Edit tour

Windows Analysis Report
nsHwyCkyFr.exe

Overview

General Information

Sample name:	nsHwyCkyFr.exe renamed because original name is a hash value
Original sample name:	4a010c5abe2f5bb4dd6f31b03058bc1847e985a95a68d4e1bf0fb20c030c2307.exe
Analysis ID:	1555000
MD5:	c9c4ac12004cc6b946cb7d49b5eb5ee5
SHA1:	7e738b153194c9f54aac1b433f8e7efff3beafd5
SHA256:	4a010c5abe2f5bb4dd6f31b03058bc1847e985a95a68d4e1bf0fb20c030c2307
Tags:	ConsolHQLTDexeuser-JAMESWT_MHT
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

nsHwyCkyFr.exe (PID: 7640 cmdline: "C:\Users\user\Desktop\nsHwyCkyFr.exe" MD5: C9C4AC12004CC6B946CB7D49B5EB5EE5)

javaw.exe (PID: 7656 cmdline: "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher MD5: 6E0F4F812AE02FBCB744A929E74A04B8)

icacls.exe (PID: 7744 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 7756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: nsHwyCkyFr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: nsHwyCkyFr.exe

Static PE information: certificate valid

Source: nsHwyCkyFr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH

Source: javaw.exe, 00000001.00000002.1364470301.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: nsHwyCkyFr.exe	String found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: nsHwyCkyFr.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0
Source: nsHwyCkyFr.exe	String found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: nsHwyCkyFr.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: nsHwyCkyFr.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: nsHwyCkyFr.exe	String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: javaw.exe, 00000001.00000002.1364470301.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: nsHwyCkyFr.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: nsHwyCkyFr.exe	String found in binary or memory: http://ocsps.ssl.com0?
Source: nsHwyCkyFr.exe	String found in binary or memory: http://ocsps.ssl.com0_
Source: javaw.exe, 00000001.00000002.1364470301.0000000004A8A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.1364232608.0000000004968000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.1364470301.0000000004A20000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.oracle.com/technetwork/java/javase/documentation/index.html
Source: nsHwyCkyFr.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: nsHwyCkyFr.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: nsHwyCkyFr.exe	String found in binary or memory: https://www.ssl.com/repository0

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe	Code function: 0_2_00405D30		0_2_00405D30
Source: C:\Users\user\Desktop\nsHwyCkyFr.exe	Code function: 0_2_004013B0		0_2_004013B0

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe

Code function: String function: 00406E10 appears 37 times

Source: nsHwyCkyFr.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: clean4.winEXE@6/2@0/0

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe

Code function: 0_2_00401ED0 GetLastError,puts,ShellExecuteA,printf,fclose,MessageBoxA,FormatMessageA,strlen,strcat,LocalFree,fprintf,fprintf,fprintf,

0_2_00401ED0

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe

Code function: 0_2_00402CB0 FindResourceExA,LoadResource,LockResource,fprintf,atoi,SetLastError,

0_2_00402CB0

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7756:120:WilError_03

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: nsHwyCkyFr.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nsHwyCkyFr.exe

String found in binary or memory: --l4j-Startup error message not defined.Launcher:%s

Source: unknown	Process created: C:\Users\user\Desktop\nsHwyCkyFr.exe "C:\Users\user\Desktop\nsHwyCkyFr.exe"
Source: C:\Users\user\Desktop\nsHwyCkyFr.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\nsHwyCkyFr.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit

Jump to behavior

Source: nsHwyCkyFr.exe

Static PE information: certificate valid

Source: nsHwyCkyFr.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 1_2_0279A21B push ecx; ret	1_2_0279A225
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 1_2_0279A20A push ecx; ret	1_2_0279A21A
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 1_2_0279BB67 push 00000000h; mov dword ptr [esp], esp	1_2_0279BB8D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 1_2_0279B3B7 push 00000000h; mov dword ptr [esp], esp	1_2_0279B3DD
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 1_2_0279B947 push 00000000h; mov dword ptr [esp], esp	1_2_0279B96D
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Code function: 1_2_0279C477 push 00000000h; mov dword ptr [esp], esp	1_2_0279C49D

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: javaw.exe, 00000001.00000002.1363478563.0000000000C48000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllw
Source: javaw.exe, 00000001.00000003.1360617298.0000000014E6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000001.00000003.1360617298.0000000014E6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: javaw.exe, 00000001.00000002.1363478563.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: javaw.exe, 00000001.00000003.1360617298.0000000014E6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: javaw.exe, 00000001.00000002.1363478563.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: javaw.exe, 00000001.00000003.1360617298.0000000014E6F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe

Code function: 0_2_00401150 SetUnhandledExceptionFilter,__getmainargs,_iob,_iob,_setmode,_iob,_iob,_setmode,__p__fmode,__p__environ,_cexit,ExitProcess,

0_2_00401150

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\nsHwyCkyFr.exe	Process created: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe "C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher			Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M			Jump to behavior

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe

Code function: 1_2_027903C0 cpuid

1_2_027903C0

Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\java.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\7656 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jsse.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jfr.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 Services File Permissions Weakness	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	22 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nsHwyCkyFr.exe	5%	ReversingLabs
nsHwyCkyFr.exe	3%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0	nsHwyCkyFr.exe	false	high
http://crls.ssl.com/ssl.com-rsa-RootCA.crl0	nsHwyCkyFr.exe	false	high
http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0	nsHwyCkyFr.exe	false	high
http://bugreport.sun.com/bugreport/	javaw.exe, 00000001.00000002.1364470301.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ssl.com/repository0	nsHwyCkyFr.exe	false	high
http://ocsps.ssl.com0?	nsHwyCkyFr.exe	false	high
http://ocsps.ssl.com0_	nsHwyCkyFr.exe	false	high
http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0	nsHwyCkyFr.exe	false	high
http://java.oracle.com/	javaw.exe, 00000001.00000002.1364470301.0000000004A00000.00000004.00000800.00020000.00000000.sdmp	false	high
http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q	nsHwyCkyFr.exe	false	high
http://ocsps.ssl.com0	nsHwyCkyFr.exe	false	high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0	nsHwyCkyFr.exe	false	high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	nsHwyCkyFr.exe	false	high
http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0	nsHwyCkyFr.exe	false	high
http://www.oracle.com/technetwork/java/javase/documentation/index.html	javaw.exe, 00000001.00000002.1364470301.0000000004A8A000.00000004.00000800.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.1364232608.0000000004968000.00000004.00000020.00020000.00000000.sdmp, javaw.exe, 00000001.00000002.1364470301.0000000004A20000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555000
Start date and time:	2024-11-13 10:11:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nsHwyCkyFr.exe renamed because original name is a hash value
Original Sample Name:	4a010c5abe2f5bb4dd6f31b03058bc1847e985a95a68d4e1bf0fb20c030c2307.exe
Detection:	CLEAN
Classification:	clean4.winEXE@6/2@0/0
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 97% Number of executed functions: 26 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net
Execution Graph export aborted for target javaw.exe, PID 7656 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Xeno Executor Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://track.reviewmgr.com/ls/click?upn=u001.W5y-2Fhe84rCuLxXDO470nfuKD2Iz98QeQpE-2BkxRR0H-2BqB5cDKklujIJ5FLru7QrAASOSa17vR-2FSCLVAx4lWyy5Q-3D-3DNnGv_Yp4ydSxZWNatis3HtI6bBrJjg57JYwT6kbyY2f89Z-2FBhxNJZyCBl9w6yXNV0YfiKUAGjaILaAN0mF43Ydvv3aAXjCPBMrYvHXhqj-2F90M8IWSluK-2FDr0h4-2FIbAXpExZIWOjtRSKBCrpvm-2BHKZd6Q2itOPvvv8Wh8uHJq1rbQgzA92MMGG0eeFCZzQMnosAWydLTI7R4yQPl90fJpGVjewvRcCF77tY5-2B3PAHwq6SU-2Fc2kSK8E1mMumIEdp0dsw2BfptVK6-2FXO4Hh-2FAV8-2FJ5YFUs6qp3oyRx3LiWrBnDVYrVE-3D	Get hash	malicious	Unknown	Browse	13.107.246.45
	new.bat	Get hash	malicious	Unknown	Browse	13.107.246.45
	txt2.bat	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	DHL.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	https://eu-central-1.protection.sophos.com/?d=xxxlgroup.com&u=aHR0cHM6Ly9zZXJ2aWNlcy5pc3QueHh4bGdyb3VwLmNvbS9QYXltZW50U2VydmljZS8xNy8wWi8wMDAxYzk5YzBhYzVjMGUzMDAwMDNmMzgwMDAwODkxODE0Nzk3NWMy&i=NWM0YWFhZTFlYmMxMjgxMzI2Mzk1MmZj&t=UjJrRmV2QXpnYUF0RUsvV3haZ0lQMllKYVZRbjFESmtncHdLSjlTVGFWST0=&h=30d9cb4dc2a54dd59052f7a4a0edde4a&s=AVNPUEhUT0NFTkNSWVBUSVYENbLvm6o_1YsgOojZ1VDNrB0gxZ-tcqRfXFH68hrgRw	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://eu-central-1.protection.sophos.com/?d=xxxlgroup.com&u=aHR0cHM6Ly9zZXJ2aWNlcy5pc3QueHh4bGdyb3VwLmNvbS9QYXltZW50U2VydmljZS8xNy8wWi8wMDAxYzk5YzBhYzVjMGUzMDAwMDNmMzgwMDAwODkxODE0Nzk3NWMy&i=NWM0YWFhZTFlYmMxMjgxMzI2Mzk1MmZj&t=UjJrRmV2QXpnYUF0RUsvV3haZ0lQMllKYVZRbjFESmtncHdLSjlTVGFWST0=&h=30d9cb4dc2a54dd59052f7a4a0edde4a&s=AVNPUEhUT0NFTkNSWVBUSVYENbLvm6o_1YsgOojZ1VDNrB0gxZ-tcqRfXFH68hrgRw	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fportal.eftsure.com.au%2finvite%2f%7b5943C803%2d027A%2d43C9%2dBBBB%2dDE0322D1F961%7d&umid=92db6cfc-6cf7-46fe-8f32-20799b471c27&auth=3a5566c60b1f4d8525fa8ab109f94675a663eb25-8cbc03c09e9a72f57497c9be7e9f6ecc1a7de37e	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.803724516543196
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USdj5:oJ5bH
MD5:	1C1C2F686D3CB33AE32A072792237050
SHA1:	1ADBFA9B9F7CB61E0B4E8CC5F1F662F43CAB89CB
SHA-256:	6BF568D0EB022B4CC63148096B901C9DA0DD358C520B2D7F597D7CB4943110A0
SHA-512:	2BDD4D8059546B0A80274D548B8A45091B82860416C6669296F25AE08BC502DAB523A1EA289688B955D68ED2817310FC5326CCB9D831228BDBD0B2D5E1E03E36
Malicious:	false
Reputation:	low
Preview:	C:\Program Files (x86)\Java\jre-1.8..1731489119890..

C:\Users\user\AppData\Local\Temp\hsperfdata_user\7656

Download File

Process:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.235779558934585
Encrypted:	false
SSDEEP:	96:4y4r+F8GQvNbE5+Q6rOI28IQqSJYYBHG1bo1L:4yn8GQlbE5+Q67IsJ3HGd
MD5:	72D109B4527B038C452A7271D06470C1
SHA1:	B62EDADB250EF033942CCA5C5567F6C2BBA3F1D8
SHA-256:	F6A3F0151E5D9AC87F2FEE122EE1105F3249C859AFA79D59D31E6AA50D150EB4
SHA-512:	D03ED4484F6FA4C244362E6B1CCBBEF1268DA77B567F7D25FF6D6040800ED7176864ADA6D96D9A6361D3A10C4820D17E75712691FCDAD2E9BAF35E78E2DCBF09
Malicious:	false
Reputation:	low
Preview:	.........7......H.*..... .......8...........J...0...sun.rt._sync_Inflations.............8...........J...0...sun.rt._sync_Deflations.............@...........J...8...sun.rt._sync_ContendedLockAttempts..........8...........J...0...sun.rt._sync_FutileWakeups..........0...........J...(...sun.rt._sync_Parks..........@...........J...8...sun.rt._sync_EmptyNotifications.............8...........J...0...sun.rt._sync_Notifications..........8...........J...0...sun.rt._sync_SlowEnter..............8...........J...0...sun.rt._sync_SlowExit...............8...........J...0...sun.rt._sync_SlowNotify.............8...........J...0...sun.rt._sync_SlowNotifyAll..........8...........J...0...sun.rt._sync_FailedSpins............@...........J...8...sun.rt._sync_SuccessfulSpins................8...........J...0...sun.rt._sync_PrivateA...............8...........J...0...sun.rt._sync_PrivateB...............@...........J...8...sun.rt._sync_MonInCirculation...............8...........J...0...sun.rt._sync_MonScavenged...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.4182780858750075
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nsHwyCkyFr.exe
File size:	80'968 bytes
MD5:	c9c4ac12004cc6b946cb7d49b5eb5ee5
SHA1:	7e738b153194c9f54aac1b433f8e7efff3beafd5
SHA256:	4a010c5abe2f5bb4dd6f31b03058bc1847e985a95a68d4e1bf0fb20c030c2307
SHA512:	c324685c6a15299504c62724c3c465b28027e93269d1df325921ac3f9a531a60de4c6a0d1775ce0c4365717497146b7360b36b1b87c1d1bae6acc0e1adc68664
SSDEEP:	1536:RZ2FWSNhd/4131iae+a0jnLjujUi1QqJ6cF3PK:z2ddQ131iae+HjPujfJ6E3
TLSH:	EC83CF43B50E50F1E62709B081DAEDFFCB30924981536506EF985E65DF2376ABC0E19B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...y:.f.................b........................@.................................\|.....@... ............................

File Icon


Icon Hash:	bdb5bd98b3f3190d

Static PE Info

General

Entrypoint:	0x401290
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH
Time Stamp:	0x66D73A79 [Tue Sep 3 16:34:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	6011984d7c1f1b97a34d7517a498bff8

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	30/08/2024 08:25:00 30/08/2025 08:25:00
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=GB, OID.2.5.4.15=Private Organization, CN=ConsolHQ LTD, SERIALNUMBER=12800651, O=ConsolHQ LTD, L=Erith, C=GB
Version:	3
Thumbprint MD5:	E4ED28FFAC43E82D3DB5467DE244B770
Thumbprint SHA-1:	787863161875446360E7486D3CF5E34E15DC8009
Thumbprint SHA-256:	CA814262219EF4B9EF1CC76050E02D41B34F87AEF05D34FA378DAE913F4C784C
Serial:	740833F89CC52CAE8CEA1984A66DBB66

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 08h
mov dword ptr [esp], 00000002h
call dword ptr [00413290h]
call 00007F0BACAE5C5Dh
nop
lea esi, dword ptr [esi+00000000h]
push ebp
mov ecx, dword ptr [004132C8h]
mov ebp, esp
pop ebp
jmp ecx
lea esi, dword ptr [esi+00h]
push ebp
mov ecx, dword ptr [004132B4h]
mov ebp, esp
pop ebp
jmp ecx
nop
nop
nop
nop
push ebp
mov edx, 00000080h
mov ebp, esp
push edi
xor eax, eax
lea edi, dword ptr [ebp-00000118h]
push esi
push ebx
sub esp, 0000011Ch
mov dword ptr [esp+08h], edx
mov dword ptr [esp+04h], eax
mov dword ptr [esp], edi
call 00007F0BACAEB8C4h
mov dword ptr [esp+04h], edi
mov dword ptr [esp], 00000018h
call 00007F0BACAE6B6Ch
test eax, eax
je 00007F0BACAE5E32h
mov dword ptr [esp], 00000000h
xor ecx, ecx
xor ebx, ebx
mov dword ptr [esp+04h], ebx
xor esi, esi
mov dword ptr [esp+0Ch], ecx
mov dword ptr [esp+08h], esi
call 00007F0BACAEBA26h
sub esp, 10h
test eax, eax
mov ebx, eax
je 00007F0BACAE5E07h
lea esi, dword ptr [ebp-00000098h]
mov esi, esi
mov dword ptr [esp+04h], esi
mov eax, 0000007Fh
mov dword ptr [esp+08h], eax
mov dword ptr [esp], ebx
call 00007F0BACAEBA08h
sub esp, 0Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13000	0xaa8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x9a0c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x11600	0x2648
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13200	0x188	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6080	0x6200	7a3818cabc9cf80103d368f58fbe48cf	False	0.47401147959183676	data	5.982433201699597	IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x40	0x200	3d4489f93d799c2f1cd6cbf1959b8bcf	False	0.052734375	data	0.1638075416558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x9000	0x510	0x600	0ba33aaa7c8de2d9ce0b1ff96bd9e64a	False	0.46484375	data	5.01354615045612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0xa000	0x8e30	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13000	0xaa8	0xc00	ef152b96063582fc8f2bd1e1fd8a5e6f	False	0.3697916666666667	data	4.652641333274655	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14000	0x9a0c	0x9c00	62b491b7e63c32ffaf9ad85db79d7cc7	False	0.9676732772435898	data	7.914760707660448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x14358	0x94d1	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9972963750426542
RT_RCDATA	0x1d82c	0x4	data	3.0
RT_RCDATA	0x1d830	0x6	data	2.3333333333333335
RT_RCDATA	0x1d838	0x2	data	5.0
RT_RCDATA	0x1d83c	0x16	data	1.3636363636363635
RT_RCDATA	0x1d854	0x29	ASCII text, with no line terminators	1.0975609756097562
RT_RCDATA	0x1d880	0x6	data	2.3333333333333335
RT_RCDATA	0x1d888	0x2	data	5.0
RT_RCDATA	0x1d88c	0x3	ASCII text, with no line terminators	3.6666666666666665
RT_RCDATA	0x1d890	0x19	ASCII text, with no line terminators	1.32
RT_RCDATA	0x1d8ac	0x2	data	5.0
RT_RCDATA	0x1d8b0	0x32	data	1.16
RT_RCDATA	0x1d8e4	0x73	ASCII text, with no line terminators	0.8695652173913043
RT_RCDATA	0x1d958	0x35	ASCII text, with no line terminators	1.1320754716981132
RT_RCDATA	0x1d990	0x68	data	0.875
RT_GROUP_ICON	0x1d9f8	0x14	data	1.1

Imports

DLL	Import
ADVAPI32.DLL	RegCloseKey, RegEnumKeyExA, RegOpenKeyExA, RegQueryValueExA
KERNEL32.dll	CloseHandle, CreateMutexA, CreateProcessA, ExitProcess, FindResourceExA, FormatMessageA, GetCommandLineA, GetCurrentDirectoryA, GetCurrentProcess, GetEnvironmentVariableA, GetExitCodeProcess, GetLastError, GetModuleFileNameA, GetModuleHandleA, GetProcAddress, GetStartupInfoA, GlobalMemoryStatusEx, LoadResource, LocalFree, LockResource, SetEnvironmentVariableA, SetLastError, SetUnhandledExceptionFilter, WaitForSingleObject
msvcrt.dll	__getmainargs, __p__environ, __p__fmode, __set_app_type, _cexit, _chdir, _close, _findclose, _findfirst, _findnext, _iob, _itoa, _onexit, _open, _read, _setmode, _stat, atexit, atoi, fclose, fopen, fprintf, fwrite, memset, printf, puts, signal, strcat, strchr, strcmp, strcpy, strlen, strncat, strncpy, strpbrk, strrchr, strstr, strtok
SHELL32.DLL	ShellExecuteA
USER32.dll	CreateWindowExA, DispatchMessageA, EnumWindows, FindWindowExA, GetMessageA, GetSystemMetrics, GetWindowLongA, GetWindowRect, GetWindowTextA, GetWindowThreadProcessId, KillTimer, LoadImageA, MessageBoxA, PostQuitMessage, SendMessageA, SetForegroundWindow, SetTimer, SetWindowPos, ShowWindow, TranslateMessage, UpdateWindow

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 10:11:55.404519081 CET	1.1.1.1	192.168.2.9	0x1cd9	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 10:11:55.404519081 CET	1.1.1.1	192.168.2.9	0x1cd9	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	04:11:59
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\nsHwyCkyFr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nsHwyCkyFr.exe"
Imagebase:	0x400000
File size:	80'968 bytes
MD5 hash:	C9C4AC12004CC6B946CB7D49B5EB5EE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:11:59
Start date:	13/11/2024
Path:	C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
Imagebase:	0x210000
File size:	257'664 bytes
MD5 hash:	6E0F4F812AE02FBCB744A929E74A04B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:11:59
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Imagebase:	0xc00000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:11:59
Start date:	13/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	27%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26%
Total number of Nodes:	688
Total number of Limit Nodes:	15

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00405D30 Relevance: 163.4, APIs: 70, Strings: 23, Instructions: 688
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,004013C7), ref: 00405D4D
memset.MSVCRT ref: 00405DCC
GetModuleFileNameA.KERNEL32(004013C7), ref: 00405DE8
strrchr.MSVCRT ref: 00405E0A
GetModuleHandleA.KERNEL32 ref: 00405E46
GetProcAddress.KERNEL32 ref: 00405E5A
GetCurrentProcess.KERNEL32 ref: 00405E68
fprintf.MSVCRT ref: 00405EAB
FindResourceExA.KERNEL32 ref: 00405ED3
LoadResource.KERNEL32 ref: 00405EF0
LockResource.KERNEL32 ref: 00405EFF

Strings

\bin, xrefs: 004062C1
bin\java.exe, xrefs: 00406600
ch4j, xrefs: 00405D7C
Launcher:%s, xrefs: 0040672C
Launcher args:%s, xrefs: 0040674F
Args length:%d/32768 chars, xrefs: 0040677B
Working dir:%s, xrefs: 004064AA
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004062A7, 004065DF, 00406609, 00406727, 004067E2
Resource %d:%s, xrefs: 00406408, 00406430, 00406458, 004065AF, 0040679F, 004067CB
Instance already exists., xrefs: 00406485
WOW64:%s, xrefs: 00405E9F
Error:%s, xrefs: 00406338, 0040648A
appendToPathVar failed., xrefs: 0040632C
bin\javaw.exe, xrefs: 00406803
Laun, xrefs: 00405D77
C:\Users\user\Desktop, xrefs: 0040617E
-Xmx, xrefs: 00406671
An error occurred while starting the application., xrefs: 0040636D, 004063FA
-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher, xrefs: 00406665, 004066A3, 004066EE, 0040674A, 0040676B
-Xms, xrefs: 00406636
IsWow64Process, xrefs: 00405E4E
yes, xrefs: 00405E8D
Startup error message not defined., xrefs: 00406380

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: ModuleResource$Handle$AddressCurrentFileFindLoadLockNameProcProcessfprintfmemsetstrrchr
String ID: -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher$-Xms$-Xmx$An error occurred while starting the application.$Args length:%d/32768 chars$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$C:\Users\user\Desktop$Error:%s$Instance already exists.$IsWow64Process$Laun$Launcher args:%s$Launcher:%s$Resource %d:%s$Startup error message not defined.$WOW64:%s$Working dir:%s$\bin$appendToPathVar failed.$bin\java.exe$bin\javaw.exe$ch4j$yes
API String ID: 919401838-82608069
Opcode ID: e98f0b280fdfade851ebe13318b98efc7c14c0c3f0ba294e535c625494688a31
Instruction ID: bf9eff1d8a15de45e5a137a0cf06cc9be9fda6a92e4b939ea636d94b2118cc52
Opcode Fuzzy Hash: e98f0b280fdfade851ebe13318b98efc7c14c0c3f0ba294e535c625494688a31
Instruction Fuzzy Hash: 6A521EB09087018BD714EF29D58025EBBE1EF84344F15C87FE889AB391DB7C89658F4A

Function 004013B0 Relevance: 58.1, APIs: 27, Strings: 6, Instructions: 365
stringtimewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405D30: GetModuleHandleA.KERNEL32(?,004013C7), ref: 00405D4D

strstr.MSVCRT ref: 0040140E
CreateWindowExA.USER32 ref: 004014B1
SetTimer.USER32 ref: 004014FA
GetMessageA.USER32 ref: 00401572

Part of subcall function 00401ED0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,004013DA), ref: 00401ED7
Part of subcall function 00401ED0: puts.MSVCRT ref: 00401F11
Part of subcall function 00401ED0: ShellExecuteA.SHELL32 ref: 00401F5A

memset.MSVCRT ref: 00401873
ShowWindow.USER32 ref: 0040189A
SetForegroundWindow.USER32 ref: 004018A5

Strings

Exit code:%d, restarting the application!, xrefs: 0040159F
--l4j-dont-wait, xrefs: 00401600
STATIC, xrefs: 00401498
Exit code:%d, xrefs: 00401820
--l4j-no-splash-err, xrefs: 0040168D
--l4j-no-splash, xrefs: 00401405

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Window$CreateErrorExecuteForegroundHandleLastMessageModuleShellShowTimermemsetputsstrstr
String ID: --l4j-dont-wait$--l4j-no-splash$--l4j-no-splash-err$Exit code:%d$Exit code:%d, restarting the application!$STATIC
API String ID: 2862500452-2488410787
Opcode ID: ef69a45fb9a8d98a3e7d4beaa163ba7c94590803dc5b94dc991fefc783aab643
Instruction ID: 24b147bc9a002fea4a62b88368d981a48f0c15b8e85cb8378e8374e035e88a4e
Opcode Fuzzy Hash: ef69a45fb9a8d98a3e7d4beaa163ba7c94590803dc5b94dc991fefc783aab643
Instruction Fuzzy Hash: CBE14CB19083018BD714EF3AD54131BBAE5AF84344F01C93FE989A73A1DB78D8519B8B

Function 00402CB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32 ref: 00402D84
LoadResource.KERNEL32 ref: 00402DA1
LockResource.KERNEL32 ref: 00402DB0
fprintf.MSVCRT ref: 00402DF8
atoi.MSVCRT ref: 00402E03

Strings

`O@, xrefs: 00402D2C, 00402CEE
Resource %d:%s, xrefs: 00402DE8

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$FindLoadLockatoifprintf
String ID: Resource %d:%s$`O@
API String ID: 2193512306-2494596910
Opcode ID: d2c659763aea7fa65e5a142a8afab7499bcdc8dbce1d9b0d6845306160327ef1
Instruction ID: 0e451c3d1c8705976eb6372eae49d11802872584f9afc5ab120ed64a9f793ad4
Opcode Fuzzy Hash: d2c659763aea7fa65e5a142a8afab7499bcdc8dbce1d9b0d6845306160327ef1
Instruction Fuzzy Hash: 1C4151709083059BDB149F29D68426EBBE1EF84300F14847FD885B73D0D6B8DD519B8A

Function 00401150 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
__getmainargs.MSVCRT ref: 0040119A
_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode_cexit
String ID:
API String ID: 3695137517-0
Opcode ID: 60854d5bb89194ddad18fca627b3fed1a2910dcd429b76d8ba96fdf7a2bac1dc
Instruction ID: 9b036dcc62e5206002a8964a93b809c6819fe7ae1a2a78e05521c6610f765c41
Opcode Fuzzy Hash: 60854d5bb89194ddad18fca627b3fed1a2910dcd429b76d8ba96fdf7a2bac1dc
Instruction Fuzzy Hash: 34212AB4A053048FC704FF65D58161ABBF5BF88344F01C93EE895A73A6DB389850CB5A

Function 00405390 Relevance: 121.2, APIs: 58, Strings: 11, Instructions: 479
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004053CE
memset.MSVCRT ref: 004053EB
memset.MSVCRT ref: 00405406
memset.MSVCRT ref: 00405422
FindResourceExA.KERNEL32(?,00000000,00000000), ref: 00405454
LoadResource.KERNEL32(?,?,?,00406706), ref: 00405471
LockResource.KERNEL32(?,?,?,?,?,00406706), ref: 00405480
fprintf.MSVCRT ref: 004054C8
FindResourceExA.KERNEL32 ref: 0040550D
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,00406706), ref: 00405529
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406706), ref: 00405538
fprintf.MSVCRT ref: 00405592
FindResourceExA.KERNEL32 ref: 004055BA
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406706), ref: 004055D7
LockResource.KERNEL32 ref: 004055EA
FindResourceExA.KERNEL32 ref: 00405649
LoadResource.KERNEL32 ref: 00405666
LockResource.KERNEL32 ref: 00405679
strlen.MSVCRT ref: 004056EE
strtok.MSVCRT ref: 00405738
strpbrk.MSVCRT ref: 00405769
strrchr.MSVCRT ref: 00405784
strncpy.MSVCRT ref: 004057B3
_findfirst.MSVCRT ref: 004057C8
_findnext.MSVCRT ref: 004057ED
strcpy.MSVCRT ref: 004057FD
strcat.MSVCRT ref: 00405813
strlen.MSVCRT ref: 0040581F
fprintf.MSVCRT ref: 0040584F
_findnext.MSVCRT ref: 00405861
_findclose.MSVCRT ref: 00405873
strtok.MSVCRT ref: 00405888
strlen.MSVCRT ref: 004058A3
strlen.MSVCRT ref: 004058B6
strcat.MSVCRT ref: 004058D9
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406706), ref: 004058ED
strlen.MSVCRT ref: 00405911
strcat.MSVCRT ref: 00405936
strlen.MSVCRT ref: 00405942
strlen.MSVCRT ref: 00405967
strncat.MSVCRT ref: 00405997
strlen.MSVCRT ref: 0040599F
strcat.MSVCRT ref: 004059C8
strlen.MSVCRT ref: 004059D4
fprintf.MSVCRT ref: 004059EE
strpbrk.MSVCRT ref: 004059FF
strcat.MSVCRT ref: 00405A1C
strlen.MSVCRT ref: 00405A28
SetLastError.KERNEL32 ref: 00405A40
fwrite.MSVCRT ref: 00405A79
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00406706), ref: 00405A8A
SetLastError.KERNEL32(?,?,?,00406706), ref: 00405AA5
strcat.MSVCRT ref: 00405AC7
strlen.MSVCRT ref: 00405AD3

Strings

" :%s, xrefs: 00405842
true, xrefs: 004054D5
org.develnext.jphp.ext.javafx.FXLauncher, xrefs: 0040589E, 004058F2, 00405B10
sspa, xrefs: 004056D1
th ", xrefs: 004056DD
-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher, xrefs: 004056E7, 00405802, 00405818, 00405897, 004058AF, 004058D2, 00405900, 00405907, 0040592B, 0040593B, 0040595B, 00405962, 004059B7, 004059CD, 00405A15, 00405A21, 00405ABC, 00405ACC, 00405AE9, 00405AFF
Resource %d:%s, xrefs: 004054B8, 00405585, 00405B1E, 00405B47
Add classpath:%s, xrefs: 004059E2
-jar, xrefs: 0040590C
-jar, xrefs: 00405972
-cla, xrefs: 004056F9

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$strlen$strcat$ErrorFindLastLoadLockfprintfmemset$_findnextstrpbrkstrtok$_findclose_findfirstfwritestrcpystrncatstrncpystrrchr
String ID: " :%s$-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher$-cla$-jar$-jar$Add classpath:%s$Resource %d:%s$org.develnext.jphp.ext.javafx.FXLauncher$sspa$th "$true
API String ID: 689643918-1453997902
Opcode ID: f3cc387d6fe282e7dd2616dd62daa608cb237d8618ec9fd67493d2c34684ebff
Instruction ID: 45e07854ae54010095be9281c7dcb4a820f195fbc1c947dc7b9175b2af9540e9
Opcode Fuzzy Hash: f3cc387d6fe282e7dd2616dd62daa608cb237d8618ec9fd67493d2c34684ebff
Instruction Fuzzy Hash: AE1261B09087018BD710AF29C54065BBBE5EF94304F0589BFE8C9AB391D77D8995CF8A

Function 00404740 Relevance: 89.8, APIs: 43, Strings: 8, Instructions: 553
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32 ref: 0040478A
LoadResource.KERNEL32 ref: 004047A7
LockResource.KERNEL32 ref: 004047B6
fprintf.MSVCRT ref: 00404808
FindResourceExA.KERNEL32 ref: 0040484F
LoadResource.KERNEL32 ref: 0040486C
LockResource.KERNEL32 ref: 0040487B
fprintf.MSVCRT ref: 004048D0
strchr.MSVCRT ref: 004048F0
strlen.MSVCRT ref: 004048FF
strcpy.MSVCRT ref: 0040491D
FindResourceExA.KERNEL32 ref: 00404946
LoadResource.KERNEL32 ref: 00404962
LockResource.KERNEL32 ref: 00404971
SetLastError.KERNEL32 ref: 00404C82

Strings

true, xrefs: 00404818
1.8.0, xrefs: 004048B5, 004048E0, 00404914, 00404B05, 00404B0E, 00404CBA
1.8.0, xrefs: 0040490D, 00404A2C, 00404A7D, 00404AFC, 00404B29, 00404B40
C:\Program Files (x86)\Java\jre-1.8, xrefs: 00404CFB, 00404EAC
Runtime used:%s (%s-bit), xrefs: 00404D32, 00404EDF
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 00404CF4, 00404EA5
Resource %d:%s, xrefs: 004047F8, 004048C3, 004049C3, 00404F19, 00404FEA
1.8.0_381, xrefs: 00404D2D, 00404EDA

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$FindLoadLock$fprintf$ErrorLaststrchrstrcpystrlen
String ID: 1.8.0$1.8.0$1.8.0_381$C:\Program Files (x86)\Java\jre-1.8$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$Resource %d:%s$Runtime used:%s (%s-bit)$true
API String ID: 1095060389-3579399910
Opcode ID: f6b770761259c2e060e376a2df3e08878bd46d2002b65d4fedf3764ae1e6227b
Instruction ID: 877def55760d6699fa8b0a675f498fd38e355f95ffd6f34839a3e279e3ce58b8
Opcode Fuzzy Hash: f6b770761259c2e060e376a2df3e08878bd46d2002b65d4fedf3764ae1e6227b
Instruction Fuzzy Hash: 70225DB4A083019BD700AF65D64435FBBE1AB84344F01C87FE989AB3C2D77C9955DB8A

Function 00402920 Relevance: 52.7, APIs: 23, Strings: 7, Instructions: 218
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 0040296B
RegOpenKeyExA.ADVAPI32 ref: 00402998
memset.MSVCRT ref: 004029DE
memset.MSVCRT ref: 004029F9
memset.MSVCRT ref: 00402A11
strcmp.MSVCRT ref: 00402A2A
RegEnumKeyExA.ADVAPI32 ref: 00402A99
strcpy.MSVCRT ref: 00402AB3
strlen.MSVCRT ref: 00402ABB
strcat.MSVCRT ref: 00402ADA
strchr.MSVCRT ref: 00402AFE
strlen.MSVCRT ref: 00402B0D
strcpy.MSVCRT ref: 00402B2E
strcmp.MSVCRT ref: 00402B45
strcmp.MSVCRT ref: 00402B71
strcpy.MSVCRT ref: 00402BA9
strcpy.MSVCRT ref: 00402BB9
fprintf.MSVCRT ref: 00402C26
strncpy.MSVCRT ref: 00402C4B
strlen.MSVCRT ref: 00402C68
strcat.MSVCRT ref: 00402C81

Strings

SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381, xrefs: 00402BB2
1.8.0, xrefs: 00402B33
Match:%s, xrefs: 00402BDC
Ignore:%s, xrefs: 00402C16
%s-bit search:%s..., xrefs: 0040295F
Check:%s, xrefs: 00402BF4
1.8.0_381, xrefs: 00402B5F, 00402B98

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strcpy$memsetstrcmpstrlen$fprintfstrcat$EnumOpenstrchrstrncpy
String ID: %s-bit search:%s...$1.8.0$1.8.0_381$Check:%s$Ignore:%s$Match:%s$SOFTWARE\JavaSoft\Java Runtime Environment\1.8.0_381
API String ID: 972160396-2880201714
Opcode ID: dea267d38a76d0ea903f176a95922dc6f8066b72660dfeb9114f6276e47ced82
Instruction ID: 9a2c2f7deab8620c59848cd1e9c546dad7476eac0264ac07e1180a0b30e31d97
Opcode Fuzzy Hash: dea267d38a76d0ea903f176a95922dc6f8066b72660dfeb9114f6276e47ced82
Instruction Fuzzy Hash: 25A12AB49087149BC711EF25C98429EFBF5AF84704F0188BFE489A7391D7789A858F86

Function 00403D20 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00403D50
FindResourceExA.KERNEL32(00000003,00412360,?), ref: 00403D73
LoadResource.KERNEL32(?,?,?,00404A72), ref: 00403D90
LockResource.KERNEL32(?,?,?,?,?,00404A72), ref: 00403DA3
memset.MSVCRT ref: 00403DFB
strcpy.MSVCRT ref: 00403E45
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00404A72), ref: 00403E7F
SetLastError.KERNEL32(?,?,?,00404A72), ref: 00403E98
FindResourceExA.KERNEL32 ref: 00403EF1
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00404A72), ref: 00403F0E
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00404A72), ref: 00403F1D
strncpy.MSVCRT ref: 00403F89
strlen.MSVCRT ref: 00403F95
strcat.MSVCRT ref: 00403FBA
fprintf.MSVCRT ref: 00403FD4
fprintf.MSVCRT ref: 00403FF7
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00404A72), ref: 00404008
fprintf.MSVCRT ref: 00404035

Strings

true, xrefs: 00403F58
:, xrefs: 00403E2D
\, xrefs: 00403E24
Bundled JRE:%s, xrefs: 00403FC8
C:\Program Files (x86)\Java\jre-1.8, xrefs: 00403E78
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 00403E3E, 00403E4A, 00403E6F, 00403F7E, 00403F8E, 00403FB3
Resource %d:%s, xrefs: 00403FE7, 00404025

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$fprintf$ErrorFindLastLoadLockmemsetstrcpy$strcatstrlenstrncpy
String ID: :$Bundled JRE:%s$C:\Program Files (x86)\Java\jre-1.8$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$Resource %d:%s$\$true
API String ID: 1825146110-3456947707
Opcode ID: 3fddfb02c48c50c2158d36c8c973bd121e6bc0de472b92549c6627d4258191eb
Instruction ID: a351f2335a7c1ffd526f9bc51b8a145b2b5fd6ff43207c8f2e401759d570546c
Opcode Fuzzy Hash: 3fddfb02c48c50c2158d36c8c973bd121e6bc0de472b92549c6627d4258191eb
Instruction Fuzzy Hash: 178160B09083019BD710AF29D54035ABFE9EF84344F05C87FE989AB3D1DB7C99558B8A

Function 00403790 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 171
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExA.KERNEL32 ref: 004037C2
LoadResource.KERNEL32 ref: 004037DF
LockResource.KERNEL32 ref: 004037EE
strlen.MSVCRT ref: 0040382C
memset.MSVCRT ref: 00403852
strlen.MSVCRT ref: 0040385A
strncpy.MSVCRT ref: 0040386F
strlen.MSVCRT ref: 00403877
_open.MSVCRT ref: 00403893
strlen.MSVCRT ref: 004038B8
_read.MSVCRT ref: 004038DC
strlen.MSVCRT ref: 0040395D
_close.MSVCRT ref: 00403971
SetLastError.KERNEL32 ref: 004039BB

Strings

Loading:%s, xrefs: 0040399E
ini, xrefs: 00403883
Resource %d:%s, xrefs: 004039D2

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strlen$Resource$ErrorFindLastLoadLock_close_open_readmemsetstrncpy
String ID: Loading:%s$Resource %d:%s$ini
API String ID: 3498103655-913749543
Opcode ID: 1aeefc6938f78fb95fdeba6918e8ca31fde1e41f92e779772340ee2ce77c709b
Instruction ID: ffe5270cda513766b45dd1113f6f5d5a6076afea4e1b231d249c2800047aef03
Opcode Fuzzy Hash: 1aeefc6938f78fb95fdeba6918e8ca31fde1e41f92e779772340ee2ce77c709b
Instruction Fuzzy Hash: 4E6181B59083118BDB10AF29C58035EBFE5AF44344F05847FE9C9A7382D7789A51CB8A

Function 00406860 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
stringprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040689C
memset.MSVCRT ref: 004068BD
strcat.MSVCRT ref: 004068DA
strlen.MSVCRT ref: 004068E2
strcat.MSVCRT ref: 004068FE
CreateProcessA.KERNEL32 ref: 00406941
WaitForSingleObject.KERNEL32(?,?,?,?,?,0040A01C,00000001,00000000,?,0040151F), ref: 00406994
GetExitCodeProcess.KERNEL32 ref: 004069AC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,0040A01C,00000001,00000000,?,0040151F), ref: 004069BD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,0040A01C,00000001,00000000,?,0040151F), ref: 004069CE

Strings

-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher, xrefs: 004068F2
D, xrefs: 004068A1
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004068C7

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: CloseHandleProcessmemsetstrcat$CodeCreateExitObjectSingleWaitstrlen
String ID: -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$D
API String ID: 196992964-638251383
Opcode ID: 925ee4bed1523179cba05dbda226f6a8605d2966789c7c8ca7956b0a3c785639
Instruction ID: c9cdd45e2a5c81e006214db6be6d40eb90bac674d27234413dd11b55ebfa4603
Opcode Fuzzy Hash: 925ee4bed1523179cba05dbda226f6a8605d2966789c7c8ca7956b0a3c785639
Instruction Fuzzy Hash: EF4129B19083009BD700EF69D58064EFBF0FF84310F02897EE599AB391D7789965CB8A

Function 00402690 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 73
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004026BF
fprintf.MSVCRT ref: 004026F4
strcpy.MSVCRT ref: 0040270F
strlen.MSVCRT ref: 00402721
strcat.MSVCRT ref: 0040273F
_stat.MSVCRT ref: 00402750
SetLastError.KERNEL32 ref: 00402769
strlen.MSVCRT ref: 00402779

Strings

bin\javaw.exe, xrefs: 00402733
(not found), xrefs: 004026DB
bin\java.exe, xrefs: 0040278B
(OK), xrefs: 004026D4
Check launcher:%s %s, xrefs: 004026E4

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strlen$ErrorLast_statfprintfmemsetstrcatstrcpy
String ID: (OK)$(not found)$Check launcher:%s %s$bin\java.exe$bin\javaw.exe
API String ID: 1479257852-1030199565
Opcode ID: 045868294d0a7ed06c315ae385c8820c2325015fc6260560a2149f7d46a293a6
Instruction ID: e8944f1a8106916e4475c21f7cef91e4a366f81d5ed1b62317d4ded5b41b0450
Opcode Fuzzy Hash: 045868294d0a7ed06c315ae385c8820c2325015fc6260560a2149f7d46a293a6
Instruction Fuzzy Hash: A63191B4908705DFD710AF65C58421EBBE0AF44304F16887FE888BB3D1D7B88941CB8A

Function 004027A0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 96
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004027D5
RegOpenKeyExA.ADVAPI32 ref: 00402808
memset.MSVCRT ref: 00402848
RegQueryValueExA.ADVAPI32 ref: 00402888
strlen.MSVCRT ref: 004028C0
strcat.MSVCRT ref: 004028DE
RegCloseKey.ADVAPI32 ref: 004028F6
strcpy.MSVCRT ref: 00402911

Strings

JavaHome, xrefs: 00402872
jre, xrefs: 004028D5
C:\Program Files (x86)\Java\jre-1.8, xrefs: 0040290A

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: memset$CloseOpenQueryValuestrcatstrcpystrlen
String ID: C:\Program Files (x86)\Java\jre-1.8$JavaHome$jre
API String ID: 2991842512-781186548
Opcode ID: bbda5aac9f1fbed216a375d1f50ad02967d02f9e0ca73d0a26f9d6527b4fb1ea
Instruction ID: f9c37e86e1fa10c1b6e9cf4516faf301a59072f01b137ca7bee1a517f153a641
Opcode Fuzzy Hash: bbda5aac9f1fbed216a375d1f50ad02967d02f9e0ca73d0a26f9d6527b4fb1ea
Instruction Fuzzy Hash: 7A4152B5D047159BD710EF29C94425ABBE0EF84310F01C5BEE88DA7381D7789A84CF86

Function 00402829 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 64
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00402848
RegQueryValueExA.ADVAPI32 ref: 00402888
strlen.MSVCRT ref: 004028C0
strcat.MSVCRT ref: 004028DE
RegCloseKey.ADVAPI32 ref: 004028F6
strcpy.MSVCRT ref: 00402911

Strings

JavaHome, xrefs: 00402872
jre, xrefs: 004028D5
C:\Program Files (x86)\Java\jre-1.8, xrefs: 0040290A

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: CloseQueryValuememsetstrcatstrcpystrlen
String ID: C:\Program Files (x86)\Java\jre-1.8$JavaHome$jre
API String ID: 2049115317-781186548
Opcode ID: ec20f89f2d16415cbd2b41da4748407b3325ed6add80f57665febe99c4b464d0
Instruction ID: 0f7c0f34ce8200dd43c2f0bb0ff6e98dc681f3c32799e7a142d2370fabdcc0ea
Opcode Fuzzy Hash: ec20f89f2d16415cbd2b41da4748407b3325ed6add80f57665febe99c4b464d0
Instruction Fuzzy Hash: DB217F759087158AD710EF29C58439ABBE1EF84304F05C9BEE58967381D7789A84CB86

Function 004013E9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128
windowstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004021A0: FindResourceExA.KERNEL32 ref: 004021DD
Part of subcall function 004021A0: LoadResource.KERNEL32 ref: 004021FA
Part of subcall function 004021A0: LockResource.KERNEL32 ref: 00402209
Part of subcall function 004021A0: fprintf.MSVCRT ref: 00402253

strstr.MSVCRT ref: 0040140E
CreateWindowExA.USER32 ref: 004014B1
SetTimer.USER32 ref: 004014FA
TranslateMessage.USER32 ref: 0040154A
DispatchMessageA.USER32 ref: 00401555
GetMessageA.USER32 ref: 00401572
fprintf.MSVCRT ref: 004015AB

Strings

Exit code:%d, restarting the application!, xrefs: 0040159F
STATIC, xrefs: 00401498
--l4j-no-splash, xrefs: 00401405

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: MessageResource$fprintf$CreateDispatchFindLoadLockTimerTranslateWindowstrstr
String ID: --l4j-no-splash$Exit code:%d, restarting the application!$STATIC
API String ID: 2241055113-1185063601
Opcode ID: 33ac18716a739c8569af302160795fed5acb0a4af97f80bbe930cd5371412de7
Instruction ID: 67a90b80666c473e9742fa792ab923d60fcf46590e4eeb89ab99995b83f5f157
Opcode Fuzzy Hash: 33ac18716a739c8569af302160795fed5acb0a4af97f80bbe930cd5371412de7
Instruction Fuzzy Hash: 4F514B71A043058BD714DF2AD94035BB7F1ABC4300F15C83FE989AB3A0EB39C8519B8A

Function 0040124A Relevance: 10.5, APIs: 7, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_setmode.MSVCRT ref: 004011D5
_setmode.MSVCRT ref: 004011FB
__p__fmode.MSVCRT ref: 00401200
__p__environ.MSVCRT ref: 00401215
_cexit.MSVCRT ref: 00401239
ExitProcess.KERNEL32 ref: 00401241
_setmode.MSVCRT ref: 00401256

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: _setmode$ExitProcess__p__environ__p__fmode_cexit
String ID:
API String ID: 2747451157-0
Opcode ID: 55b44065cfc3671dcbda3173ad3e590a602a7e1e9e535e6ec2c50fd80800269a
Instruction ID: 6dd9965de3e649a4df042f89f412d9c8f3f420679e1b57de8b71a4d36494cbca
Opcode Fuzzy Hash: 55b44065cfc3671dcbda3173ad3e590a602a7e1e9e535e6ec2c50fd80800269a
Instruction Fuzzy Hash: CD1109746057108FC304FF25D9C181A77B1BF88304B12CA7EE986AB3A6C738D850DB4A

Function 00406A10 Relevance: 4.6, APIs: 3, Instructions: 95COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00406A29
GetStartupInfoA.KERNEL32 ref: 00406A36
GetModuleHandleA.KERNEL32 ref: 00406AED

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: CommandHandleInfoLineModuleStartup
String ID:
API String ID: 1628297973-0
Opcode ID: 426b7e169bc4001adf4ac2880b2c14a6d5950ebf415b9d4ab6f3d543cdd5321b
Instruction ID: ebf8bf4e4e20132a1a66f6807e23304a966a01df456f573df18988500c29227c
Opcode Fuzzy Hash: 426b7e169bc4001adf4ac2880b2c14a6d5950ebf415b9d4ab6f3d543cdd5321b
Instruction Fuzzy Hash: 00215CB67047154FEB147636C4A23AB7BE26F42344F8AC03BC583321C3D23C5AB59A06

Function 00406A9C Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00406AED

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 661c79fa3b8ac9abb4e224266d4cded6d62ffdd14050f3927dba7b757e43ebb2
Instruction ID: f042ff4e9afc238231ba2f0a1a21a068439de561cfa6daf720de4363d65ecbf7
Opcode Fuzzy Hash: 661c79fa3b8ac9abb4e224266d4cded6d62ffdd14050f3927dba7b757e43ebb2
Instruction Fuzzy Hash: 23F0F4B1A047154BDB14AF39C09139BBBF2AF40348F86C43EC987732C2D37C99608A02

Function 00406ACE Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00406AED

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: acdd093e482f5bde7bba130dde77f32350e70ae8059faee5c55a3686f59b36ed
Instruction ID: 3ce4b8eff68f737e1e19327138148219799e312e833f16ad5da121a4cd60d1db
Opcode Fuzzy Hash: acdd093e482f5bde7bba130dde77f32350e70ae8059faee5c55a3686f59b36ed
Instruction Fuzzy Hash: 1DF0A0B6A083244ADB04AF7AC18136AFFF1AF45358F45C47ED985626D2D27C8550CB52

Function 00401290 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 0040129D

Part of subcall function 00401150: SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,004012A8), ref: 00401161
Part of subcall function 00401150: __getmainargs.MSVCRT ref: 0040119A
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011D5
Part of subcall function 00401150: _setmode.MSVCRT ref: 004011FB
Part of subcall function 00401150: __p__fmode.MSVCRT ref: 00401200
Part of subcall function 00401150: __p__environ.MSVCRT ref: 00401215
Part of subcall function 00401150: _cexit.MSVCRT ref: 00401239
Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401241

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: _setmode$ExceptionExitFilterProcessUnhandled__getmainargs__p__environ__p__fmode__set_app_type_cexit
String ID:
API String ID: 250851222-0
Opcode ID: f8f8779216d611a18a63dbf5b8c311eb09e190107aa71f1f2c959bcc01329ce4
Instruction ID: f3566ed841fe2c78bbec3e3585cf37c7a6b3b3915cdcc1304e07bfa49eda4ab5
Opcode Fuzzy Hash: f8f8779216d611a18a63dbf5b8c311eb09e190107aa71f1f2c959bcc01329ce4
Instruction Fuzzy Hash: F3C09B3041421497C3003FB5DC0E359BBA87B05305F41443CD5C967261D67839054796

Non-executed Functions

Function 00401ED0 Relevance: 31.6, APIs: 13, Strings: 5, Instructions: 116stringwindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,004013DA), ref: 00401ED7
puts.MSVCRT ref: 00401F11
ShellExecuteA.SHELL32 ref: 00401F5A
printf.MSVCRT ref: 00401F89
fclose.MSVCRT ref: 00401F93
MessageBoxA.USER32 ref: 00401FBF
FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,004013DA), ref: 00401FFD
strlen.MSVCRT ref: 0040201F
strcat.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004013DA), ref: 00402040
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004013DA), ref: 0040204B
fprintf.MSVCRT ref: 0040206D

Strings

Open URL:%s, xrefs: 0040207F
An error occurred while starting the application., xrefs: 00401F0A, 00401F7C, 00401FB2, 00402013, 00402035, 0040205B
Error msg:%s, xrefs: 00402060
Error:%s, xrefs: 00402099
open, xrefs: 00401F43

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Message$ErrorExecuteFormatFreeLastLocalShellfclosefprintfprintfputsstrcatstrlen
String ID: An error occurred while starting the application.$Error msg:%s$Error:%s$Open URL:%s$open
API String ID: 1449747937-1100426463
Opcode ID: 1d01a69e9d7fb2250e9da01269d9a9a695086d462b34391a24b83a14a180ea29
Instruction ID: 2d12064388d49b1e09197d997951df6f1fa04ecba0d9f77cc5412a013d33004a
Opcode Fuzzy Hash: 1d01a69e9d7fb2250e9da01269d9a9a695086d462b34391a24b83a14a180ea29
Instruction Fuzzy Hash: 5041F1B0B083019BD704EF29D68525FBAE1BB84344F11C83FE589A7391D77C89559B8B

Function 004042B0 Relevance: 61.5, APIs: 29, Strings: 6, Instructions: 286stringCOMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 004042EA
LoadResource.KERNEL32 ref: 00404306
LockResource.KERNEL32 ref: 00404315
strlen.MSVCRT ref: 00404367
strcat.MSVCRT ref: 00404388
strlen.MSVCRT ref: 004043B9
strcat.MSVCRT ref: 004043F1
strlen.MSVCRT ref: 004043FD
FindResourceExA.KERNEL32 ref: 00404445
LoadResource.KERNEL32 ref: 00404462
LockResource.KERNEL32 ref: 00404471
FindResourceExA.KERNEL32 ref: 004044E8
LoadResource.KERNEL32 ref: 00404500
LockResource.KERNEL32 ref: 0040450F
fprintf.MSVCRT ref: 00404564
SetLastError.KERNEL32 ref: 00404590

Strings

1.8.0, xrefs: 00404378
1.8.0, xrefs: 004042BA
-bit, xrefs: 00404402
An error occurred while starting the application., xrefs: 00404360, 00404381, 004043B2, 004043C3, 004043E5, 004043EA, 004043F6, 00404546, 0040457A, 00404595, 0040466D, 00404689, 0040469A, 004046BA, 00404700
Resource %d:%s, xrefs: 0040455B, 00404658, 0040470E
- , xrefs: 004046AB

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$FindLoadLockstrlen$strcat$ErrorLastfprintf
String ID: - $-bit$1.8.0$1.8.0$An error occurred while starting the application.$Resource %d:%s
API String ID: 484976878-253376002
Opcode ID: b992894269d4df67585a336ef44875f4a4d0f1fa0297b5c6ea2c178211651a31
Instruction ID: 34e31f97e9555f3506bafa7709ed99a0cf1f3aa383949e3ef6a0ea41d6191ac0
Opcode Fuzzy Hash: b992894269d4df67585a336ef44875f4a4d0f1fa0297b5c6ea2c178211651a31
Instruction Fuzzy Hash: 50B170B07183018BD704EF3AD64035ABAE1BB84344F05C93ED989E7391D77DC9658B9A

Function 00403100 Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 186stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403136
memset.MSVCRT ref: 00403151
strchr.MSVCRT ref: 0040316C
strchr.MSVCRT ref: 0040318A
strncat.MSVCRT ref: 004031AF
strncat.MSVCRT ref: 004031D5
strlen.MSVCRT ref: 004031EB
strstr.MSVCRT ref: 0040327E
GetEnvironmentVariableA.KERNEL32 ref: 004032AD
strncat.MSVCRT ref: 0040332E
strcat.MSVCRT ref: 00403342
GetCurrentDirectoryA.KERNEL32 ref: 00403361
strcat.MSVCRT ref: 0040337D
strcat.MSVCRT(?,?,00403E17,?,?,?,?,?,?,00404A72), ref: 004033C2
strcat.MSVCRT(?,?,?,?,00403E17,?,?,?,?,?,?,00404A72), ref: 004033D6

Strings

PWD, xrefs: 00403225
EXEDIR, xrefs: 004031DD
HKEY, xrefs: 00403272
C:\Users\user\Desktop, xrefs: 0040336E
JREHOMEDIR, xrefs: 00403254
C:\Program Files (x86)\Java\jre-1.8, xrefs: 00403387
OLDPWD, xrefs: 0040323E
EXEFILE, xrefs: 0040320C
Substitute:%s = %s, xrefs: 00403303

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strcat$strncat$memsetstrchr$CurrentDirectoryEnvironmentVariablestrlenstrstr
String ID: C:\Program Files (x86)\Java\jre-1.8$C:\Users\user\Desktop$EXEDIR$EXEFILE$HKEY$JREHOMEDIR$OLDPWD$PWD$Substitute:%s = %s
API String ID: 3324974479-1786125850
Opcode ID: 6614e760f1d2ee19f4b253176852c44bfd1491407e5a90ce63a812219ddd9ebb
Instruction ID: ed202c75566bdcf25b9861d036979bf7c043f81e68319857b6959b64db836d4b
Opcode Fuzzy Hash: 6614e760f1d2ee19f4b253176852c44bfd1491407e5a90ce63a812219ddd9ebb
Instruction Fuzzy Hash: 80711C759043159BCB54DF25C88025ABBE5FF84314F41C8BEE98DA7381DB389E85CB8A

Function 004033F0 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 00403440
LoadResource.KERNEL32 ref: 0040345C
LockResource.KERNEL32 ref: 0040346B
fprintf.MSVCRT ref: 004034B3
atoi.MSVCRT ref: 004034C3
FindResourceExA.KERNEL32 ref: 004034FE
LoadResource.KERNEL32 ref: 0040351B
LockResource.KERNEL32 ref: 0040352A
fprintf.MSVCRT ref: 00403573
atoi.MSVCRT ref: 00403583
strcat.MSVCRT(?), ref: 0040361A
strlen.MSVCRT ref: 00403622
_itoa.MSVCRT ref: 00403639
strlen.MSVCRT ref: 00403641
SetLastError.KERNEL32 ref: 004036EF

Strings

Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB, xrefs: 004036B0
Resource %d:%s, xrefs: 004034A3, 00403563
Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB, xrefs: 00403688

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$FindLoadLockatoifprintfstrlen$ErrorLast_itoastrcat
String ID: Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB$Heap limit:Reduced %d MB heap size to 32-bit maximum %d MB$Resource %d:%s
API String ID: 1284713559-335395982
Opcode ID: 49b52521ad4b28281b4610723bdc3fecec1105f7fc221ab9df715c009cf8496d
Instruction ID: 556c7044ae09a008ffae0a8d9fc69ada731a51744f4509117c473fc4c8ef08ad
Opcode Fuzzy Hash: 49b52521ad4b28281b4610723bdc3fecec1105f7fc221ab9df715c009cf8496d
Instruction Fuzzy Hash: CC916FB19083159BDB14EF69C58025FBBF5BF88304F05883EE889AB391D738D915CB86

Function 00401C30 Relevance: 36.9, APIs: 12, Strings: 9, Instructions: 108stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401C58
GetEnvironmentVariableA.KERNEL32(?,00000000,?,?,00405E35), ref: 00401C71
strstr.MSVCRT ref: 00401C88
memset.MSVCRT ref: 00401CB2
strncpy.MSVCRT ref: 00401CC8
strlen.MSVCRT ref: 00401CD0
fopen.MSVCRT ref: 00401CFC
strstr.MSVCRT ref: 00401D1F
fprintf.MSVCRT ref: 00401D4C
fprintf.MSVCRT ref: 00401D74
strstr.MSVCRT ref: 00401D92
strstr.MSVCRT ref: 00401DB3

Strings

--l4j-debug, xrefs: 00401C7C
j.lo, xrefs: 00401CAA
3.9, xrefs: 00401D3A
nch4, xrefs: 00401CDC
Version:%s, xrefs: 00401D3F
debug, xrefs: 00401D89
debug-all, xrefs: 00401DAA
CmdLine:%s %s, xrefs: 00401D60
--l4j-debug-all, xrefs: 00401D11

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strstr$fprintfmemset$EnvironmentVariablefopenstrlenstrncpy
String ID: Version:%s$--l4j-debug$--l4j-debug-all$3.9$CmdLine:%s %s$debug$debug-all$j.lo$nch4
API String ID: 1991431792-3923029096
Opcode ID: a285fad08061a693a5248468f59be63a75b3341ece323a7797179705ea493636
Instruction ID: 60ffc86f505bfdbbbba3efb310094abc59b8358325a5033e9b193ab27e218064
Opcode Fuzzy Hash: a285fad08061a693a5248468f59be63a75b3341ece323a7797179705ea493636
Instruction Fuzzy Hash: AA411DB49083059BC710AF6AC58056EFBE5EF84754F01C83FE989AB391D738D851DB8A

Function 00405B60 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 121stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405B8A
FindResourceExA.KERNEL32(?,?,?,00406711), ref: 00405BB2
LoadResource.KERNEL32 ref: 00405BCF
LockResource.KERNEL32 ref: 00405BDE
strlen.MSVCRT ref: 00405C1A
strcat.MSVCRT ref: 00405C36
strcpy.MSVCRT ref: 00405C55
strstr.MSVCRT ref: 00405C61
strchr.MSVCRT ref: 00405C7C
strstr.MSVCRT ref: 00405C9A
strlen.MSVCRT ref: 00405CB5
strcat.MSVCRT ref: 00405CD1
SetLastError.KERNEL32 ref: 00405CF4

Strings

--l4j-, xrefs: 00405C50, 00405C8E
-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher, xrefs: 00405C13, 00405C2F, 00405CAE, 00405CCA
Resource %d:%s, xrefs: 00405D11

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$strcatstrlenstrstr$ErrorFindLastLoadLockmemsetstrchrstrcpy
String ID: --l4j-$-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher$Resource %d:%s
API String ID: 782867121-649097702
Opcode ID: ac6294b31dbabfa38df6261dad10e70e22e75e7ae9a4ecf5308ff82ecc24c60d
Instruction ID: d40fd4806269129820aebf3143e2994a5f350a870bc7b93ef3ae692e42a163e9
Opcode Fuzzy Hash: ac6294b31dbabfa38df6261dad10e70e22e75e7ae9a4ecf5308ff82ecc24c60d
Instruction Fuzzy Hash: E6414DB0908B019AE714AF29C54432BBAE5EF45704F01C87FE589A73C2D73D88958F9B

Function 004023B0 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 118stringregistryCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 004023CD
strstr.MSVCRT ref: 004023E7
strstr.MSVCRT ref: 00402401
strstr.MSVCRT ref: 0040241B
strstr.MSVCRT ref: 00402435
strchr.MSVCRT ref: 00402454
strrchr.MSVCRT ref: 00402468
RegOpenKeyExA.ADVAPI32 ref: 004024A2
RegQueryValueExA.ADVAPI32 ref: 004024D3
RegCloseKey.ADVAPI32 ref: 004024EC
RegOpenKeyExA.ADVAPI32 ref: 00402520

Strings

HKEY_LOCAL_MACHINE, xrefs: 004023F3
HKEY, xrefs: 004023B8
HKEY_CURRENT_CONFIG, xrefs: 00402427
HKEY_CURRENT_USER, xrefs: 004023D9
HKEY_CLASSES_ROOT, xrefs: 004023B1
HKEY_USERS, xrefs: 0040240D

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strstr$Open$CloseQueryValuestrchrstrrchr
String ID: HKEY$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS
API String ID: 356245303-4236897492
Opcode ID: 2f58436ba1d9a0b613b282f8eb25c1e7930d7951b9ec5870fe4d8ca9b2378fcc
Instruction ID: 2ae7df6790b6f1853f37995f78c893f74154cd1711da3b843cecc37fcb260c67
Opcode Fuzzy Hash: 2f58436ba1d9a0b613b282f8eb25c1e7930d7951b9ec5870fe4d8ca9b2378fcc
Instruction Fuzzy Hash: 2B414FB5D087069BDB00EF69C98425EFBE1BF84314F05883FE988A7381D77899448B96

Function 00403B77 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 111stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403BA9
memset.MSVCRT ref: 00403BC0
GetCurrentDirectoryA.KERNEL32 ref: 00403BD5
FindResourceExA.KERNEL32 ref: 00403C00
LoadResource.KERNEL32 ref: 00403C1D
LockResource.KERNEL32 ref: 00403C30
strncpy.MSVCRT ref: 00403C84
strlen.MSVCRT ref: 00403C8C
strcat.MSVCRT ref: 00403CA5
_chdir.MSVCRT ref: 00403CAD
fprintf.MSVCRT ref: 00403CCB
SetLastError.KERNEL32 ref: 00403CDE
fprintf.MSVCRT ref: 00403D0D

Strings

C:\Users\user\Desktop, xrefs: 00403BCC
Working dir:%s, xrefs: 00403CBF
Resource %d:%s, xrefs: 00403CFD

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$fprintfmemset$CurrentDirectoryErrorFindLastLoadLock_chdirstrcatstrlenstrncpy
String ID: C:\Users\user\Desktop$Resource %d:%s$Working dir:%s
API String ID: 422477114-2404225895
Opcode ID: 9c9ccb99f420a877555200c07f2862f7891259c708e168cf86730445fea71b0e
Instruction ID: 349f221890d6d40fe71c0e96cafd37487ebf52b12bf3dfd57c186abffd885e97
Opcode Fuzzy Hash: 9c9ccb99f420a877555200c07f2862f7891259c708e168cf86730445fea71b0e
Instruction Fuzzy Hash: B1416BB19087119BE700AF29D58135EBFE4EF84344F01883EE989A7381D7389994CB8A

Function 00404040 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 155stringCOMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 004040A4
LoadResource.KERNEL32 ref: 004040C1
LockResource.KERNEL32 ref: 004040D0
atoi.MSVCRT ref: 00404113
strcpy.MSVCRT ref: 004041B5
fprintf.MSVCRT ref: 004041EF

Strings

1.8.0, xrefs: 00404051
C:\Program Files (x86)\Java\jre-1.8, xrefs: 004041AC
Runtime used:%s (%s-bit), xrefs: 004041DF
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004041A5
Resource %d:%s, xrefs: 0040428D
1.8.0_381, xrefs: 004041DA

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$FindLoadLockatoifprintfstrcpy
String ID: 1.8.0$1.8.0_381$C:\Program Files (x86)\Java\jre-1.8$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$Resource %d:%s$Runtime used:%s (%s-bit)
API String ID: 1856142485-2878787163
Opcode ID: 5bad5463ab02470c6f235011ec21a0e21543ba014425d0f3e3f6b6fee1eeea78
Instruction ID: 209fe916da85df5c911ae4276ce2f96064c2a1019c36ad74d5d97ab76ae223e1
Opcode Fuzzy Hash: 5bad5463ab02470c6f235011ec21a0e21543ba014425d0f3e3f6b6fee1eeea78
Instruction Fuzzy Hash: A8513AB0A083059BD704AF65D54436EBBE1ABC4304F01C87EE989AB3D2D77D9C919B4A

Function 004051E0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 117stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405211
memset.MSVCRT ref: 00405228
FindResourceExA.KERNEL32(?,00000000,?), ref: 00405250
LoadResource.KERNEL32(?,?,?,00406514), ref: 0040526D
LockResource.KERNEL32(?,?,?,?,?,00406514), ref: 0040527C
fprintf.MSVCRT ref: 004052C8
SetEnvironmentVariableA.KERNEL32 ref: 004052EC
strtok.MSVCRT(?,?,?,?,00406514), ref: 004052FF
strchr.MSVCRT ref: 00405316
fprintf.MSVCRT ref: 0040535A
SetLastError.KERNEL32(?,?,?,00406514), ref: 00405373

Strings

Set var:%s = %s, xrefs: 0040534A
Resource %d:%s, xrefs: 004052B8

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$fprintfmemset$EnvironmentErrorFindLastLoadLockVariablestrchrstrtok
String ID: Resource %d:%s$Set var:%s = %s
API String ID: 301265589-2172967655
Opcode ID: 269e6b674d12423d849caec9e5e778c3ff3d2c18b953fcfb33869b71bd7f8dc3
Instruction ID: afa5dd9bf5237a591f145b88366e3ef618c797e9271656589243b0a106b18b75
Opcode Fuzzy Hash: 269e6b674d12423d849caec9e5e778c3ff3d2c18b953fcfb33869b71bd7f8dc3
Instruction Fuzzy Hash: DA4138B0A087019BD710AF2AD58035FBBE4EF88340F41C87EE489A7391D738D9559F9A

Function 004050D0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 79stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405102
strcpy.MSVCRT ref: 00405114
strlen.MSVCRT ref: 0040511C
memset.MSVCRT ref: 0040513F
GetEnvironmentVariableA.KERNEL32 ref: 00405158
strlen.MSVCRT ref: 00405165
fprintf.MSVCRT ref: 00405198
strlen.MSVCRT ref: 004051A3
strcat.MSVCRT ref: 004051B5
SetEnvironmentVariableA.KERNEL32 ref: 004051C5

Strings

C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004050F1
Error:%s, xrefs: 0040518B
appendToPathVar failed., xrefs: 00405186

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strlen$EnvironmentVariablememset$fprintfstrcatstrcpy
String ID: C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$Error:%s$appendToPathVar failed.
API String ID: 495583820-2191414873
Opcode ID: 1bd0987b0e2fc78d473a59205c3eea85c459be8ceac31c8754d4a8f2c5af2878
Instruction ID: f6e45bb88e98a1b81569ded4109919bd0ed7862b498e3da174d31cb25c7df640
Opcode Fuzzy Hash: 1bd0987b0e2fc78d473a59205c3eea85c459be8ceac31c8754d4a8f2c5af2878
Instruction Fuzzy Hash: 232161B5A087109AD710AF2AD44016FBBE5EFC4704F42C43FE489AB391D73C88528B8A

Function 004039F1 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 103synchronizationCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403A22
FindResourceExA.KERNEL32 ref: 00403A4A
LoadResource.KERNEL32 ref: 00403A66
LockResource.KERNEL32 ref: 00403A75
fprintf.MSVCRT ref: 00403AC8
CreateMutexA.KERNEL32 ref: 00403B14
GetLastError.KERNEL32 ref: 00403B1C
SetLastError.KERNEL32 ref: 00403B3F
fprintf.MSVCRT ref: 00403B6E

Strings

Resource %d:%s, xrefs: 00403AB8
Instance already exists., xrefs: 00403B5C
Error:%s, xrefs: 00403B61

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$ErrorLastfprintf$CreateFindLoadLockMutexmemset
String ID: Error:%s$Instance already exists.$Resource %d:%s
API String ID: 1676011544-3441027790
Opcode ID: 5d703d892fcee4d035bb5678ce239c4aadbc0211198db526eb703aee52715d62
Instruction ID: 63ebb8a2186d1c087548a531fdd3118c811b0fdf88078b365d510e972c39d1b2
Opcode Fuzzy Hash: 5d703d892fcee4d035bb5678ce239c4aadbc0211198db526eb703aee52715d62
Instruction Fuzzy Hash: 7E414F70A083059BDB14EF39D58135ABBE4AB84344F00C87EE48EE73C1E678D9959F56

Function 00404069 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 107stringCOMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 004040A4
LoadResource.KERNEL32 ref: 004040C1
LockResource.KERNEL32 ref: 004040D0
atoi.MSVCRT ref: 00404113
strcpy.MSVCRT ref: 004041B5
fprintf.MSVCRT ref: 004041EF
SetLastError.KERNEL32 ref: 00404273
fprintf.MSVCRT ref: 0040429D

Strings

C:\Program Files (x86)\Java\jre-1.8, xrefs: 004041AC
Runtime used:%s (%s-bit), xrefs: 004041DF
C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe, xrefs: 004041A5
1.8.0_381, xrefs: 004041DA

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$fprintf$ErrorFindLastLoadLockatoistrcpy
String ID: 1.8.0_381$C:\Program Files (x86)\Java\jre-1.8$C:\Program Files (x86)\Java\jre-1.8\bin\javaw.exe$Runtime used:%s (%s-bit)
API String ID: 440416407-175693797
Opcode ID: bd0dd93339672a2f3fc852d7772f3d6f5c9daa2767713f90459c8e259a1bbb6b
Instruction ID: 5389436385b8e7cd97168d55a14ed6d8c30c170912d26635384efc32abc192e5
Opcode Fuzzy Hash: bd0dd93339672a2f3fc852d7772f3d6f5c9daa2767713f90459c8e259a1bbb6b
Instruction Fuzzy Hash: D3415CB0A043019BD714AF25D58436EBBE1ABC4304F05C87ED989AB3D2D77D9C918B4A

Function 004022B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 004022ED
LoadResource.KERNEL32 ref: 0040230A
LockResource.KERNEL32 ref: 00402319
fprintf.MSVCRT ref: 00402363
atoi.MSVCRT ref: 00402373
SetLastError.KERNEL32 ref: 00402386
atoi.MSVCRT ref: 00402395

Strings

Resource %d:%s, xrefs: 00402353

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$atoi$ErrorFindLastLoadLockfprintf
String ID: Resource %d:%s
API String ID: 1405122715-3770364717
Opcode ID: 860e33d9464aaac1aaf4294ce0ce0efbf730c1f33b9003797695dbf45b4547a1
Instruction ID: 173d0b95324560bc3b63ac67752d65b29fca71815bb9e03dc755f331b579f335
Opcode Fuzzy Hash: 860e33d9464aaac1aaf4294ce0ce0efbf730c1f33b9003797695dbf45b4547a1
Instruction Fuzzy Hash: 5B21B2759083018BDB14EF3AD58076FBBE0AF84340F01883EE989A7391D73CD8658B96

Function 004021A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32 ref: 004021DD
LoadResource.KERNEL32 ref: 004021FA
LockResource.KERNEL32 ref: 00402209
fprintf.MSVCRT ref: 00402253
SetLastError.KERNEL32 ref: 0040228B

Strings

true, xrefs: 00402263, 00402286
Resource %d:%s, xrefs: 00402243

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLockfprintf
String ID: Resource %d:%s$true
API String ID: 2300709556-1650570159
Opcode ID: 81dd6341af696f5ba0067316c7a2603a014bd5558d3fa65d953e464f06248ab3
Instruction ID: edd0d00bdcf57973877bd5b19408a799ab47b92a6fbc58d7c0a8dfc23e37736a
Opcode Fuzzy Hash: 81dd6341af696f5ba0067316c7a2603a014bd5558d3fa65d953e464f06248ab3
Instruction Fuzzy Hash: DA21FB72A083155BDB10AF79D54436BBBE4FF80350F05847FE989A73C0D639DA148B95

Function 00401DC5 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401DDE
GetProcAddress.KERNEL32 ref: 00401DF2
GetCurrentProcess.KERNEL32 ref: 00401E00
fprintf.MSVCRT ref: 00401E43

Strings

IsWow64Process, xrefs: 00401DE6
yes, xrefs: 00401E25
WOW64:%s, xrefs: 00401E37

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes
API String ID: 24026888-2072328098
Opcode ID: 79cba90a5c32919940d47014e4f11db2286ddd08fea7034ebff4aa08fe6649a9
Instruction ID: aea4bb79273e8d534990c21f24d6dc2711a2c6fda4608cbe9aad56ecb48cfa11
Opcode Fuzzy Hash: 79cba90a5c32919940d47014e4f11db2286ddd08fea7034ebff4aa08fe6649a9
Instruction Fuzzy Hash: 9001677060430597CB00BF75D58521B76E0AB84348F01C83ED5857B381D778DC25CB9A

Function 00401DD0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401DDE
GetProcAddress.KERNEL32 ref: 00401DF2
GetCurrentProcess.KERNEL32 ref: 00401E00
fprintf.MSVCRT ref: 00401E43

Strings

IsWow64Process, xrefs: 00401DE6
yes, xrefs: 00401E25
WOW64:%s, xrefs: 00401E37

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcessfprintf
String ID: IsWow64Process$WOW64:%s$yes
API String ID: 24026888-2072328098
Opcode ID: 0f449fa4e61134affe168ec5c855c7a0e9b7151d64be7ae9747b5a4d41c4c0fd
Instruction ID: a217be7bda152947c960663f56388daf3a3792abde6a83131336f65876ccd3cc
Opcode Fuzzy Hash: 0f449fa4e61134affe168ec5c855c7a0e9b7151d64be7ae9747b5a4d41c4c0fd
Instruction Fuzzy Hash: 52F03170A0830597DB00BF75D58511F7AE4AB84348F01C83ED985AB3D6EB78DC249B9A

Function 00405CDC Relevance: 12.0, APIs: 6, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00405C55
strstr.MSVCRT ref: 00405C61
strchr.MSVCRT ref: 00405C7C
strstr.MSVCRT ref: 00405C9A
strlen.MSVCRT ref: 00405CB5
strcat.MSVCRT ref: 00405CD1
SetLastError.KERNEL32 ref: 00405CF4

Strings

--l4j-, xrefs: 00405C50, 00405C8E
-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher, xrefs: 00405CAE, 00405CCA

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strstr$ErrorLaststrcatstrchrstrcpystrlen
String ID: --l4j-$-Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
API String ID: 1304447673-3764877108
Opcode ID: d165a1be7fc4b68c02de8a7e451452b4915db2d7301cae9c236fcca6c72a7ef8
Instruction ID: 56afbf9f269423abcfbc407513a566e97e7e4f5f61a7ec7fa9ea9c2cf9926f11
Opcode Fuzzy Hash: d165a1be7fc4b68c02de8a7e451452b4915db2d7301cae9c236fcca6c72a7ef8
Instruction Fuzzy Hash: 950109745087109AE710AF65C44436BBAE1EF44304F45887FD589B73C2D77D88518B8A

Function 004019E0 Relevance: 10.6, APIs: 7, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401A32
KillTimer.USER32 ref: 00401A58
PostQuitMessage.USER32 ref: 00401A67
ShowWindow.USER32 ref: 00401AA7
KillTimer.USER32 ref: 00401ADA
PostQuitMessage.USER32 ref: 00401AEE
EnumWindows.USER32 ref: 00401B0D

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: KillMessagePostQuitTimer$CodeEnumExitProcessShowWindowWindows
String ID:
API String ID: 1905518172-0
Opcode ID: ed7f04139cc10e99910bf818abc7fe4566fa36b293454e2dcc1566a67e520c2f
Instruction ID: 4aa06db3ae75fa459c5dc857b340d842a3fba66811b007700aa9ab28a47e10bc
Opcode Fuzzy Hash: ed7f04139cc10e99910bf818abc7fe4566fa36b293454e2dcc1566a67e520c2f
Instruction Fuzzy Hash: 75216F71B053048BC714EF39EA4571A77E1AB80348F00853EE885A73A0D739E915DB9B

Function 004020C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

FindResourceExA.KERNEL32(?,?,?,00401888), ref: 004020EF
LoadResource.KERNEL32 ref: 00402108
LockResource.KERNEL32 ref: 00402117
SetLastError.KERNEL32 ref: 00402162
fprintf.MSVCRT ref: 0040218D

Strings

Resource %d:%s, xrefs: 0040217D

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$ErrorFindLastLoadLockfprintf
String ID: Resource %d:%s
API String ID: 2300709556-3770364717
Opcode ID: 5fdb7a8abfa6b102f5a50e062b281fc94a6f536b858fcc5aa029184cd9954bbf
Instruction ID: 7b4c6ba3150bb0ca76113f71d5647f24083859b2f22289e308b5470f49ef36ec
Opcode Fuzzy Hash: 5fdb7a8abfa6b102f5a50e062b281fc94a6f536b858fcc5aa029184cd9954bbf
Instruction Fuzzy Hash: D321C570A083018BDB00FF39DA8035ABBE4EF44344F00847FE989EB381D278D8558B86

Function 00403659 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

strcat.MSVCRT(?), ref: 0040361A
strlen.MSVCRT ref: 00403622
_itoa.MSVCRT ref: 00403639
strlen.MSVCRT ref: 00403641
fprintf.MSVCRT ref: 0040369D

Strings

Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB, xrefs: 00403688

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strlen$_itoafprintfstrcat
String ID: Heap %s:Requested %d MB / %d%%, Available: %d MB, Heap size: %d MB
API String ID: 309510014-1709647519
Opcode ID: 4c106ecc713cc839283f90cd6b49804e0ebd0d678dfbdb3f99c2325a0ba98a86
Instruction ID: e9b7ccf47b61d8f8975171a80ab5ecc25053be3e66329a59218f8502b43fd955
Opcode Fuzzy Hash: 4c106ecc713cc839283f90cd6b49804e0ebd0d678dfbdb3f99c2325a0ba98a86
Instruction Fuzzy Hash: 2B1115B59083059FCB04DF59C08129EFBF2FF88300F12882EE899AB351C7389855CB86

Function 00401B87 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 35stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401BB2
strncpy.MSVCRT ref: 00401BC8
strlen.MSVCRT ref: 00401BD0
fopen.MSVCRT ref: 00401C01

Strings

j.lo, xrefs: 00401BE1
nch4, xrefs: 00401BDC

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: fopenmemsetstrlenstrncpy
String ID: j.lo$nch4
API String ID: 80595551-1605737849
Opcode ID: 70a3b17f3908ebedc0b3180f6b19ea0b43561d51c620d0b91f5d0ff4da68ae63
Instruction ID: 17a981617f60ab97fca732e22f92d21c70fcd95c49624fe496cb553d8773ac1f
Opcode Fuzzy Hash: 70a3b17f3908ebedc0b3180f6b19ea0b43561d51c620d0b91f5d0ff4da68ae63
Instruction Fuzzy Hash: 0601E8B5D083049BC714AF25D48155AFBE0FF48314F42C86EA88D9B356D6389954CB96

Function 00401000 Relevance: 9.1, APIs: 6, Instructions: 89COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00401037
signal.MSVCRT ref: 0040109B
signal.MSVCRT ref: 004010CB

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: dc29bf9aea78ba53ae1806de999a580e3e5e4b6085ce782c554fd26ddb7216e3
Instruction ID: 1bbb52622e8a19badba6bad6b28e715f43f04d6c83c205b25cbd975ffaf7a7a3
Opcode Fuzzy Hash: dc29bf9aea78ba53ae1806de999a580e3e5e4b6085ce782c554fd26ddb7216e3
Instruction Fuzzy Hash: 63312FB0A042408BD724AF69C58036EB6A0BF49354F16893FD9C5E77E1C6BECCD0974A

Function 00405010 Relevance: 9.1, APIs: 6, Instructions: 53stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405046
GetEnvironmentVariableA.KERNEL32 ref: 0040505F
strlen.MSVCRT ref: 0040506C
strlen.MSVCRT ref: 00405089
strcat.MSVCRT ref: 0040509B
SetEnvironmentVariableA.KERNEL32 ref: 004050AB

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: EnvironmentVariablestrlen$memsetstrcat
String ID:
API String ID: 2108680700-0
Opcode ID: d95cb74e045f58805c42f9113675087c7de655c0657359ccab51889906dee4cd
Instruction ID: 19ba68cff2aee44dae23cc5b56ef49d50704ee26ecf9892f5ebb6658b324295f
Opcode Fuzzy Hash: d95cb74e045f58805c42f9113675087c7de655c0657359ccab51889906dee4cd
Instruction Fuzzy Hash: 9D1119B5D087149BCB00EF69C54105DFBF1EF88314F1284BEE888A7355DA385A518BC6

Function 00402620 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 34stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00402636
strcat.MSVCRT ref: 00402654
strlen.MSVCRT ref: 00402663
strcat.MSVCRT ref: 00402681

Strings

bin\javaw.exe, xrefs: 00402678
bin\java.exe, xrefs: 0040264B

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strcatstrlen
String ID: bin\java.exe$bin\javaw.exe
API String ID: 1179760717-2770878578
Opcode ID: b65ea48d9e9f20d7926c5458ddd7f93f7f40326ce165c218aab041ff87f19a90
Instruction ID: 7687c5f18350c46cbce8d6c5260ce5ab4989a23d013a9ddc911cfd2f41cc631c
Opcode Fuzzy Hash: b65ea48d9e9f20d7926c5458ddd7f93f7f40326ce165c218aab041ff87f19a90
Instruction Fuzzy Hash: 01F062B4D183049EE710AF39D9C9A1ABBD4AF00308F46487EE4895F3D3D77A8450879A

Function 00402EE0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00402F9F
fprintf.MSVCRT ref: 00402FD9

Strings

C:\Program Files (x86)\Java\jre-1.8, xrefs: 00402F90
Runtime used:%s (%s-bit), xrefs: 00402FC4
1.8.0_381, xrefs: 00402FC9

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: fprintfstrcpy
String ID: 1.8.0_381$C:\Program Files (x86)\Java\jre-1.8$Runtime used:%s (%s-bit)
API String ID: 1458319006-1209485249
Opcode ID: 384320036ec86c7677915ca7cd64674f5bfe1fbe95e064327e76059add0c0678
Instruction ID: e570360796af71997f007bbec0ddf7bd71377d3d7eeb5d391251dbc393d587ea
Opcode Fuzzy Hash: 384320036ec86c7677915ca7cd64674f5bfe1fbe95e064327e76059add0c0678
Instruction Fuzzy Hash: CA3139719093019BD715AF24864839FB6A1EB80748F01C87FE8887B3C6D7BD9C419B8A

Function 00402EDE Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00402F9F
fprintf.MSVCRT ref: 00402FD9

Strings

C:\Program Files (x86)\Java\jre-1.8, xrefs: 00402F90
Runtime used:%s (%s-bit), xrefs: 00402FC4
1.8.0_381, xrefs: 00402FC9

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: fprintfstrcpy
String ID: 1.8.0_381$C:\Program Files (x86)\Java\jre-1.8$Runtime used:%s (%s-bit)
API String ID: 1458319006-1209485249
Opcode ID: e035c1c117aebe9e0d10ea843332a47cc9c32bea83d5b872931b4e891ef88464
Instruction ID: 2e410cda6b073cc25c187766190d21a1da9afde98849d5476af63c368e3af956
Opcode Fuzzy Hash: e035c1c117aebe9e0d10ea843332a47cc9c32bea83d5b872931b4e891ef88464
Instruction Fuzzy Hash: 602181719043059BD7149F15C64439BB7A5EB80348F01C87EE8887B3C6C7BD9C519B89

Function 004052DE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35stringCOMMON

Download Yara Rule

APIs

SetEnvironmentVariableA.KERNEL32 ref: 004052EC
strtok.MSVCRT(?,?,?,?,00406514), ref: 004052FF
strchr.MSVCRT ref: 00405316

Part of subcall function 00403100: memset.MSVCRT ref: 00403136
Part of subcall function 00403100: memset.MSVCRT ref: 00403151
Part of subcall function 00403100: strchr.MSVCRT ref: 0040316C
Part of subcall function 00403100: strchr.MSVCRT ref: 0040318A
Part of subcall function 00403100: strncat.MSVCRT ref: 004031AF
Part of subcall function 00403100: strncat.MSVCRT ref: 004031D5
Part of subcall function 00403100: strlen.MSVCRT ref: 004031EB
Part of subcall function 00403100: strstr.MSVCRT ref: 0040327E

fprintf.MSVCRT ref: 0040535A
SetLastError.KERNEL32(?,?,?,00406514), ref: 00405373

Strings

Set var:%s = %s, xrefs: 0040534A

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strchr$memsetstrncat$EnvironmentErrorLastVariablefprintfstrlenstrstrstrtok
String ID: Set var:%s = %s
API String ID: 3263537496-1184643595
Opcode ID: ee98d8c8936dcdd218bc3ae6b4bee14f3b7f662cf54e9fc7437ca12448ec09f5
Instruction ID: b35ccef8a7e5673246ed472a237be416f5c44ba05b5604b2d57a73e62d97e0d5
Opcode Fuzzy Hash: ee98d8c8936dcdd218bc3ae6b4bee14f3b7f662cf54e9fc7437ca12448ec09f5
Instruction Fuzzy Hash: FA01DAB05087109EC701AF2AC58031EBFE4AF88744F41C87FE4C8AB381D77889519F9A

Function 00401FCC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(?,?,?,?,?,?,?,?,004013DA), ref: 00401FFD
strlen.MSVCRT ref: 0040201F
strcat.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004013DA), ref: 00402040
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004013DA), ref: 0040204B
fprintf.MSVCRT ref: 004020A9

Strings

An error occurred while starting the application., xrefs: 00402013, 00402035

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: FormatFreeLocalMessagefprintfstrcatstrlen
String ID: An error occurred while starting the application.
API String ID: 863393273-2110520379
Opcode ID: 9e24085052815f66a929547d79b0b0ecebc814cf3094997c733abd0dc5bb07b1
Instruction ID: 48929c70c90143ab4f29c9b601d13be01fb97ec1997cc056402bd9998a5ef999
Opcode Fuzzy Hash: 9e24085052815f66a929547d79b0b0ecebc814cf3094997c733abd0dc5bb07b1
Instruction Fuzzy Hash: 730116B0A083018BC300EF69C28025BBBF1BB84314F01886EE8C9A7245D77896548B8A

Function 004012D0 Relevance: 7.6, APIs: 5, Instructions: 68stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012F4

Part of subcall function 004020C0: FindResourceExA.KERNEL32(?,?,?,00401888), ref: 004020EF
Part of subcall function 004020C0: LoadResource.KERNEL32 ref: 00402108
Part of subcall function 004020C0: LockResource.KERNEL32 ref: 00402117

FindWindowExA.USER32 ref: 0040132A
GetWindowTextA.USER32 ref: 00401350
strstr.MSVCRT ref: 0040135F
FindWindowExA.USER32 ref: 0040137F

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: FindResourceWindow$LoadLockTextmemsetstrstr
String ID:
API String ID: 1871962372-0
Opcode ID: 1298e7c1909e02cac85a35fd553868d9f91c7302c22f4e1a6b2c68c72ce7dee5
Instruction ID: 5d52d5c0b459d14cb6f1974f7d56ade6fd7020e608e51b2663064d8790cfeea0
Opcode Fuzzy Hash: 1298e7c1909e02cac85a35fd553868d9f91c7302c22f4e1a6b2c68c72ce7dee5
Instruction Fuzzy Hash: 282160B2A083019BE714AF6AD54129FFBE4EF84354F01C83FE98CD3691E67885548B86

Function 00403700 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00403717

Part of subcall function 004033F0: FindResourceExA.KERNEL32 ref: 00403440
Part of subcall function 004033F0: LoadResource.KERNEL32 ref: 0040345C
Part of subcall function 004033F0: LockResource.KERNEL32 ref: 0040346B
Part of subcall function 004033F0: fprintf.MSVCRT ref: 004034B3
Part of subcall function 004033F0: atoi.MSVCRT ref: 004034C3
Part of subcall function 004033F0: FindResourceExA.KERNEL32 ref: 004034FE
Part of subcall function 004033F0: LoadResource.KERNEL32 ref: 0040351B
Part of subcall function 004033F0: LockResource.KERNEL32 ref: 0040352A

Part of subcall function 004033F0: fprintf.MSVCRT ref: 00403573
Part of subcall function 004033F0: atoi.MSVCRT ref: 00403583
Part of subcall function 004033F0: strcat.MSVCRT(?), ref: 0040361A
Part of subcall function 004033F0: strlen.MSVCRT ref: 00403622
Part of subcall function 004033F0: _itoa.MSVCRT ref: 00403639
Part of subcall function 004033F0: strlen.MSVCRT ref: 00403641

Strings

@, xrefs: 0040370D
-Xmx, xrefs: 00403756
-Xms, xrefs: 00403722

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: Resource$FindLoadLockatoifprintfstrlen$GlobalMemoryStatus_itoastrcat
String ID: -Xms$-Xmx$@
API String ID: 2157757142-2676391021
Opcode ID: dff8b46c210c447c65d657b453adb865e188cc97235aba00eb8c1e73047c40b0
Instruction ID: 0838842f76f9e4a7ac68c74f3cf3971a36c87926e8153908363a189b489a0147
Opcode Fuzzy Hash: dff8b46c210c447c65d657b453adb865e188cc97235aba00eb8c1e73047c40b0
Instruction Fuzzy Hash: 1D01D7B09097099FC704DF69E18154EBBF1EF88304F10883EF489A7385D738D9449B46

Function 00401AFC Relevance: 6.0, APIs: 4, Instructions: 26timewindowCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00401A32
KillTimer.USER32 ref: 00401A58
PostQuitMessage.USER32 ref: 00401A67
EnumWindows.USER32 ref: 00401B0D

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: CodeEnumExitKillMessagePostProcessQuitTimerWindows
String ID:
API String ID: 405088690-0
Opcode ID: 9d36f53bfc2b48dcf375a5f439baa85ef358b269035d827499970f5c7433ee0c
Instruction ID: 4530f2aae7447fe0df29e6f37fc7dc1219e95ab942fdeb78a325eac38ac8bd41
Opcode Fuzzy Hash: 9d36f53bfc2b48dcf375a5f439baa85ef358b269035d827499970f5c7433ee0c
Instruction Fuzzy Hash: 87F05EB59093008BC300BF34DA052197AE0AB40348F018A3FE8C5A33D1D77C9558EB9B

Function 00401B20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00401B2D

Strings

Laun, xrefs: 00401B47
ch4j, xrefs: 00401B4C

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: HandleModule
String ID: Laun$ch4j
API String ID: 4139908857-52159806
Opcode ID: ba5704b0daeddb5bd746fd9b5eed543a5f99ab6f6a48090e1268a62a4232c58d
Instruction ID: 3efb9f204aa9b6cf598ae448a7fd9fa3256bf58a8a3bede9923b47c04f3ea8c0
Opcode Fuzzy Hash: ba5704b0daeddb5bd746fd9b5eed543a5f99ab6f6a48090e1268a62a4232c58d
Instruction Fuzzy Hash: 30F01CB0A042058BD708EF3EEE053963AE2A784300F04C27ED409CB3B5EBB484618B8D

Function 00402531 Relevance: 5.1, APIs: 4, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00402564
strlen.MSVCRT ref: 00402573
strncpy.MSVCRT ref: 004025A9
strlen.MSVCRT ref: 004025B8

Memory Dump Source

Source File: 00000000.00000002.1359073088.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1359007891.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359113141.0000000000409000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359131273.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1359185315.0000000000414000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nsHwyCkyFr.jbxd

Similarity

API ID: strlen$strchrstrncpy
String ID:
API String ID: 4793283-0
Opcode ID: c717c3167b26713e1d36be612c62a11c9a96452fabd6d96aff045e23f77e9a9b
Instruction ID: 1041cfa0432d9ad742072a7b848d71ebc1d8de872eff087a6a568f2cbe167894
Opcode Fuzzy Hash: c717c3167b26713e1d36be612c62a11c9a96452fabd6d96aff045e23f77e9a9b
Instruction Fuzzy Hash: 0E11D3B8D04728ABCB009F55C5841AEFBB1EF48310F1684AAE8547B381C779AA41CBC6

Analysis Process: javaw.exePID: 7656, Parent PID: 7640COMMON

Executed Functions

Function 02790672 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2790000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9a74ad1facb2b777f8e68bd3b9585c3abf0eb644f452b4bba2d5b088e3e4f1
Instruction ID: 0bfbd5a9a49c299b4852dc2af9806be3289ea4906125236fdcbff1d50b77e289
Opcode Fuzzy Hash: df9a74ad1facb2b777f8e68bd3b9585c3abf0eb644f452b4bba2d5b088e3e4f1
Instruction Fuzzy Hash: BB1149B681022A9FCF24CF48D8815ADB7B0FB99324F164525DD65A7741D3346920CF90

Function 02790667 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2790000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673803d3c0d64bc346a69436ff40ff507c189774a9c81711587006cd83bdfd86
Instruction ID: 4651d1134710353c12cb836720a2d22951d7103964e7cd73c36b74e085d3fd60
Opcode Fuzzy Hash: 673803d3c0d64bc346a69436ff40ff507c189774a9c81711587006cd83bdfd86
Instruction Fuzzy Hash: A4118FB6D0022A8FCF24CF88D4865EDB7B0FB49324F164559DC64A7342D3346D61CB81

Function 02790722 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2790000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6657055d1cb97638c29c3afa1398fe00a75bf05f4923be127b3933239bc28b9
Instruction ID: ec65764643c41158d1422f4fbfe5db39b7f37606076f6fd3f4366767d357911e
Opcode Fuzzy Hash: b6657055d1cb97638c29c3afa1398fe00a75bf05f4923be127b3933239bc28b9
Instruction Fuzzy Hash: C3F0A576C0022ADB8F54DF48D4841ADBBB1FB45228B1A8596DC6977241D332AD62CF91

Function 027A4B78 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002792000.00000040.00000800.00020000.00000000.sdmp, Offset: 02792000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2792000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e9bd9c1b694fcc5e745f7907f82692276675359976f32f2426e15b88652bbb
Instruction ID: 5fc024cc2cf60923fdb107272c0ff4913bddf397b0526b27729e157439382342
Opcode Fuzzy Hash: 36e9bd9c1b694fcc5e745f7907f82692276675359976f32f2426e15b88652bbb
Instruction Fuzzy Hash: FEF079B6A04B16EBDB258F61C0047DAFBB4BB88718F15821AD92CA7350D778B4658BC0

Function 0279DA35 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002792000.00000040.00000800.00020000.00000000.sdmp, Offset: 02792000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2792000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a9b07b682c5e7f3f72a119ced51e2f77d7a8706903a2418a99b358167123f30
Instruction ID: 86ba84032e002e8549c00a2481cc8bbf5e98ad5523ec2247db105bede5d7300d
Opcode Fuzzy Hash: 9a9b07b682c5e7f3f72a119ced51e2f77d7a8706903a2418a99b358167123f30
Instruction Fuzzy Hash: 0FF0CAB6D00A1AABDB248F61C0047DAFBB4BB88714F19421AC52C67320D378B465CBC0

Function 027A3C76 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002792000.00000040.00000800.00020000.00000000.sdmp, Offset: 02792000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2792000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23f3f30023145bd5b9d8646c33d7ca644500e79b58848b01564098ff282c280
Instruction ID: c0b8479a2cb04cc779ac8e339e3553c60ca9f3a805ce52827253e148d0fa77eb
Opcode Fuzzy Hash: e23f3f30023145bd5b9d8646c33d7ca644500e79b58848b01564098ff282c280
Instruction Fuzzy Hash: 55F0CAB6D00A1AABDB248F61C0047DAFBB4BB88714F16421AC52CA7320D378B465CFC0

Function 027A45E9 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002792000.00000040.00000800.00020000.00000000.sdmp, Offset: 02792000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2792000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa91ac4db3d6f83bac3115f81c4e251ef1b8cbca671593b6c4611de73c4515a
Instruction ID: 2f35c50c1039b3cef2c4b836632182ecd9c4134556e91ca93f5ae6d63f0ce4d5
Opcode Fuzzy Hash: afa91ac4db3d6f83bac3115f81c4e251ef1b8cbca671593b6c4611de73c4515a
Instruction Fuzzy Hash: D0F0CAB6D00A1AABDB248F65C0047DAFBB4BB88724F19421AC52C63320D3B8B465CBC0

Non-executed Functions

Function 027903C0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1364023394.0000000002790000.00000040.00000800.00020000.00000000.sdmp, Offset: 02790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2790000_javaw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction ID: 6143f804da18813e045217a6b8ccf7ad278d9380312c89a78cf28a1d541bb54a
Opcode Fuzzy Hash: a012a9fb5cf5d9e1554885d89a3030425dd9bcc3e3bcfa4e280c99466c7885fc
Instruction Fuzzy Hash: 742103BA5182568FEF358F199C403D9B7E5FB09314F21482EDEC9E7710D3306A898B90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Process: Process Creation, Service: Service Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nsHwyCkyFr.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\7656

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: nsHwyCkyFr.exePID: 7640, Parent PID: 3504

General

Chronological Activities

Analysis Process: javaw.exePID: 7656, Parent PID: 7640

General

Windows Analysis Report
nsHwyCkyFr.exe

Function 00405D30 Relevance: 163.4, APIs: 70, Strings: 23, Instructions: 688
librarystringloaderCOMMON

Function 004013B0 Relevance: 58.1, APIs: 27, Strings: 6, Instructions: 365
stringtimewindowCOMMON

Function 00402CB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 122
COMMON

Function 00401150 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Function 00405390 Relevance: 121.2, APIs: 58, Strings: 11, Instructions: 479
stringfileCOMMON

Function 00404740 Relevance: 89.8, APIs: 43, Strings: 8, Instructions: 553
stringCOMMON

Function 00402920 Relevance: 52.7, APIs: 23, Strings: 7, Instructions: 218
stringregistryCOMMON

Function 00403D20 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 207
stringCOMMON

Function 00403790 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 171
stringCOMMON

Function 00406860 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
stringprocesssynchronizationCOMMON

Function 00402690 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 73
stringCOMMON

Function 004027A0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 96
registrystringCOMMON

Function 00402829 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 64
stringregistryCOMMON

Function 004013E9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 128
windowstringtimeCOMMON

Function 0040124A Relevance: 10.5, APIs: 7, Instructions: 41
COMMON