401D30: GetProcAddress.KERNEL32(00000000), ref: 00401D45
Part of subcall function 00401D30: WaitForSingleObject.KERNEL32(?,0000EA60), ref: 00401D9B
Part of subcall function 00401D30: TerminateProcess.KERNEL32(?,00000000), ref: 00401DA8

Part of subcall function 00401DC0: RegOpenKeyA.ADVAPI32(80000001,Software\motherFucker,00000000), ref: 00401DD0

Sleep.KERNEL32(00000000), ref: 004013B3

Part of subcall function 00401B70: GetTickCount.KERNEL32 ref: 00401B91

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0040140D

Strings

\microsofthelp.exe, xrefs: 00401104
%s?mac=%02X-%02X-%02X-%02X-%02X-%02X, xrefs: 00401349
X`@, xrefs: 00401255
pomdfghrt, xrefs: 004011C2

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Heap$Process$Sleep$File$CreateFreeObjectSingleWait$AddressAllocateCountDeleteDirectoryExitLibraryLoadModuleNameOpenProcTerminateThreadTickWindowslstrcatlstrcmpiwsprintf
String ID: %s?mac=%02X-%02X-%02X-%02X-%02X-%02X$X`@$\microsofthelp.exe$pomdfghrt
API String ID: 2581394299-1931053007
Opcode ID: 7c86d722310137bea74e8926fe4469c2c242f417fb379d92e93ada3bf0e95c41
Instruction ID: c93c4410b6f9ce83984329ff30afab9ceec6f0109ae303d27975de2972423e7e
Opcode Fuzzy Hash: 7c86d722310137bea74e8926fe4469c2c242f417fb379d92e93ada3bf0e95c41
Instruction Fuzzy Hash: 92B1B471104341ABD310EB61DD85FAF77A8EB84748F00493EF545B72E1DB79A508CBAA

Function 00401A70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,00000000), ref: 00401A94
RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?), ref: 00401B24
RegSetValueExA.KERNELBASE(?,?,00000000,00000001,?), ref: 00401B50
RegCloseKey.KERNELBASE(?), ref: 00401B5B

Strings

microsofthelp, xrefs: 00401AA2
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00401A8A

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion\Run$microsofthelp
API String ID: 237177642-1634705127
Opcode ID: f7c400446dd4b0eaf363823c9acbb087059bbcb61e32a475db951db840792250
Instruction ID: b03c8cffa3ec6c7e040931d0d3628476303e7d830e5fa7719da2c02013b6585d
Opcode Fuzzy Hash: f7c400446dd4b0eaf363823c9acbb087059bbcb61e32a475db951db840792250
Instruction Fuzzy Hash: 7B213075204300AFE314CF54DD45BABB7E9FBC8704F10892DF699A7290D774A908CBA6

Function 00401E00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00401E36

Strings

D, xrefs: 00401E2E

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: D
API String ID: 963392458-2746444292
Opcode ID: 0f08fe3d5e39c7ad0f3b9866134e47126feb68cf31e5c23f9a2aaa827ce31891
Instruction ID: fd742313cb0a091491768e560f4c778023b14539371b139e9f1572b6239331a1
Opcode Fuzzy Hash: 0f08fe3d5e39c7ad0f3b9866134e47126feb68cf31e5c23f9a2aaa827ce31891
Instruction Fuzzy Hash: 73E0C2B1204205AFE700CB18C901F9FF3F9EBC4B04F00482DB28592160EBB4E80D8AA3

Function 00401E70 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000000,?,00000003,00000080,00000000), ref: 00401F29

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 244432acfb3134b082432ff8491b6debc7a3ecf6e80df1f238a0c7c9efdd7ce6
Instruction ID: 05550ef9e33e7e84e3b6bc3839cb9a3f78c36243665b6addbe76957046887e68
Opcode Fuzzy Hash: 244432acfb3134b082432ff8491b6debc7a3ecf6e80df1f238a0c7c9efdd7ce6
Instruction Fuzzy Hash: 652106729182019BE3148929DC047BF7695FBC4320F59463FFC59AB2E0D73C9D4A838A

Function 00401FB0 Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?,00000000,004010D2,00000000,00012448), ref: 00401FC4

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: b93a9b78cbd62f9fe948b498fb7911c449fe5431a5487516e5b23f81960dbb3c
Instruction ID: 43a84dae57fcb4f39ce841453d48ab4dd32bf7ac3f326298a40ffc40c6fe3ef3
Opcode Fuzzy Hash: b93a9b78cbd62f9fe948b498fb7911c449fe5431a5487516e5b23f81960dbb3c
Instruction Fuzzy Hash: F2D0C975204202BFD600CB14C984F2BBBE8EBC8344F10C80CB588C7264C230E840CB21

Function 00401FE0 Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,-00000104,?,?,00000000,004015BB,-00000104,?,?,00001001), ref: 00401FF4

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d51f81dfc302b25ed21715e1a4ec1d1ea5c212fa588abe32f30b4167e8c1f651
Instruction ID: 8412a9df26c4f65110dcd5ffe45d6d75a38598c42cfd04e715d6217de15bf98b
Opcode Fuzzy Hash: d51f81dfc302b25ed21715e1a4ec1d1ea5c212fa588abe32f30b4167e8c1f651
Instruction Fuzzy Hash: ECC012B5204202BFD600CB10CC80F2BB7ACEBC8300F10C80CB589C2164C230E844CB21

Function 00402010 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,?,004010DB,00000000,00012448), ref: 0040201B

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ed0b8a1cc943b172fc063eda297eab4dd0b697e40e826464df3d2352261a915f
Instruction ID: f380ff02c583651ec5e048fedd40acb13b80acef4397e412b4aeb2cfa76ed4a0
Opcode Fuzzy Hash: ed0b8a1cc943b172fc063eda297eab4dd0b697e40e826464df3d2352261a915f
Instruction Fuzzy Hash: 42C04C7140451147CA245F6CB94888677D89A0A3303250B5AB5B4E73E0C7744CCA8A94

Non-executed Functions

Function 004017C0 Relevance: 19.6, APIs: 13, Instructions: 133
memorynetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(-00000080,00000000,00000000,00000000,00000000), ref: 004017D4
InternetSetOptionExA.WININET(00000000,0000003C,?,00000004,00000000), ref: 004017F7
InternetOpenUrlA.WININET(00000000,?,?,?,84000100,00000000), ref: 00401825
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00401848
GetProcessHeap.KERNEL32(00000008,0000000C,?,84000100,00000000), ref: 00401870
RtlAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 00401873
GetProcessHeap.KERNEL32(00000008,?,?,84000100,00000000), ref: 004018B3
RtlAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 004018B6
GetProcessHeap.KERNEL32(00000008,?,?,?,84000100,00000000), ref: 004018C5
RtlReAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 004018C8
InternetReadFile.WININET(?,?,00000400,?), ref: 004018F9
InternetCloseHandle.WININET(?), ref: 00401910
InternetCloseHandle.WININET(00000000), ref: 00401918

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Internet$Heap$AllocateProcess$CloseFileHandleOpenRead$Option
String ID:
API String ID: 4239491033-0
Opcode ID: 27e194aba4e82846d3f4da33b5ed9e1d6c7b9291d0f5d1b706f76689d8bb74bc
Instruction ID: de712bc095ac002a8553a350c11476705d51c3392b1ed3ae2cb040fc4048f14c
Opcode Fuzzy Hash: 27e194aba4e82846d3f4da33b5ed9e1d6c7b9291d0f5d1b706f76689d8bb74bc
Instruction Fuzzy Hash: 6F419DB1200305AFE714DB65DD48E6B77ECEB84740F00892DBA5AE3290E674ED44CBA8

Function 00401CC0 Relevance: 9.0, APIs: 6, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI(00000000,004012F3), ref: 00401CD0
GetProcessHeap.KERNEL32(00000008,?,?,00000000,76E1F380,?,004012F3,?), ref: 00401CE7
RtlAllocateHeap.KERNEL32(00000000,?,004012F3,?), ref: 00401CEA
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 00401CFC
GetProcessHeap.KERNEL32(00000008,00000000,00000000,?,?,004012F3,?), ref: 00401D20
HeapFree.KERNEL32(00000000,?,004012F3,?), ref: 00401D23

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Heap$AdaptersInfoProcess$AllocateFree
String ID:
API String ID: 1547009028-0
Opcode ID: ae4cd1613d13a3508d5532ec1a729aa1a889069799b90c70b2f88935c34b7fe7
Instruction ID: dc2670a0019a1668092bca9973550d1eda5b32d409034f8e0507b86233cc308b
Opcode Fuzzy Hash: ae4cd1613d13a3508d5532ec1a729aa1a889069799b90c70b2f88935c34b7fe7
Instruction Fuzzy Hash: 49F028B25003107EE614ABB1ED89EAFB39DEFC4314F00883EF645A7291D6789C048B75

Function 00401510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67librarystringloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00401C40: GetModuleFileNameA.KERNEL32(00000000,00000000,00000000,?,00401550,?,00000104), ref: 00401C4D

lstrcat.KERNEL32(?,HidePlugin.dll), ref: 0040155D

Part of subcall function 00401C80: FindFirstFileA.KERNEL32(?,004AF438), ref: 00401C90
Part of subcall function 00401C80: FindClose.KERNEL32(00000000), ref: 00401C9C

LoadLibraryA.KERNEL32(?), ref: 004015C9
GetProcAddress.KERNEL32(00000000,WindowsHookExON), ref: 004015D9

Part of subcall function 00401FE0: WriteFile.KERNELBASE(?,-00000104,?,?,00000000,004015BB,-00000104,?,?,00001001), ref: 00401FF4

Part of subcall function 00402010: CloseHandle.KERNELBASE(00000000,?,004010DB,00000000,00012448), ref: 0040201B

Strings

WindowsHookExON, xrefs: 004015D3
HidePlugin.dll, xrefs: 00401557

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: File$CloseFind$AddressFirstHandleLibraryLoadModuleNameProcWritelstrcat
String ID: HidePlugin.dll$WindowsHookExON
API String ID: 3025667872-4170400652
Opcode ID: cfa9ba43bf56096691c989f4651af11862903b7cc85df6f345d9adcbdabb091c
Instruction ID: 1cfee7871fdb0a5e497566d1a60dc36b52138cb3ac88a2e81f3614d0223312f0
Opcode Fuzzy Hash: cfa9ba43bf56096691c989f4651af11862903b7cc85df6f345d9adcbdabb091c
Instruction Fuzzy Hash: 1321C275108340BBD314DB20CD86BDB73A8AB84B44F00493EB686A62E1EB78E544CA5A

Function 00401C80 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,004AF438), ref: 00401C90
FindClose.KERNEL32(00000000), ref: 00401C9C

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 396459ae9dbc40363b26d10f372c57bb8eb4907c95b21f3c69ddb9f91e0ef698
Instruction ID: 999be1285c1457e8b158f15fa6632ad0c06acd6332edbbb8b50b98010bf598bc
Opcode Fuzzy Hash: 396459ae9dbc40363b26d10f372c57bb8eb4907c95b21f3c69ddb9f91e0ef698
Instruction Fuzzy Hash: A3D05E748006006BDB129B35EA089AB3368B744310FC41B25A92C952E0E63E89199A55

Function 00402D5E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00002D18), ref: 00402D63

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 54329c6066849e8d6f66c2d2d63da4c5d0a37b205ba5cd890395b89ab1935c85
Instruction ID: 7baa2d917a238f68f9c444747c48ff2f2d2c5bfd5ec22148f497a587d35f09d0
Opcode Fuzzy Hash: 54329c6066849e8d6f66c2d2d63da4c5d0a37b205ba5cd890395b89ab1935c85
Instruction Fuzzy Hash: E7A002B4542B40DBEB009FA4AF5D70A3A61FEC4712770417AE541F26E8DFB40400EE9E

Function 00402D70 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00402D75

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 87a07ab88af14b4b861e53270df4e4bcad16118dd914d66932d628474a690077
Instruction ID: 2a2aa3ba8b16ee852c6eda22cbbbf5c917f74d603f65e28f191c167c999a12dc
Opcode Fuzzy Hash: 87a07ab88af14b4b861e53270df4e4bcad16118dd914d66932d628474a690077
Instruction Fuzzy Hash:

Function 004034C2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040352F
GetStdHandle.KERNEL32(000000F4,004053D4,00000000,?,00000000), ref: 00403605
WriteFile.KERNEL32(00000000), ref: 0040360C

Strings

..., xrefs: 00403581
Microsoft Visual C++ Runtime Library, xrefs: 004035DB
<program name unknown>, xrefs: 0040353F
pb@, xrefs: 004034D0
Runtime Error!Program: , xrefs: 00403595

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $pb@
API String ID: 3784150691-2760755561
Opcode ID: 494720bf53c82e86b4848cccfc41ffe18c81eb234ef754eb86fdfe3b02abf932
Instruction ID: 30caa44505c107635b1953f75765a1a395c4180280156776a196f92af409ceee
Opcode Fuzzy Hash: 494720bf53c82e86b4848cccfc41ffe18c81eb234ef754eb86fdfe3b02abf932
Instruction Fuzzy Hash: 7D31C3726002187EDF20AF608D45F9B3BACEB85306F5408BBF545B61D0E6799B848E59

Function 00403615 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,004035E6,?,Microsoft Visual C++ Runtime Library,00012010,?,004053D4,?,00405424,?,?,?,Runtime Error!Program: ), ref: 00403627
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040363F
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00403650
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0040365D

Strings

GetLastActivePopup, xrefs: 00403652
user32.dll, xrefs: 00403622
MessageBoxA, xrefs: 00403639
GetActiveWindow, xrefs: 0040364A

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 6648bb0cf6ab2364024db40a26a27d188e770c7a4f648041535ca084ddadecca
Instruction ID: f14f4256c31c583cabfc643d01e6b202917792f182549b03fd3d916eb0d30c8c
Opcode Fuzzy Hash: 6648bb0cf6ab2364024db40a26a27d188e770c7a4f648041535ca084ddadecca
Instruction Fuzzy Hash: 4C018035200701AAC7218FB59E88A6B3EDCE748646324083FA541F3390DA798841CA5D

Function 00401D30 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 33
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Shell32.dll,ShellExecuteExA,?), ref: 00401D3E
GetProcAddress.KERNEL32(00000000), ref: 00401D45
WaitForSingleObject.KERNEL32(?,0000EA60), ref: 00401D9B
TerminateProcess.KERNEL32(?,00000000), ref: 00401DA8

Strings

ShellExecuteExA, xrefs: 00401D34
Shell32.dll, xrefs: 00401D39
<, xrefs: 00401D63
@, xrefs: 00401D6B

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadObjectProcProcessSingleTerminateWait
String ID: <$@$Shell32.dll$ShellExecuteExA
API String ID: 147223314-455453916
Opcode ID: 30361c74d003b684e33ebe575471fed2f31caefad97197682b103e4892ec008c
Instruction ID: f3ee7dde88a2767ab9b9819a0d364dbdbe4749208eae26a4876106582c349e33
Opcode Fuzzy Hash: 30361c74d003b684e33ebe575471fed2f31caefad97197682b103e4892ec008c
Instruction Fuzzy Hash: DDF01970608340ABD700EF64D948B0FBBE4EBC9705F50892DF289B62A0C7B995048F9A

Function 004041EF Relevance: 13.7, APIs: 9, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,004054A0,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00404231
LCMapStringA.KERNEL32(00000000,00000100,0040549C,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 0040424D
LCMapStringA.KERNEL32(?,00000100,00000020,00000001,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 00404296
MultiByteToWideChar.KERNEL32(00000000,00000101,00000020,00000001,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?,00000000), ref: 004042CE
MultiByteToWideChar.KERNEL32(00000000,00000001,00000020,00000001,00000100,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 00404326
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 0040433C
LCMapStringW.KERNEL32(?,00000100,00000100,00000000,00000000,00000100,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 0040436F
LCMapStringW.KERNEL32(?,00000100,00000100,00000100,?,00000000,?,00000100,00000000,00000100,00000000,00000001,00000020,00000100,?), ref: 004043D7

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: cf6cd3ea0d53a4292b9b6c064744d10efb8a84b9d8ce6cda0e0d2f74403f721a
Instruction ID: 98ee5418c39406d66df4b3238e22c5ff09758f77d3906c2d4109edb63ff875be
Opcode Fuzzy Hash: cf6cd3ea0d53a4292b9b6c064744d10efb8a84b9d8ce6cda0e0d2f74403f721a
Instruction Fuzzy Hash: 2E516C71A00209EBDF218F94DD45E9F7FB5FB88754F10412AFA54B11A0C3398961DBA8

Function 00401610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 122
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004017C0: InternetOpenA.WININET(-00000080,00000000,00000000,00000000,00000000), ref: 004017D4
Part of subcall function 004017C0: InternetSetOptionExA.WININET(00000000,0000003C,?,00000004,00000000), ref: 004017F7
Part of subcall function 004017C0: InternetOpenUrlA.WININET(00000000,?,?,?,84000100,00000000), ref: 00401825
Part of subcall function 004017C0: InternetReadFile.WININET(00000000,?,00000400,?), ref: 00401848
Part of subcall function 004017C0: GetProcessHeap.KERNEL32(00000008,0000000C,?,84000100,00000000), ref: 00401870
Part of subcall function 004017C0: RtlAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 00401873
Part of subcall function 004017C0: GetProcessHeap.KERNEL32(00000008,?,?,84000100,00000000), ref: 004018B3
Part of subcall function 004017C0: RtlAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 004018B6

Part of subcall function 00401B70: GetTickCount.KERNEL32 ref: 00401B91

lstrcat.KERNEL32(?,?), ref: 004016CF
GetProcessHeap.KERNEL32(00000008,?), ref: 00401763
HeapFree.KERNEL32(00000000), ref: 00401766
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00401774
HeapFree.KERNEL32(00000000), ref: 00401777

Strings

X`@, xrefs: 00401637
x, xrefs: 004016A3

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Heap$InternetProcess$AllocateFreeOpen$CountFileOptionReadTicklstrcat
String ID: X`@$x
API String ID: 1655345245-717951356
Opcode ID: cb30632985af1e3c9f67740ed37206872311120655ae5bed39b305224cf2606c
Instruction ID: 3bf0248d1d02ff10fb603f448cc26978b7f31e24750967aed57f5272111a2168
Opcode Fuzzy Hash: cb30632985af1e3c9f67740ed37206872311120655ae5bed39b305224cf2606c
Instruction Fuzzy Hash: 4541E071109380EBD310EF24D880A9FBBA4EB95744F40483EF985A7391DB79D948CBA6

Function 00401930 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 99
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004017C0: InternetOpenA.WININET(-00000080,00000000,00000000,00000000,00000000), ref: 004017D4
Part of subcall function 004017C0: InternetSetOptionExA.WININET(00000000,0000003C,?,00000004,00000000), ref: 004017F7
Part of subcall function 004017C0: InternetOpenUrlA.WININET(00000000,?,?,?,84000100,00000000), ref: 00401825
Part of subcall function 004017C0: InternetReadFile.WININET(00000000,?,00000400,?), ref: 00401848
Part of subcall function 004017C0: GetProcessHeap.KERNEL32(00000008,0000000C,?,84000100,00000000), ref: 00401870
Part of subcall function 004017C0: RtlAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 00401873
Part of subcall function 004017C0: GetProcessHeap.KERNEL32(00000008,?,?,84000100,00000000), ref: 004018B3
Part of subcall function 004017C0: RtlAllocateHeap.KERNEL32(00000000,?,84000100,00000000), ref: 004018B6

Sleep.KERNEL32(00000000), ref: 00401A18
GetProcessHeap.KERNEL32(00000008,?,00000000,?,?,?,?,?,?,?,?,?,00404668,000000FF), ref: 00401A39
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00404668,000000FF), ref: 00401A40
GetProcessHeap.KERNEL32(00000008,00000000,00000000,?,?,?,?,?,?,?,?,?,00404668,000000FF), ref: 00401A51
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00404668,000000FF), ref: 00401A58
Sleep.KERNEL32(000927C0,00000000,?,?,?,?,?,?,?,?,?,00404668,000000FF), ref: 00401A63

Strings

X`@, xrefs: 0040195E

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Heap$InternetProcess$AllocateFreeOpenSleep$FileOptionRead
String ID: X`@
API String ID: 4027785372-2395966509
Opcode ID: ef5807f77e3d9209a1a73c8554bf5cae4dc84749adef77a81185759513a985a4
Instruction ID: 2a3d68a4cb3ad5a6740f31ececbff504450f23066a0547a1662793225cd4e481
Opcode Fuzzy Hash: ef5807f77e3d9209a1a73c8554bf5cae4dc84749adef77a81185759513a985a4
Instruction Fuzzy Hash: 22316DB5900205AFC610EF65DD89D1BB7ACFB40708F40493EF455A72A2DB39E858CBA9

Function 0040443E Relevance: 9.1, APIs: 6, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStringTypeW.KERNEL32(00000001,004054A0,00000001,00000000,?,00000100,00000000,00403BE9,00000001,00000020,00000100,?,00000000), ref: 0040447D
GetStringTypeA.KERNEL32(00000000,00000001,0040549C,00000001,00000000,?,00000100,00000000,00403BE9,00000001,00000020,00000100,?,00000000), ref: 00404497
GetStringTypeA.KERNEL32(00000000,?,00000100,00000020,00000001,?,00000100,00000000,00403BE9,00000001,00000020,00000100,?,00000000), ref: 004044CB
MultiByteToWideChar.KERNEL32(00403BE9,00000101,00000100,00000020,00000000,00000000,?,00000100,00000000,00403BE9,00000001,00000020,00000100,?,00000000), ref: 00404503
MultiByteToWideChar.KERNEL32(00403BE9,00000001,00000100,00000020,?,00000100,?,00000100,00000000,00403BE9,00000001,00000020,00000100,?), ref: 00404559
GetStringTypeW.KERNEL32(?,?,00000000,00000001,?,00000100,?,00000100,00000000,00403BE9,00000001,00000020,00000100,?), ref: 0040456B

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 8e854d9fa4f4398d75815cede1d979f26cdfc50dae45bf3eda8242ca51bb8a02
Instruction ID: 2188734dec57a6a0c26fce41748a14a73f6bfbabae9171f71f79f3fb2461c293
Opcode Fuzzy Hash: 8e854d9fa4f4398d75815cede1d979f26cdfc50dae45bf3eda8242ca51bb8a02
Instruction Fuzzy Hash: DB415DB2900219BFCF209F94DD85EAF7F68FB44750F10453AFA15A6290D3388951DAA8

Function 00401450 Relevance: 6.0, APIs: 4, Instructions: 17synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,?,?,004011CC,pomdfghrt), ref: 0040145A
GetLastError.KERNEL32(?,004011CC,pomdfghrt), ref: 00401462
CloseHandle.KERNEL32(00000000,?,004011CC,pomdfghrt), ref: 00401470
ExitProcess.KERNEL32 ref: 00401478

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: CloseCreateErrorExitHandleLastMutexProcess
String ID:
API String ID: 3398734568-0
Opcode ID: e089459fb3c133711734621798408cb0bf6eac9c580570532973a8d6c4f29ab0
Instruction ID: 9792b8971bcf3522c44d91a70b44a2a34ba3860b6ce640e96ef06d3b816d1a4e
Opcode Fuzzy Hash: e089459fb3c133711734621798408cb0bf6eac9c580570532973a8d6c4f29ab0
Instruction Fuzzy Hash: 25D09E35645610ABE65027A4AE0DB5F7B64EB45752F104461FA09F91A0C6744C448EE9

Function 00403B4A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00403B5E

Strings

, xrefs: 00403BA7
, xrefs: 00403B83

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 2e9acfdf2129eec143310afa17a87b31ebc8fffb8175ec50fa4333e461519020
Instruction ID: 9fea7db5651f1ed54e8b234f10fcc364519221288e556eab496837c1a2af7e32
Opcode Fuzzy Hash: 2e9acfdf2129eec143310afa17a87b31ebc8fffb8175ec50fa4333e461519020
Instruction Fuzzy Hash: 42415A320082581AFB11AB14CE59BFB3FEC9B02705F1404FAD5C9F71D2C6794B489BAA

Function 00401DC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000001,Software\motherFucker,00000000), ref: 00401DD0
RegCreateKeyA.ADVAPI32(80000001,Software\motherFucker), ref: 00401DED

Strings

Software\motherFucker, xrefs: 00401DC6, 00401DE3

Memory Dump Source

Source File: 00000000.00000002.2405623435.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2405610333.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405640977.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405655773.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405669404.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405688362.0000000000409000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2405709558.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5ZjBJd69zi.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID: Software\motherFucker
API String ID: 436179556-2836984702
Opcode ID: fd27c9dd01183eb9183b13d0eab79d08815a2102ff50255ba53693f223f8de77
Instruction ID: 2502ecdb676ee3a5e9370ea0e6d3390d155e98568e7563ded56a1d124eb2bb05
Opcode Fuzzy Hash: fd27c9dd01183eb9183b13d0eab79d08815a2102ff50255ba53693f223f8de77
Instruction Fuzzy Hash: 0FD0A7B2150200BFE7045B50AC09FEB77D8FB98302F31456EF507B50D0D67494699A69

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5ZjBJd69zi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\microsofthelp.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
5ZjBJd69zi.exe

Function 00401000 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 309
memorysleepstringCOMMON

Function 00401A70 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70
registryCOMMON

Function 00401E00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24
processCOMMON

Function 00401E70 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Function 00401FB0 Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Function 00401FE0 Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Function 00402010 Relevance: 1.3, APIs: 1, Instructions: 10
COMMON

Function 004017C0 Relevance: 19.6, APIs: 13, Instructions: 133
memorynetworkfileCOMMON

Function 004034C2 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
fileCOMMON

Function 00403615 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMON

Function 00401D30 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 33
libraryloadersynchronizationCOMMON

Function 004041EF Relevance: 13.7, APIs: 9, Instructions: 177
COMMON

Function 00401610 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 122
memorystringCOMMON

Function 00401930 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 99
memorysleepCOMMON

Function 0040443E Relevance: 9.1, APIs: 6, Instructions: 117
COMMON