Edit tour

Windows Analysis Report
DHL_Doc.9787653446578978656879764534576879764545766456.exe

Overview

General Information

Sample name:	DHL_Doc.9787653446578978656879764534576879764545766456.exe
Analysis ID:	1559106
MD5:	61bdc143810dff5cb798e3b005b6331c
SHA1:	d4353ab7ad96db756d9d7e93e9bcc9d1f97c629c
SHA256:	92c5d005c4454ff4be8093157b6f5d5cb11e7254fb3f979ffdddf167e464955f
Tags:	AgentTeslaDHLexeuser-abuse_ch
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DHL_Doc.9787653446578978656879764534576879764545766456.exe (PID: 5176 cmdline: "C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe" MD5: 61BDC143810DFF5CB798E3B005B6331C)

RegSvcs.exe (PID: 3088 cmdline: "C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.elquijotebanquetes.com", "Username": "urchman@elquijotebanquetes.com", "Password": "-GN,s*KH{VEhPmo)+f"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3408272306.0000000002765000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3455f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x345d1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3465b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x346ed:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34757:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x347c9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3485f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x348ef:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31697:$s2: GetPrivateProfileString 0x30d0c:$s3: get_OSFullName 0x323df:$s5: remove_Key 0x32567:$s5: remove_Key 0x33504:$s6: FtpWebRequest 0x34541:$s7: logins 0x34ab3:$s7: logins 0x377b8:$s7: logins 0x37876:$s7: logins 0x391c9:$s7: logins 0x38410:$s9: 1.85 (Hash, version 2, native byte-order)
Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 3088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 3088	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3455f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x345d1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3465b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x346ed:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34757:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x347c9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3485f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x348ef:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31697:$s2: GetPrivateProfileString 0x30d0c:$s3: get_OSFullName 0x323df:$s5: remove_Key 0x32567:$s5: remove_Key 0x33504:$s6: FtpWebRequest 0x34541:$s7: logins 0x34ab3:$s7: logins 0x377b8:$s7: logins 0x37876:$s7: logins 0x391c9:$s7: logins 0x38410:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3275f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x327d1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3285b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x328ed:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32957:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x329c9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32a5f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32aef:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f897:$s2: GetPrivateProfileString 0x2ef0c:$s3: get_OSFullName 0x305df:$s5: remove_Key 0x30767:$s5: remove_Key 0x31704:$s6: FtpWebRequest 0x32741:$s7: logins 0x32cb3:$s7: logins 0x359b8:$s7: logins 0x35a76:$s7: logins 0x373c9:$s7: logins 0x36610:$s9: 1.85 (Hash, version 2, native byte-order)
2.2.RegSvcs.exe.7c0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.7c0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.7c0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.7c0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3455f:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x345d1:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x3465b:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x346ed:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34757:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x347c9:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3485f:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x348ef:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.7c0000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31697:$s2: GetPrivateProfileString 0x30d0c:$s3: get_OSFullName 0x323df:$s5: remove_Key 0x32567:$s5: remove_Key 0x33504:$s6: FtpWebRequest 0x34541:$s7: logins 0x34ab3:$s7: logins 0x377b8:$s7: logins 0x37876:$s7: logins 0x391c9:$s7: logins 0x38410:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 9 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.RegSvcs.exe.7c0000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.elquijotebanquetes.com", "Username": "urchman@elquijotebanquetes.com", "Password": "-GN,s*KH{VEhPmo)+f"}

Multi AV Scanner detection for submitted file

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	ReversingLabs: Detection: 39%
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Virustotal: Detection: 39%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Joe Sandbox ML: detected

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2172546450.0000000003C90000.00000004.00001000.00020000.00000000.sdmp, DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2176058244.0000000003E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2172546450.0000000003C90000.00000004.00001000.00020000.00000000.sdmp, DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2176058244.0000000003E30000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007C6CA9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_007C60DD
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_007C63F9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007CEB60
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CF56F FindFirstFileW,FindClose,	0_2_007CF56F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007CF5FA
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007D1B2F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007D1C8A
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007D1F94

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007D4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_007D4EB5

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: ip-api.com

Source: RegSvcs.exe, 00000002.00000002.3408272306.0000000002812000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.3408272306.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002731000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, umlRMRbjNqD.cs

.Net Code: HekSQQsMT

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007D6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_007D6B0C

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007D6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_007D6D07

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

0_2_007D6B0C

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_007C2B37

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007EF7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_007EF7FF

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00783D19
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_49d20ece-5
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: {SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_7da829fb-b
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1993571c-2
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1d14e916-a

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C6606: CreateFileW,DeviceIoControl,CloseHandle,

0_2_007C6606

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007BACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_007BACC5

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007C79D3

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007AB043	0_2_007AB043
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_00793200	0_2_00793200
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_00793B70	0_2_00793B70
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007B410F	0_2_007B410F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A02A4	0_2_007A02A4
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0078E3E3	0_2_0078E3E3
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007B038E	0_2_007B038E
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007B467F	0_2_007B467F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A06D9	0_2_007A06D9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007EAACE	0_2_007EAACE
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007B4BEF	0_2_007B4BEF
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007ACCC1	0_2_007ACCC1
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0078AF50	0_2_0078AF50
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_00786F07	0_2_00786F07
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0079B11F	0_2_0079B11F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007E31BC	0_2_007E31BC
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007AD1B9	0_2_007AD1B9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007B724D	0_2_007B724D
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A123A	0_2_007A123A
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007893F0	0_2_007893F0
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C13CA	0_2_007C13CA
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0079F563	0_2_0079F563
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CB6CC	0_2_007CB6CC
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007896C0	0_2_007896C0
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007EF7FF	0_2_007EF7FF
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007877B0	0_2_007877B0
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007B79C9	0_2_007B79C9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0079FA57	0_2_0079FA57
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_00789B60	0_2_00789B60
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_00787D19	0_2_00787D19
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0079FE6F	0_2_0079FE6F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A9ED0	0_2_007A9ED0
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_00787FA3	0_2_00787FA3
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174CEA8	0_2_0174CEA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00C9A6E0	2_2_00C9A6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00C94A88	2_2_00C94A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00C93E70	2_2_00C93E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00C941B8	2_2_00C941B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00C9DD13	2_2_00C9DD13
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05EA2588	2_2_05EA2588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05EA13D8	2_2_05EA13D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05EA3D28	2_2_05EA3D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05EA3640	2_2_05EA3640

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: String function: 007A6AC0 appears 42 times
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: String function: 007AF8A0 appears 35 times
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: String function: 0079EC2F appears 68 times

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2174531234.0000000003DB3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL_Doc.9787653446578978656879764534576879764545766456.exe
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2176058244.0000000003F5D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL_Doc.9787653446578978656879764534576879764545766456.exe
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename07823960-0dbd-43bb-aade-b6626acc7f4a.exe0 vs DHL_Doc.9787653446578978656879764534576879764545766456.exe

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, v9Lsz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, VFo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, 5FJ0H20tobu.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, NtdoTGO.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, XBsYgp.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, AwxUa2Na.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, 19C9FfZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, 19C9FfZ.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, soCD8XkwU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, soCD8XkwU.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@1/1

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007CCE7A GetLastError,FormatMessageW,

0_2_007CCE7A

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007BAB84 AdjustTokenPrivileges,CloseHandle,		0_2_007BAB84
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007BB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007BB134

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007CE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007CE1FD

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_007C6532

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007DC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_007DC18C

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_0078406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_0078406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

File created: C:\Users\user\AppData\Local\Temp\aut3EFA.tmp

Jump to behavior

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3408272306.0000000002830000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002843000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	ReversingLabs: Detection: 39%
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe "C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Static file information: File size 1078784 > 1048576

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2172546450.0000000003C90000.00000004.00001000.00020000.00000000.sdmp, DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2176058244.0000000003E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2172546450.0000000003C90000.00000004.00001000.00020000.00000000.sdmp, DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000003.2176058244.0000000003E30000.00000004.00001000.00020000.00000000.sdmp

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_0079E01E LoadLibraryA,GetProcAddress,

0_2_0079E01E

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0079288B push 66007923h; retn 007Fh	0_2_007928E1
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A6B05 push ecx; ret	0_2_007A6B18
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174D1FC pushfd ; ret	0_2_0174D1FD
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174D1DA pushfd ; ret	0_2_0174D1DB
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174DE71 push eax; retf 0004h	0_2_0174DEDF

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007E8111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_007E8111
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0079EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0079EB42

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007A123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007A123A

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

API/Special instruction interceptor: Address: 174CACC

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002812000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002765000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Evaded block: after key decision

graph_0-94607

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-96519

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

API coverage: 4.5 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007C6CA9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_007C60DD
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007C63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_007C63F9
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007CEB60
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CF56F FindFirstFileW,FindClose,	0_2_007CF56F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007CF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007CF5FA
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007D1B2F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007D1C8A
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007D1F94

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_0079DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0079DDC0

Source: RegSvcs.exe, 00000002.00000002.3408272306.0000000002765000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: RegSvcs.exe, 00000002.00000002.3409279242.0000000005A59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	API call chain: ExitProcess graph end node			graph_0-94893
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	API call chain: ExitProcess graph end node			graph_0-93993

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_00C97078 CheckRemoteDebuggerPresent,

2_2_00C97078

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007D6AAF BlockInput,

0_2_007D6AAF

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_00783D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00783D19

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007B3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_007B3920

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_0079E01E LoadLibraryA,GetProcAddress,

0_2_0079E01E

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174B708 mov eax, dword ptr fs:[00000030h]	0_2_0174B708
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174CD38 mov eax, dword ptr fs:[00000030h]	0_2_0174CD38
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_0174CD98 mov eax, dword ptr fs:[00000030h]	0_2_0174CD98

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007BA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_007BA66C

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_007A81AC
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007A8189 SetUnhandledExceptionFilter,		0_2_007A8189

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 4BC008

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007BB106 LogonUserW,

0_2_007BB106

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_00783D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00783D19

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C411C SendInput,keybd_event,

0_2_007C411C

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C74E7 mouse_event,

0_2_007C74E7

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

0_2_007BA66C

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007C71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_007C71FA

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: Shell_TrayWnd
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007A65C4 cpuid

0_2_007A65C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007D091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_007D091D

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007FB340 GetUserNameW,

0_2_007FB340

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_007B1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_007B1E8E

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe

Code function: 0_2_0079DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0079DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3088, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: WIN_81
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: WIN_XP
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: WIN_XPe
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: WIN_VISTA
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: WIN_7
Source: DHL_Doc.9787653446578978656879764534576879764545766456.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3408272306.0000000002765000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3088, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DHL_Doc.9787653446578978656879764534576879764545766456.exe.3c00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DHL_Doc.9787653446578978656879764534576879764545766456.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 3088, type: MEMORYSTR

Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_007D8C4F
Source: C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe	Code function: 0_2_007D923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_007D923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Virtualization/Sandbox Evasion	Cached Domain Credentials	22 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL_Doc.9787653446578978656879764534576879764545766456.exe	39%	ReversingLabs	Win32.Trojan.AutoitInject
DHL_Doc.9787653446578978656879764534576879764545766456.exe	39%	Virustotal		Browse
DHL_Doc.9787653446578978656879764534576879764545766456.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://account.dyn.com/	DHL_Doc.9787653446578978656879764534576879764545766456.exe, 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3408272306.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002731000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	RegSvcs.exe, 00000002.00000002.3408272306.0000000002812000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.00000000027F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3408272306.0000000002731000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559106
Start date and time:	2024-11-20 07:53:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL_Doc.9787653446578978656879764534576879764545766456.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 59 Number of non-executed functions: 287
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	file.exe	Get hash	malicious	Unknown	Browse	ip-api.com/line/
	FACTER9098767800.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/
	XSLHv0kxy7.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	oaUNY8P657.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	IAdjMfB2A5.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	paket teklif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FACTER9098767800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	XSLHv0kxy7.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	oaUNY8P657.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	file.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	http://ok.clicknowvip.com	Get hash	malicious	Unknown	Browse	162.252.214.5
	paket teklif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	FACTER9098767800.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Wire slip account payable.pif.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	file.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	XSLHv0kxy7.exe	Get hash	malicious	XWorm	Browse	208.95.112.1

Process:	C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe
File Type:	data
Category:	dropped
Size (bytes):	146170
Entropy (8bit):	7.7473196469982675
Encrypted:	false
SSDEEP:	3072:x+rPAAID3y/VlYpjAbpb9V4fyv3otVlVg+uAL61TdzaVj:x+7ID3yysbpbC03ojlnWaV
MD5:	3BA5DA050F344AA587C754FE0D7BC581
SHA1:	8A8A1C872D990DADA69DCDA6FF815587E78AE493
SHA-256:	4F10C5ABFD2C89C86367FAD0F81087B6D90E109C69DAEBDEF66C63C8B9BDD9CF
SHA-512:	B7590D0C361F037F00FB5D030ABE6FCB1A36F34AD86C525ED277EEBE037FCF1DF0CEE54AF40A543BB0E3B4290FE37CCB388F37DF6EE67B2A9ADCAF6360A71082
Malicious:	false
Reputation:	low
Preview:	EA06.....Z.....Z...SM.>.M..h........)3..6j.!........'r......e..z......k.+%.CV.J&.+.^Q^..1.5R.K.M.2idR...[k...R.4.T......(....Z......l.5..j.I.RpUJl.r...~.4........@..6...eW..@$3U...F.1...(1K.E..Y.RcS...5).&@......j..<.0. ..3M\|....Lk. .P....@P@.;Y.. .............h.....A...=i.U...0..6...... M...mh.....k1...OX.T......].Ti.......Bf.xx...........R..u.i.~.X.T...D.K.....3(..98..F..._'....qf[L]+..k/tk..AN..:...S7...:v.-G.\|..'.<..OX.l..:.Z.0.Qz\|O..i..h.z..u..Ix..Z..X.....[.O........"..........DV.%....&.V.Jc.*L.m4..j....I..........{0...r....Uj%..:.x.....G<..5;l......`.p..d.`E...0..[..%..............@....@..".A...;....J6{v.!Y5.x'....h..h7...H23.\|....{..+...\..h.......s;...............M&...F}]..nT.....M...../.....D....F.\)...4..<...u....9.. ........==.f......Z..sZ......Y4......{G.O.p1N.M.j...A...4:.>.....4..u$.0+....iM...6....'.S.S....3.Lh..ul.......v.7..59.~R..L...:.7Z..).....6.Sd.....{..kU.1..0.V.s..>............m....O[..mT ...5..0.......r...-1.M.j

C:\Users\user\AppData\Local\Temp\outbluffed

Download File

Process:	C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe
File Type:	data
Category:	dropped
Size (bytes):	244736
Entropy (8bit):	6.715119996849362
Encrypted:	false
SSDEEP:	3072:q3PTd5PisUIP6gbzuW1nLD3xRU+owC1I6sLAjGt9FAmaqXLjgSTUo/qOA+Ozv6yY:q37d5RUQ6gbdxXxRU+buIdL/pASgaivY
MD5:	F53BB419587B0504DF9BC58BE619D73D
SHA1:	DBF6864123990801A04473F6BDF5082AC9A123DB
SHA-256:	D2CE1A8C48AC1C05204F871D6300005C1793890E245EC6E4356F6C5C3FC84B13
SHA-512:	97039A7310E281AB8F6F2D19717EAB208FEDA7DB81040E67B4D1915EE116607E8A561E9BA8DEBA6354ABD3B464F9B4A8C22964FE8B949D4DCDA11429078459F4
Malicious:	false
Reputation:	low
Preview:	xk.1P9YZUOB4..WM.1D1S9YZ.OB4I0WM51D1S9YZQOB4I0WM51D1S9YZQOB4.0WM;..?S.P.p.Cx...%\BdA!V>(0"bW(^9"A.&TsK,4q&,....mX^ T}4TPuOB4I0WMetD1.8ZZ.f.QI0WM51D1.9[[ZNI4I.TM59D1S9YZ..A4I.WM5.G1S9.ZQoB4I2WM11D1S9YZUOB4I0WM5.@1S;YZQOB4K0..51T1S)YZQOR4I WM51D1C9YZQOB4I0WMU.G1.9YZQ.A4.5WM51D1S9YZQOB4I0WM51@1_9YZQOB4I0WM51D1S9YZQOB4I0WM51D1S9YZQOB4I0WM51D1S9YZQoB4A0WM51D1S9YZYoB4.0WM51D1S9YZ.;'L=0WM..G1S.YZQ.A4I2WM51D1S9YZQOB4i0W-.C7C09YZ.JB4I.TM57D1S.ZZQOB4I0WM51D1.9Y..='X&SWM91D1S9]ZQMB4I.TM51D1S9YZQOB4.0W.51D1S9YZQOB4I0WM..G1S9YZ.OB4K0RMa.F1_.XZROB4H0WK51D1S9YZQOB4I0WM51D1S9YZQOB4I0WM51D1S9YZQOB4I0WM(.....d.2\|>+7.k.V.2..J..6.{FqB.N%....T....nEQ.\|1.>c..X...E.E0HE.....i/IEGX.:.>%.N....rc@.{.K[.>..'h.!D......g...U%....D..V^).2I)64a.U/Q%$.3.0S9YZ.......\I.k~:VDe]:b...#<g..../OB4-0WMG1D129YZ.OB4&0WM[1D1-9YZ/OB4.0WMu1D1d9YZtOB4$0WM.1D1-9YZ.2M;..$F..1S9YZd....]..n....l .<o+....U.z.c\..@*.>s....J..R..F.)2j~.J47@4Q>]Y]rL...l75@4Q>]Y]rL...l....j... ....J.151D1S9.ZQ.B4I..M.1D1.9.Z..B4I..M.1.1..Z

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.975789802094544
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL_Doc.9787653446578978656879764534576879764545766456.exe
File size:	1'078'784 bytes
MD5:	61bdc143810dff5cb798e3b005b6331c
SHA1:	d4353ab7ad96db756d9d7e93e9bcc9d1f97c629c
SHA256:	92c5d005c4454ff4be8093157b6f5d5cb11e7254fb3f979ffdddf167e464955f
SHA512:	0074fcbe88119f522a33a61282b156bdcabca62e6948f89561ba6d17864c24b21349683c0396d72ed0d6e8eba82ddb755119358b7b4dba76e295e3b5cf3d8cc1
SSDEEP:	12288:Htb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaSTUqpKVjfgiJ6A:Htb20pkaCqT5TBWgNQ7ayUMglJ6A
TLSH:	BB35BF1373DE8361C3B25273BA55B741AEBF782506A5F46B2FD8093DE820122525EB73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673CC665 [Tue Nov 19 17:09:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007F2318CF116Fh
jmp 00007F2318CE4184h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F2318CE430Ah
cmp edi, eax
jc 00007F2318CE466Eh
bt dword ptr [004C0158h], 01h
jnc 00007F2318CE4309h
rep movsb
jmp 00007F2318CE461Ch
cmp ecx, 00000080h
jc 00007F2318CE44D4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F2318CE4310h
bt dword ptr [004BA370h], 01h
jc 00007F2318CE47E0h
bt dword ptr [004C0158h], 00000000h
jnc 00007F2318CE44ADh
test edi, 00000003h
jne 00007F2318CE44BEh
test esi, 00000003h
jne 00007F2318CE449Dh
bt edi, 02h
jnc 00007F2318CE430Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F2318CE4313h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F2318CE4365h
bt esi, 03h
jnc 00007F2318CE43B8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x3e460	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x103000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x3e460	0x3e600	13b4329145fda465538429fc936859d6	False	0.8939402241983968	data	7.814393346320674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x103000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x35767	data			1.000347058904116
RT_GROUP_ICON	0x101f20	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x101f98	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x101fac	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x101fc0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x101fd4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1020b0	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:54:48.946554899 CET	49710	80	192.168.2.6	208.95.112.1
Nov 20, 2024 07:54:48.951436043 CET	80	49710	208.95.112.1	192.168.2.6
Nov 20, 2024 07:54:48.951584101 CET	49710	80	192.168.2.6	208.95.112.1
Nov 20, 2024 07:54:48.952438116 CET	49710	80	192.168.2.6	208.95.112.1
Nov 20, 2024 07:54:48.957529068 CET	80	49710	208.95.112.1	192.168.2.6
Nov 20, 2024 07:54:49.407095909 CET	80	49710	208.95.112.1	192.168.2.6
Nov 20, 2024 07:54:49.455270052 CET	49710	80	192.168.2.6	208.95.112.1
Nov 20, 2024 07:55:39.620517969 CET	80	49710	208.95.112.1	192.168.2.6
Nov 20, 2024 07:55:39.621006966 CET	49710	80	192.168.2.6	208.95.112.1
Nov 20, 2024 07:56:29.409708023 CET	49710	80	192.168.2.6	208.95.112.1
Nov 20, 2024 07:56:29.414730072 CET	80	49710	208.95.112.1	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:54:48.932616949 CET	55037	53	192.168.2.6	1.1.1.1
Nov 20, 2024 07:54:48.939342022 CET	53	55037	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 07:54:48.932616949 CET	192.168.2.6	1.1.1.1	0x70ea	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 07:54:48.939342022 CET	1.1.1.1	192.168.2.6	0x70ea	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	208.95.112.1	80	3088	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:54:48.952438116 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Nov 20, 2024 07:54:49.407095909 CET	175	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:54:49 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	01:54:45
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"
Imagebase:	0x780000
File size:	1'078'784 bytes
MD5 hash:	61BDC143810DFF5CB798E3B005B6331C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000000.00000002.2183208774.0000000003C00000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:54:46
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"
Imagebase:	0x3f0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3408272306.0000000002765000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3407442270.00000000007C2000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	7.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	57

Executed Functions

Function 007AB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 748f037eabe05d9b997d6755f3e70ac10f075a746cbd9bdaa8dd825235b3a674
Instruction ID: b932cce6f64462b46de1c047ef4c6b615537f5a60048be31d60ed5b1749e889b
Opcode Fuzzy Hash: 748f037eabe05d9b997d6755f3e70ac10f075a746cbd9bdaa8dd825235b3a674
Instruction Fuzzy Hash: 19324075A02258CFDB248F54DC856E9B7B5FB8B310F1442D9E40AA7A52D7389E80CF52

Function 00783D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00783AA3,?), ref: 00783D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00783AA3,?), ref: 00783D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00841148,00841130,?,?,?,?,00783AA3,?), ref: 00783DC8

Part of subcall function 00786430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00783DEE,00841148,?,?,?,?,?,00783AA3,?), ref: 00786471

SetCurrentDirectoryW.KERNEL32(?,?,?,00783AA3,?), ref: 00783E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,008328F4,00000010), ref: 007F1CCE
SetCurrentDirectoryW.KERNEL32(?,00841148,?,?,?,?,?,00783AA3,?), ref: 007F1D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0081DAB4,00841148,?,?,?,?,?,00783AA3,?), ref: 007F1D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00783AA3), ref: 007F1D90

Part of subcall function 00783E6E: GetSysColorBrush.USER32(0000000F), ref: 00783E79
Part of subcall function 00783E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00783E88
Part of subcall function 00783E6E: LoadIconW.USER32(00000063), ref: 00783E9E
Part of subcall function 00783E6E: LoadIconW.USER32(000000A4), ref: 00783EB0
Part of subcall function 00783E6E: LoadIconW.USER32(000000A2), ref: 00783EC2
Part of subcall function 00783E6E: RegisterClassExW.USER32(?), ref: 00783F30

Part of subcall function 007836B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007836E6
Part of subcall function 007836B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00783707
Part of subcall function 007836B8: ShowWindow.USER32(00000000,?,?,?,?,00783AA3,?), ref: 0078371B
Part of subcall function 007836B8: ShowWindow.USER32(00000000,?,?,?,?,00783AA3,?), ref: 00783724

Part of subcall function 00784FFC: _memset.LIBCMT ref: 00785022
Part of subcall function 00784FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007850CB

Strings

This is a third-party compiled AutoIt script., xrefs: 007F1CC8
runas, xrefs: 007F1D84

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-3287110873
Opcode ID: 6902435fa570670c2e0824ab73eeeacff68a482c7d1963cc6c9fb4730b2bf209
Instruction ID: 85f5eec63b29a47d3a9a8b7bcf07d6af52c46f57ce207f2fcac387d3b691dd84
Opcode Fuzzy Hash: 6902435fa570670c2e0824ab73eeeacff68a482c7d1963cc6c9fb4730b2bf209
Instruction Fuzzy Hash: 2751E434A8424CEEDF11BBF8DC4DEAD7B75BF16B00F005065F611A2292DA7C4685CB21

Function 0079DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0079DDEC
GetCurrentProcess.KERNEL32(00000000,0081DC38,?,?), ref: 0079DEAC
GetNativeSystemInfo.KERNELBASE(?,0081DC38,?,?), ref: 0079DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 0079DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 0079DF1F
GetSystemInfo.KERNEL32(?,0081DC38,?,?), ref: 0079DF29
GetSystemInfo.KERNEL32(?,0081DC38,?,?), ref: 0079DF35

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 1f73187a2643c51105c7780b30e33c781b37550d8a3cdfe0fed8090f7a17e70c
Instruction ID: f4aec7b615ca9faf40ba641c027573d0d8b0ac0cff2a41af92911df9d30b4e65
Opcode Fuzzy Hash: 1f73187a2643c51105c7780b30e33c781b37550d8a3cdfe0fed8090f7a17e70c
Instruction Fuzzy Hash: B5619EB180A3C4DBCF25CF68A8C11F9BFB5AF29300B1989D9D8459F247C6688D49CB65

Function 0078406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,0078449E,?,?,00000000,00000001), ref: 0078407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,0078449E,?,?,00000000,00000001), ref: 00784092
LoadResource.KERNEL32(?,00000000,?,?,0078449E,?,?,00000000,00000001,?,?,?,?,?,?,007841FB), ref: 007F4F1A
SizeofResource.KERNEL32(?,00000000,?,?,0078449E,?,?,00000000,00000001,?,?,?,?,?,?,007841FB), ref: 007F4F2F
LockResource.KERNEL32(0078449E,?,?,0078449E,?,?,00000000,00000001,?,?,?,?,?,?,007841FB,00000000), ref: 007F4F42

Strings

SCRIPT, xrefs: 00784088

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 912397f5c446a2fa988141fc8f51e3989a142d51c495e4da15171b9c03f8c349
Instruction ID: c6e19d08b3d6267e98b5761fb5d21691d594032c791288acac3d0fc6eb8502d4
Opcode Fuzzy Hash: 912397f5c446a2fa988141fc8f51e3989a142d51c495e4da15171b9c03f8c349
Instruction Fuzzy Hash: F0113C71240701BFE7219B66EC49F677BB9FBC5B51F14856CF612962A0DBB1EC008A30

Function 007C6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,007F2F49), ref: 007C6CB9
FindFirstFileW.KERNELBASE(?,?), ref: 007C6CCA
FindClose.KERNEL32(00000000), ref: 007C6CDA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 4cdee48124cf5cc1b1492e6bad68de1161efa78f1b7ce835a29a8538089608fa
Instruction ID: 721ed3033e4782aa1021eaeba4eb1594a168a7c53b8bd110eba505bc2ff8bbaa
Opcode Fuzzy Hash: 4cdee48124cf5cc1b1492e6bad68de1161efa78f1b7ce835a29a8538089608fa
Instruction Fuzzy Hash: DCE0D83581051057C3306778EC4D8EA776CEE06339F10070EF571C21D0EB78E90055E5

Function 00793B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON

Download Yara Rule

Strings

@, xrefs: 00794176

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @
API String ID: 3728558374-2766056989
Opcode ID: 802768c3fe7e7607ff0d84620eca8bc9e680a972d5ec3936d2319e34f315aa99
Instruction ID: a2298d4858677035bc7a8d84154d237cb41d7443f18143124696399b688c2254
Opcode Fuzzy Hash: 802768c3fe7e7607ff0d84620eca8bc9e680a972d5ec3936d2319e34f315aa99
Instruction Fuzzy Hash: 66727D74E04209EBCF24DF94D485ABEB7B6FF48300F14805AE909AB351D779AE45CB91

Function 00793200 Relevance: 1.0, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: bfe9c6cf26a48c44a4ffa849b80aadfe1390b9336e101c2c7d302c6cfad354b2
Instruction ID: 5178aacbc2b8137b26352bb1dd1041b6bc7072aad1674d09f34e4113306e63f7
Opcode Fuzzy Hash: bfe9c6cf26a48c44a4ffa849b80aadfe1390b9336e101c2c7d302c6cfad354b2
Instruction Fuzzy Hash: 36923870608241DFDB24DF18D484B6AB7E1FF88308F14885DEA9A8B362D779ED45CB52

Function 0078E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0078E959
timeGetTime.WINMM ref: 0078EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0078ED2E
TranslateMessage.USER32(?), ref: 0078ED3F
DispatchMessageW.USER32(?), ref: 0078ED4A
LockWindowUpdate.USER32(00000000), ref: 0078ED79
DestroyWindow.USER32 ref: 0078ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0078ED9F
Sleep.KERNEL32(0000000A), ref: 007F5270
TranslateMessage.USER32(?), ref: 007F59F7
DispatchMessageW.USER32(?), ref: 007F5A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007F5A19

Strings

@TRAY_ID, xrefs: 007F54C9
@GUI_WINHANDLE, xrefs: 007F5360
@GUI_CTRLHANDLE, xrefs: 007F53AC
@GUI_CTRLID, xrefs: 007F5314

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 80dd2c0f1dfea5bf652382d57fbb40995f24fa784083d16e1098bd70aec7bb28
Instruction ID: 61d1b7ee7527319983441d38da12ac7330c1453c4db88005208034187f642017
Opcode Fuzzy Hash: 80dd2c0f1dfea5bf652382d57fbb40995f24fa784083d16e1098bd70aec7bb28
Instruction Fuzzy Hash: 2D62F570548344DFDB24EF64C889BBA77E4BF45304F04496DFA868B292DB79E844CB62

Function 007B5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 007B5EC3
___createFile.LIBCMT ref: 007B5F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 007B5F2D
__dosmaperr.LIBCMT ref: 007B5F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 007B5F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 007B5F6A
__dosmaperr.LIBCMT ref: 007B5F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 007B5F7C
__set_osfhnd.LIBCMT ref: 007B5FAC
__lseeki64_nolock.LIBCMT ref: 007B6016
__close_nolock.LIBCMT ref: 007B603C
__chsize_nolock.LIBCMT ref: 007B606C
__lseeki64_nolock.LIBCMT ref: 007B607E
__lseeki64_nolock.LIBCMT ref: 007B6176
__lseeki64_nolock.LIBCMT ref: 007B618B
__close_nolock.LIBCMT ref: 007B61EB

Part of subcall function 007AEA9C: CloseHandle.KERNELBASE(00000000,0082EEF4,00000000,?,007B6041,0082EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 007AEAEC
Part of subcall function 007AEA9C: GetLastError.KERNEL32(?,007B6041,0082EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 007AEAF6
Part of subcall function 007AEA9C: __free_osfhnd.LIBCMT ref: 007AEB03
Part of subcall function 007AEA9C: __dosmaperr.LIBCMT ref: 007AEB25

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

__lseeki64_nolock.LIBCMT ref: 007B620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 007B6342
___createFile.LIBCMT ref: 007B6361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 007B636E
__dosmaperr.LIBCMT ref: 007B6375
__free_osfhnd.LIBCMT ref: 007B6395
__invoke_watson.LIBCMT ref: 007B63C3
__wsopen_helper.LIBCMT ref: 007B63DD

Strings

@, xrefs: 007B5F98

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 95f944d078372e82696c770eaa78a78cc98760e35bc080c5dce1e04b1fb565fd
Instruction ID: 9dc14aa9d228f9cb10887a1e9e72db907630301c88f8bca0541346ce0cab3005
Opcode Fuzzy Hash: 95f944d078372e82696c770eaa78a78cc98760e35bc080c5dce1e04b1fb565fd
Instruction Fuzzy Hash: 94220671A046099FEF299F68DC89BFD7B61FB45324F284229E6219B2D1D33D8D40CB51

Function 007AEE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 4db0e0f8215f031b6ce2cd6756a4d90a1636e88bcebc628175214623dcf06e11
Instruction ID: e2ed4d4aa4bd72b8b1e3123a295fde9d704b65dd4a0c43884b68f192f1c411bf
Opcode Fuzzy Hash: 4db0e0f8215f031b6ce2cd6756a4d90a1636e88bcebc628175214623dcf06e11
Instruction Fuzzy Hash: 03322974E04245DFDB219F98D880BAE7FB1BFC7310F24426AE8559F292D7389842CB61

Function 007CFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 007CFA96
_wcschr.LIBCMT ref: 007CFAA4
_wcscpy.LIBCMT ref: 007CFABB
_wcscat.LIBCMT ref: 007CFACA
_wcscat.LIBCMT ref: 007CFAE8
_wcscpy.LIBCMT ref: 007CFB09
__wsplitpath.LIBCMT ref: 007CFBE6
_wcscpy.LIBCMT ref: 007CFC0B
_wcscpy.LIBCMT ref: 007CFC1D
_wcscpy.LIBCMT ref: 007CFC32
_wcscat.LIBCMT ref: 007CFC47
_wcscat.LIBCMT ref: 007CFC59
_wcscat.LIBCMT ref: 007CFC6E

Part of subcall function 007CBFA4: _wcscmp.LIBCMT ref: 007CC03E
Part of subcall function 007CBFA4: __wsplitpath.LIBCMT ref: 007CC083
Part of subcall function 007CBFA4: _wcscpy.LIBCMT ref: 007CC096
Part of subcall function 007CBFA4: _wcscat.LIBCMT ref: 007CC0A9
Part of subcall function 007CBFA4: __wsplitpath.LIBCMT ref: 007CC0CE
Part of subcall function 007CBFA4: _wcscat.LIBCMT ref: 007CC0E4
Part of subcall function 007CBFA4: _wcscat.LIBCMT ref: 007CC0F7

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 007CFA61

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: 81636c7785eb15a01f0006a35575e927554c728777c5cadad0aee56e6e2a9ce3
Instruction ID: f654f874bec3abea47f32242a1bd583bdd163b2ae5a84921f6275f3f837fd7ba
Opcode Fuzzy Hash: 81636c7785eb15a01f0006a35575e927554c728777c5cadad0aee56e6e2a9ce3
Instruction Fuzzy Hash: AD91B272604705EFCB20EF64C855F9AB3E9BF85310F04492DF95997292DB38EA44CB91

Function 007CBFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007CBDB4: __time64.LIBCMT ref: 007CBDBE

Part of subcall function 00784517: _fseek.LIBCMT ref: 0078452F

__wsplitpath.LIBCMT ref: 007CC083

Part of subcall function 007A1DFC: __wsplitpath_helper.LIBCMT ref: 007A1E3C

_wcscpy.LIBCMT ref: 007CC096
_wcscat.LIBCMT ref: 007CC0A9
__wsplitpath.LIBCMT ref: 007CC0CE
_wcscat.LIBCMT ref: 007CC0E4
_wcscat.LIBCMT ref: 007CC0F7
_wcscmp.LIBCMT ref: 007CC03E

Part of subcall function 007CC56D: _wcscmp.LIBCMT ref: 007CC65D
Part of subcall function 007CC56D: _wcscmp.LIBCMT ref: 007CC670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007CC2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007CC338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007CC34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007CC35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007CC371

Strings

p1#v`K$v, xrefs: 007CC2A1, 007CC338, 007CC35F, 007CC371

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID: p1#v`K$v
API String ID: 2378138488-1068180069
Opcode ID: fa1022f46cfa41ef5d7a1c37dc90b0a70fdc06bf5175ecb0a69a5e0016fdf6af
Instruction ID: 36cccd65f026852345f6c18ca1aafc6d7c9abb120afac350e00755f9abc21963
Opcode Fuzzy Hash: fa1022f46cfa41ef5d7a1c37dc90b0a70fdc06bf5175ecb0a69a5e0016fdf6af
Instruction Fuzzy Hash: 04C12AB1A00219AFDF11DF95CC85FDEB7B8AF49310F0040AAF609E6151DB749A848F61

Function 00783F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00783F86
RegisterClassExW.USER32(00000030), ref: 00783FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00783FC1
InitCommonControlsEx.COMCTL32(?), ref: 00783FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00783FEE
LoadIconW.USER32(000000A9), ref: 00784004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00784013

Strings

AutoIt v3 GUI, xrefs: 00783FA2
0, xrefs: 00783F68
+, xrefs: 00783F6F
TaskbarCreated, xrefs: 00783FB6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 3523112639cdcf661625bfe4b89b7c33e1629c7ec508d08bd94addc3834f0254
Instruction ID: 94f5c40afef5d0bc4ab2df8c917bb82b881475dddeac6579e1e5b0f354e2d078
Opcode Fuzzy Hash: 3523112639cdcf661625bfe4b89b7c33e1629c7ec508d08bd94addc3834f0254
Instruction Fuzzy Hash: 0C21C7B9900318AFDF40DFE4E889BCDBBB4FB19710F01421AFA25A62A0D7B54584CF91

Function 00783742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007837B3
KillTimer.USER32(?,00000001), ref: 007837DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00783800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0078380B
CreatePopupMenu.USER32 ref: 0078381F
PostQuitMessage.USER32(00000000), ref: 0078382E

Strings

TaskbarCreated, xrefs: 00783806

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 820b49b2d00c52468c1757d9a1c01b63039f75bcde8cd4351822b7ee0c26ab7e
Instruction ID: b66ce7cceec8a6617151573e616083029fa7ad19fd5e78b99a8adfeb8691c04f
Opcode Fuzzy Hash: 820b49b2d00c52468c1757d9a1c01b63039f75bcde8cd4351822b7ee0c26ab7e
Instruction Fuzzy Hash: 624125F5284249EBDF147BACEC8EB7A3A55FB01B01F400119FB12D2191DA6DDE80D761

Function 00783E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00783E79
LoadCursorW.USER32(00000000,00007F00), ref: 00783E88
LoadIconW.USER32(00000063), ref: 00783E9E
LoadIconW.USER32(000000A4), ref: 00783EB0
LoadIconW.USER32(000000A2), ref: 00783EC2

Part of subcall function 00784024: LoadImageW.USER32(00780000,00000063,00000001,00000010,00000010,00000000), ref: 00784048

RegisterClassExW.USER32(?), ref: 00783F30

Part of subcall function 00783F53: GetSysColorBrush.USER32(0000000F), ref: 00783F86
Part of subcall function 00783F53: RegisterClassExW.USER32(00000030), ref: 00783FB0
Part of subcall function 00783F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00783FC1
Part of subcall function 00783F53: InitCommonControlsEx.COMCTL32(?), ref: 00783FDE
Part of subcall function 00783F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00783FEE
Part of subcall function 00783F53: LoadIconW.USER32(000000A9), ref: 00784004
Part of subcall function 00783F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00784013

Strings

0, xrefs: 00783F02
#, xrefs: 00783F09
AutoIt v3, xrefs: 00783F1F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 694aba81edf92ae4bd8eb7b3d9db2aa03144f58b6d36aa6745dcc7a21a0ab2d3
Instruction ID: cafcef28636b3465cf9b4a66962fd06124853b7a74511137cfac637faf140970
Opcode Fuzzy Hash: 694aba81edf92ae4bd8eb7b3d9db2aa03144f58b6d36aa6745dcc7a21a0ab2d3
Instruction Fuzzy Hash: E8213AB8E40314AFDF10DFA9EC49A99BFF5FB49710F00522AE614A72A0D7754684CF91

Function 0174BE88 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0174BF59
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0174C17F

Memory Dump Source

Source File: 00000000.00000002.2183055598.0000000001749000.00000040.00000020.00020000.00000000.sdmp, Offset: 01749000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1749000_DHL_Doc.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: eb084072e95c2066e750f44a6d90df14a9e34cfd00309ff3be3b53d92e0a7586
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: A5A11970E01209EBDB15CFA8C898BEEFBB5BF48304F208199E615BB290D7759A41CF51

Function 007849FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00784A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007F41DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 007F421A
RegCloseKey.ADVAPI32(?), ref: 007F4249

Strings

Software\AutoIt v3\AutoIt, xrefs: 00784A13
Include, xrefs: 007F41D3, 007F4212

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: ec13fb604c5cdc0b8346798083069e765c04f52d75b2e782c569a68fdd2f1896
Instruction ID: 73b0b2d3b835ff99324f2a25451501a86021771af4cc2919aaeb074bad385e29
Opcode Fuzzy Hash: ec13fb604c5cdc0b8346798083069e765c04f52d75b2e782c569a68fdd2f1896
Instruction Fuzzy Hash: 6F113D71A40209FFEB04ABA4DD8AEFF7BACFF04354F004465B516E6291EA749E419750

Function 007836B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007836E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00783707
ShowWindow.USER32(00000000,?,?,?,?,00783AA3,?), ref: 0078371B
ShowWindow.USER32(00000000,?,?,?,?,00783AA3,?), ref: 00783724

Strings

edit, xrefs: 00783701
AutoIt v3, xrefs: 007836DE, 007836E3, 007836E4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: fe317febca68e0a76356d4fc0a7d32dcd285d3ab39010afc6dd3ef9399e94baa
Instruction ID: 34a332ce7fdfd6e84f87bdb0f8b7c57a76a9a258d1ec3cab9e372fc78022db35
Opcode Fuzzy Hash: fe317febca68e0a76356d4fc0a7d32dcd285d3ab39010afc6dd3ef9399e94baa
Instruction Fuzzy Hash: A0F0DA796807D07AEB715797AC0CE672E7DFBC7F20B00001ABA04A21A0C56908D5DAB1

Function 0174BC48 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0174BB38: Sleep.KERNELBASE(000001F4), ref: 0174BB49

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0174BD72

Strings

51D1S9YZQOB4I0WM, xrefs: 0174BDD5, 0174BDD8

Memory Dump Source

Source File: 00000000.00000002.2183055598.0000000001749000.00000040.00000020.00020000.00000000.sdmp, Offset: 01749000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1749000_DHL_Doc.jbxd

Similarity

API ID: CreateFileSleep
String ID: 51D1S9YZQOB4I0WM
API String ID: 2694422964-687684006
Opcode ID: 7f743126ae3914048edc7228d1486163cc6cac1fbd360b4f8a38dc87338e799e
Instruction ID: 3e62d66714267ab23cb124a2095f67606e8a68efa2d93ca6637072f69da109be
Opcode Fuzzy Hash: 7f743126ae3914048edc7228d1486163cc6cac1fbd360b4f8a38dc87338e799e
Instruction Fuzzy Hash: 02518E30D04259EBEF11DBA4D818BEEFB79AF58300F004199E648BB2C1D7B94B45CB66

Function 007851AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0078522F
_wcscpy.LIBCMT ref: 00785283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00785293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 007F3CB0

Strings

Line: , xrefs: 007F3CD9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 260e95c302fc77159f3426dd821e8c693b73ba6c5c3c928c8d8958d6cf37d5d5
Instruction ID: 4dbdd67f9ba9f16f4c89158d3b96245f7125341f00ce8cb4c43a18dd58bf86b9
Opcode Fuzzy Hash: 260e95c302fc77159f3426dd821e8c693b73ba6c5c3c928c8d8958d6cf37d5d5
Instruction Fuzzy Hash: 4D310F71588704AFC720FB60DC0AFDABBD8BF45310F00451AF58592191EB78A688CB92

Function 00784139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 007841A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007839FE,?,00000001), ref: 007841DB

_free.LIBCMT ref: 007F36B7
_free.LIBCMT ref: 007F36FE

Part of subcall function 0078C833: __wsplitpath.LIBCMT ref: 0078C93E
Part of subcall function 0078C833: _wcscpy.LIBCMT ref: 0078C953
Part of subcall function 0078C833: _wcscat.LIBCMT ref: 0078C968
Part of subcall function 0078C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0078C978

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 007F3491
Bad directive syntax error, xrefs: 007F36E4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: 09c640bdfbbf270a1d9fea7645b2fee08359d9748283c60ba4cee79da0fda6e2
Instruction ID: 1c51c472b49eb8a4e348c04f0490dda6b6fdc9fa408ac1a51add6234ccf8b56b
Opcode Fuzzy Hash: 09c640bdfbbf270a1d9fea7645b2fee08359d9748283c60ba4cee79da0fda6e2
Instruction Fuzzy Hash: 73913C71910219EBCF04EFA4DC959FDB7B4BF18310F104429F916EB291DB78AA55CBA0

Function 00784A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00785374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00841148,?,007861FF,?,00000000,00000001,00000000), ref: 00785392

Part of subcall function 007849FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00784A1D

_wcscat.LIBCMT ref: 007F2D80
_wcscat.LIBCMT ref: 007F2DB5

Strings

\, xrefs: 007F2DA2
\Include\, xrefs: 00784B0A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: \$\Include\
API String ID: 3592542968-2640467822
Opcode ID: 147dc100510b18173bff2f5980505ff47a0191d0f8d16120de1290ca00122f99
Instruction ID: cfb0e7a4f85dfd5b71a317ae9fa5aec894dd9bdc388a6c2586d16c253508de50
Opcode Fuzzy Hash: 147dc100510b18173bff2f5980505ff47a0191d0f8d16120de1290ca00122f99
Instruction Fuzzy Hash: 48519879508344DFC314FF59D8858AAB7F8FF5A310B80492EF645D3261EB78A948CB62

Function 007A34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 007A34FE

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 007A3539
__wopenfile.LIBCMT ref: 007A3549

Strings

<G, xrefs: 007A34CD, 007A34F0, 007A34FC

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 6a8e61286d9929646be85b1c47ce3aff4ee6a276f9bda01202546d1522a0a907
Instruction ID: c8ed065ccb44188c47c1afefb8d9e469dc49497f01544338c5dccbdb8b412faa
Opcode Fuzzy Hash: 6a8e61286d9929646be85b1c47ce3aff4ee6a276f9bda01202546d1522a0a907
Instruction Fuzzy Hash: B111A770A00306DADB51BF749C4667E76A4AFCB360B198725F415D7281EB3CCA1197B1

Function 0079D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0079D28B,SwapMouseButtons,00000004,?), ref: 0079D2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,0079D28B,SwapMouseButtons,00000004,?,?,?,?,0079C865), ref: 0079D2DD
RegCloseKey.KERNELBASE(00000000,?,?,0079D28B,SwapMouseButtons,00000004,?,?,?,?,0079C865), ref: 0079D2FF

Strings

Control Panel\Mouse, xrefs: 0079D2BA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 1ab413fdb5bf5786fd3efd6ceaa187b71e8a8e17290f7fd5eec2434dedae0989
Instruction ID: e6f42996bbb27896da28c28380c8cc5f7288cbe1a3a7624ea9b6240611f26233
Opcode Fuzzy Hash: 1ab413fdb5bf5786fd3efd6ceaa187b71e8a8e17290f7fd5eec2434dedae0989
Instruction Fuzzy Hash: 58113575611208FFDF208FA8EC85EEF7BB8EF54745F108869E805E7210E635AE419B60

Function 0174AB38 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0174B365
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0174B389
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0174B3AB

Memory Dump Source

Source File: 00000000.00000002.2183055598.0000000001749000.00000040.00000020.00020000.00000000.sdmp, Offset: 01749000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1749000_DHL_Doc.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: ec40cea32e34b77dc66852b254e16eb814eeb5cb53dbe13a3b9b961a1e41453f
Instruction ID: 487e8df2f51ec8fd3c604dbd1097dcdc1b50ebbf342118762e479e5bf4149bd5
Opcode Fuzzy Hash: ec40cea32e34b77dc66852b254e16eb814eeb5cb53dbe13a3b9b961a1e41453f
Instruction Fuzzy Hash: 6962EB30A14258DBEB24CFA4C854BDEB776EF58300F1091A9D10DEB394E7799E81CB5A

Function 007A365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A36B7
_memcpy_s.LIBCMT ref: 007A3729
__filbuf.LIBCMT ref: 007A37AA
_memset.LIBCMT ref: 007A37EE

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 183c989a3d5f6e59f411e9a3c40cc400f0bfe7bd43b7f44b2ec0e110d1d6b850
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: 6F51A2B1A00305EBDB288FA9888466E77A5AFC2320F248729F835962D0D77D9F50CB50

Function 007CC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00784517: _fseek.LIBCMT ref: 0078452F

Part of subcall function 007CC56D: _wcscmp.LIBCMT ref: 007CC65D
Part of subcall function 007CC56D: _wcscmp.LIBCMT ref: 007CC670

_free.LIBCMT ref: 007CC4DD
_free.LIBCMT ref: 007CC4E4
_free.LIBCMT ref: 007CC54F

Part of subcall function 007A1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,007A7A85), ref: 007A1CB1
Part of subcall function 007A1C9D: GetLastError.KERNEL32(00000000,?,007A7A85), ref: 007A1CC3

_free.LIBCMT ref: 007CC557

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction ID: c083d4af90cdaa974208fe631b5a432ece34d4f5085fd97ff6dde0f8b0953317
Opcode Fuzzy Hash: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction Fuzzy Hash: 06516CB1904219EFDF259F64DC85BAEBBB9EF48310F1040AEF20DA3241DB755A908F58

Function 0079EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0079EBB2

Part of subcall function 007851AF: _memset.LIBCMT ref: 0078522F
Part of subcall function 007851AF: _wcscpy.LIBCMT ref: 00785283
Part of subcall function 007851AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00785293

KillTimer.USER32(?,00000001,?,?), ref: 0079EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0079EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007F3C88

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 4f0f0173753e932e3adf6211654d0d87a4db7066c52e92a057c319f0f93359a4
Instruction ID: 6b730a902192f5253d26f2ce4aa535ca30774406b0c63348eb1b9f4be90a2d26
Opcode Fuzzy Hash: 4f0f0173753e932e3adf6211654d0d87a4db7066c52e92a057c319f0f93359a4
Instruction Fuzzy Hash: 0821DA705047849FEB32DB28D859BE7BFECAB02304F04044DE69E56281C3786A84CB61

Function 007840E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F3725
GetOpenFileNameW.COMDLG32 ref: 007F376F

Part of subcall function 0078660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007853B1,?,?,007861FF,?,00000000,00000001,00000000), ref: 0078662F

Part of subcall function 007840A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007840C6

Strings

X, xrefs: 007F373E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 51089674f024b51eb0b0df7d4cb2b2aca31048b195534ac02dd7689ee88713a8
Instruction ID: 0ff2bb767eca2360d6fbc44cf462543ce26dfdf4571c380cc54cb9db663804f4
Opcode Fuzzy Hash: 51089674f024b51eb0b0df7d4cb2b2aca31048b195534ac02dd7689ee88713a8
Instruction Fuzzy Hash: 43219671A10198ABCB01EFD4D8497EE7BF8AF89304F108059E505E7241DBFC5A898FA5

Function 007CC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 007CC72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 007CC746

Strings

aut, xrefs: 007CC740

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: de7e353094cdac6a347fd83d4beb72385d8936b5cb887046b4fa3902ed282c23
Instruction ID: f8c9dcea3bc4ffc21606ecee93c14c9c1b5732bd30da7ee55f30ac6b5fa56be8
Opcode Fuzzy Hash: de7e353094cdac6a347fd83d4beb72385d8936b5cb887046b4fa3902ed282c23
Instruction Fuzzy Hash: 3BD05E7250030EABDB50AB90DC0EF8A7B6CA700704F0005A07650E51B1DAB4E6998B94

Function 007DF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a356c30688e51d64d1c410a3ea3aeaa97bb6e7bdef2ffabb1ddc6c02d14cddc7
Instruction ID: c7e159288ad2d8b4b84f82a6be465d280e0a21511c3dbfb3f22b89065072d669
Opcode Fuzzy Hash: a356c30688e51d64d1c410a3ea3aeaa97bb6e7bdef2ffabb1ddc6c02d14cddc7
Instruction Fuzzy Hash: 39F15771604301DFCB10DF24C895B6AB7E5BF89314F14892EF99A9B392D738E905CB82

Function 00784FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00785022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007850CB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 59246a51217c1c8e6a48fd2ae1c9b65f48149688598f356099c6c911c3525fcc
Instruction ID: 33e65278cdc23cdb74b65e7e0efde04428db95d09d4e5fbaa79e4f26aa325c7a
Opcode Fuzzy Hash: 59246a51217c1c8e6a48fd2ae1c9b65f48149688598f356099c6c911c3525fcc
Instruction Fuzzy Hash: 953196B1504B01CFD721EF74D849697BBE4FF49304F00092EF69A87251E775A984CBA6

Function 007A395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 007A3973

Part of subcall function 007A81C2: __NMSG_WRITE.LIBCMT ref: 007A81E9
Part of subcall function 007A81C2: __NMSG_WRITE.LIBCMT ref: 007A81F3

__NMSG_WRITE.LIBCMT ref: 007A397A

Part of subcall function 007A821F: GetModuleFileNameW.KERNEL32(00000000,00840312,00000104,00000000,00000001,00000000), ref: 007A82B1
Part of subcall function 007A821F: ___crtMessageBoxW.LIBCMT ref: 007A835F

Part of subcall function 007A1145: ___crtCorExitProcess.LIBCMT ref: 007A114B
Part of subcall function 007A1145: ExitProcess.KERNEL32 ref: 007A1154

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

RtlAllocateHeap.NTDLL(014F0000,00000000,00000001,00000001,00000000,?,?,0079F507,?,0000000E), ref: 007A399F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 77696af5401c8030cb5637024613ec1cd02440c753c2cf4994a8fb5db3cc9d4f
Instruction ID: 14dc5395a4b406c359d3aeca6548c4f896ff5e6f46c514b948a1be79a544f619
Opcode Fuzzy Hash: 77696af5401c8030cb5637024613ec1cd02440c753c2cf4994a8fb5db3cc9d4f
Instruction Fuzzy Hash: E4019635245301DAE6153F74EC4AA6B774CABC3768F210326F50596191DFBCAD008661

Function 007CC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,007CC385,?,?,?,?,?,00000004), ref: 007CC6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,007CC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 007CC708
CloseHandle.KERNEL32(00000000,?,007CC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007CC70F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 87f9b5ff9f694e0db7fc7d336f701c1ec88c83fe0d7b35eab052687b403ba50d
Instruction ID: d0ac30cd51ca41cb19fe3252ea86cd7b2abe3cf90c1bf7ba70c449546609a786
Opcode Fuzzy Hash: 87f9b5ff9f694e0db7fc7d336f701c1ec88c83fe0d7b35eab052687b403ba50d
Instruction Fuzzy Hash: 02E08632140314B7D7611B94AC09FCA7F18FB05760F104210FB14690E097B125118798

Function 007CBB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007CBB72

Part of subcall function 007A1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,007A7A85), ref: 007A1CB1
Part of subcall function 007A1C9D: GetLastError.KERNEL32(00000000,?,007A7A85), ref: 007A1CC3

_free.LIBCMT ref: 007CBB83
_free.LIBCMT ref: 007CBB95

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction ID: 4c0e39244c88a774dd724897fc4b80814839940adad1d33660ebfd27fa199dca
Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction Fuzzy Hash: 68E0C2E160070082EA2069786E49FB313CC0F45321F04090DB419E3142DF2CEC4085B4

Function 00782322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 007822A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007824F1), ref: 00782303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007825A1
CoInitialize.OLE32(00000000), ref: 00782618
CloseHandle.KERNEL32(00000000), ref: 007F503A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: 97ebf7cce2c97cea9ced3412f729ee20323f4ef1401e4824f69d420a0956b2fd
Instruction ID: adc1bfbc04b34e2885bf9480047fc7ad8bfbbd404d2571d11cf64288bb45a24a
Opcode Fuzzy Hash: 97ebf7cce2c97cea9ced3412f729ee20323f4ef1401e4824f69d420a0956b2fd
Instruction Fuzzy Hash: F871CFB89413658BCF04EFAAE89D494BBA5FB9A344780422ED219C7772DBB844C4CF14

Function 007CBBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007CBC18

Strings

EA06, xrefs: 007CBC46

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 6f4a9c2d15b2dd90546e7013bf1898973c3ab684035bc13ea6e960dba1d601cf
Instruction ID: ac7fd5c4fc488c4108f59421ae9441a1fb6618c5ac09eccc5755e5c78f7a6e65
Opcode Fuzzy Hash: 6f4a9c2d15b2dd90546e7013bf1898973c3ab684035bc13ea6e960dba1d601cf
Instruction Fuzzy Hash: B001B971904258BEDB28C798C856FEDBBF89B15301F00455EF552D6181D578A7048B70

Function 007E0828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 007E08FD

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

_wcscpy.LIBCMT ref: 007E098C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: bc2c64f8b08a14b7f262f5cbfd7a3d53e48ef81aad3da0b53e396a40799f1d53
Instruction ID: 3276019c33733f0729db373d45e0ef9f7c8571191b8a590cf37aca621825031c
Opcode Fuzzy Hash: bc2c64f8b08a14b7f262f5cbfd7a3d53e48ef81aad3da0b53e396a40799f1d53
Instruction Fuzzy Hash: 41912834A01604DFCB18EF29C4959ADB7E5FF49310B55C46AE85A8F3A2DB78ED41CB80

Function 00783A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00783A73

Part of subcall function 007A1405: __lock.LIBCMT ref: 007A140B

Part of subcall function 00783ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00783AF3
Part of subcall function 00783ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00783B08

Part of subcall function 00783D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00783AA3,?), ref: 00783D45
Part of subcall function 00783D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00783AA3,?), ref: 00783D57
Part of subcall function 00783D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00841148,00841130,?,?,?,?,00783AA3,?), ref: 00783DC8
Part of subcall function 00783D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00783AA3,?), ref: 00783E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00783AB3

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: 8d07a73c2d633b7c79fbc1ce59f2124c78fdc0c22b0a31ff48c8d017d1b37de8
Instruction ID: b5314b35f0ccf77127a65f609ce3ae01ee5b44d65d621a58d3bbc6a07a123722
Opcode Fuzzy Hash: 8d07a73c2d633b7c79fbc1ce59f2124c78fdc0c22b0a31ff48c8d017d1b37de8
Instruction Fuzzy Hash: 8A119D75A08341DBC700EF69E84991AFBE8FF96710F008A1EF584872A2DB749585CF92

Function 007AE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 007AEA29
__close_nolock.LIBCMT ref: 007AEA42

Part of subcall function 007A7BDA: __getptd_noexit.LIBCMT ref: 007A7BDA

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: e9a007e03eb1f2ff0f1519af064d011ac0bfff67b84480934d3751a27e80a559
Instruction ID: 9bb0472d689b37f2b84ce6902ae32a624225edcca945c55c350b5a4a9688d3f0
Opcode Fuzzy Hash: e9a007e03eb1f2ff0f1519af064d011ac0bfff67b84480934d3751a27e80a559
Instruction Fuzzy Hash: C51170B2909610DAD716BB689C453697A617FC3331F2A8350E4345F2E3CBBC8841CAA1

Function 0079F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 007A395C: __FF_MSGBANNER.LIBCMT ref: 007A3973
Part of subcall function 007A395C: __NMSG_WRITE.LIBCMT ref: 007A397A
Part of subcall function 007A395C: RtlAllocateHeap.NTDLL(014F0000,00000000,00000001,00000001,00000000,?,?,0079F507,?,0000000E), ref: 007A399F

std::exception::exception.LIBCMT ref: 0079F51E
__CxxThrowException@8.LIBCMT ref: 0079F533

Part of subcall function 007A6805: RaiseException.KERNEL32(?,?,0000000E,00836A30,?,?,?,0079F538,0000000E,00836A30,?,00000001), ref: 007A6856

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: b84c5a188d2417ac88bc35d0ee4a762a10249827a2f82d9223f9028c68a502e3
Instruction ID: e0314b4bf1c54a2de2e96b2993f07afa57f5ce9122413e6c001fbba3ca9032ee
Opcode Fuzzy Hash: b84c5a188d2417ac88bc35d0ee4a762a10249827a2f82d9223f9028c68a502e3
Instruction Fuzzy Hash: F4F0AF3110422EA7EB04BFDCEC069DE77ACAF41394F648226FA08D2191DBB8965496A5

Function 007A3839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A3868
__lock_file.LIBCMT ref: 007A3889

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: d8208808d53e7a0d59774c1ee6354bc06c718036846bb699b9ad9b74db7d31a5
Instruction ID: c7c20a02a003271fe8bd43c2641c899f1f36179261dbcb064bdb27403d1f952d
Opcode Fuzzy Hash: d8208808d53e7a0d59774c1ee6354bc06c718036846bb699b9ad9b74db7d31a5
Instruction Fuzzy Hash: 25018471900209FBCF22AFA48C0989E7B61BFC2361F158319F82456161D77D8B61DFA1

Function 007A35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

__lock_file.LIBCMT ref: 007A3629

Part of subcall function 007A4E1C: __lock.LIBCMT ref: 007A4E3F

__fclose_nolock.LIBCMT ref: 007A3634

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: b9c87e425f1e3316504cd1d22246d02e76e6d8c2d1c61fd41c7d704b1d74fce6
Instruction ID: c7b29a46f6bd1e278d2e9e6623c63699bc4e6557338b579a5c448b34c8285191
Opcode Fuzzy Hash: b9c87e425f1e3316504cd1d22246d02e76e6d8c2d1c61fd41c7d704b1d74fce6
Instruction Fuzzy Hash: 41F09671901204EAD7117F65880A75E76A06FD3330F298349F420AB2C1C77C86419E55

Function 0174AB35 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 0174B365
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0174B389
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0174B3AB

Memory Dump Source

Source File: 00000000.00000002.2183055598.0000000001749000.00000040.00000020.00020000.00000000.sdmp, Offset: 01749000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1749000_DHL_Doc.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 119f5e1bf593c9750e916eb3160708a3ed2d53d0f52a1c870a1150a28f1606e4
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: 9112CD24E18658C7EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4E81CF5A

Function 0078E8A0 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417bb679ceaad8a4f567474de9afd2fd15c037afe00782249d4b1237c43cf775
Instruction ID: e8dda558eafba8cdb5d9798870cbfacb76a55a1a944586cb5d3efba0c038921f
Opcode Fuzzy Hash: 417bb679ceaad8a4f567474de9afd2fd15c037afe00782249d4b1237c43cf775
Instruction Fuzzy Hash: F471D8709483849FEF25DF14C8487797BD0FB52314F08496EEA858B361E779E885CB92

Function 007A2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 007A2A0B

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: ff184aa1cc67178a0c0df65922df6d7b610e9b3916cd0a1d3b0a9d1a5dbc7802
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: 624192716007069FDB288F6DC88056F77A6AFC6760F24C72DEC55D7242EA78ED428B40

Function 0079ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0079EDC7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 4c140592a2a7433219582ef37af719d8dfcf876885a3ebb60faee2a3732d3489
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 0631C274B00505DBDB18DF58E480A69FBA6FF49340B6486A5E40ACB366DB39EDC1CBD0

Function 007E040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007E0519

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4336dbe2fb500dbb4b805f61c437714f8d5504006cac333bf481c5b8ab24ae93
Instruction ID: 5f4088a4e66665abf64abdbf48e6628515bf14e8ee35d84f8a1c2fea886035b6
Opcode Fuzzy Hash: 4336dbe2fb500dbb4b805f61c437714f8d5504006cac333bf481c5b8ab24ae93
Instruction Fuzzy Hash: C531C575205A54DFCF01AF51D084A6E7BB0FF4A320F10844AEA951F386D7B8A951CFD1

Function 007F9A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 007F9A80

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b034b118166d1174d3a3c961a988cdac35073a09e9c98d02d9b7b4277d4c3936
Instruction ID: a52fd8e5afe3096146e2c8d1eb4cbf7c37b994bac89976df50d14fe19302169f
Opcode Fuzzy Hash: b034b118166d1174d3a3c961a988cdac35073a09e9c98d02d9b7b4277d4c3936
Instruction Fuzzy Hash: 5D414F70504651CFDB24DF14D484B1ABBE1BF45304F2989ACE99A4B362C37AF855CF92

Function 007AED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 51ed332b9dd9555718a9cd40760c3384171af2d89e2d55fad6c0141e5f63cb16
Instruction ID: 8bafc5d78409dc1744ff448d01c2798e6fb9a53c6046df5c102bfa2aee5974b4
Opcode Fuzzy Hash: 51ed332b9dd9555718a9cd40760c3384171af2d89e2d55fad6c0141e5f63cb16
Instruction Fuzzy Hash: 96213BB2949640DBD7167FA89C497593A61AFC3736F260740E4704B1E2DBBC8901DBB1

Function 007841A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00784214: FreeLibrary.KERNEL32(00000000,?), ref: 00784247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007839FE,?,00000001), ref: 007841DB

Part of subcall function 00784291: FreeLibrary.KERNEL32(00000000), ref: 007842C4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: 5ba6810734a49a1b1f2608cee5f4ce6dbec055746d816d708bc9ad35248afb03
Instruction ID: 104e41419c609f9a31cc9a77708f0020be35f7a3565113cd78d6fcce216cbbf5
Opcode Fuzzy Hash: 5ba6810734a49a1b1f2608cee5f4ce6dbec055746d816d708bc9ad35248afb03
Instruction Fuzzy Hash: 49119131684207EBDB10BB64DC0AFAE77A9BF40700F108429B596E61C1EAB89A049B60

Function 007F9B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 007F9B51

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: b32a0391831a4a46d72ece3bd6e8c099833bd1e614353d256bc5a9e7eef06afa
Instruction ID: 99575bd55bd513200be281d179d3d95070467e5d1368929a093cbb48b45047ba
Opcode Fuzzy Hash: b32a0391831a4a46d72ece3bd6e8c099833bd1e614353d256bc5a9e7eef06afa
Instruction Fuzzy Hash: 48215770608701CFDB24DF64D448B1ABBE1BF85304F254968F69A47322D739E855CF92

Function 007AAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 007AAFC0

Part of subcall function 007A7BDA: __getptd_noexit.LIBCMT ref: 007A7BDA

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: a04907e315db442ca0ad547960e120c2147b6100b624c4145ab0c42914c1ffd7
Instruction ID: fe80ad4ebc9a67ff99814f33815158203918d85b6742026d64b9dcf5f6c6ab7a
Opcode Fuzzy Hash: a04907e315db442ca0ad547960e120c2147b6100b624c4145ab0c42914c1ffd7
Instruction Fuzzy Hash: D2119DB2809600DFD7166FA49C4A75A3A60AFC3332F2A4340E5301F1E3D7BC8900DBA1

Function 007839DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction ID: 87992b7a4d4a627ec6a924cf379600551ecf8d51951bf761c3cff8296e002a4b
Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction Fuzzy Hash: BD01863154010EEECF05FF64C8958FEBBB4EF10304F008129B525971A5EA349A49CB60

Function 007A2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 007A2AED

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 04a538a49f1e8df571c53d1ed834b4963221a8135d76ed6874db33d3363b3d07
Instruction ID: 434dc6bacb93ca5b48e0847fd2478e3aa4e080b6fedb095897d5b606cb0b9759
Opcode Fuzzy Hash: 04a538a49f1e8df571c53d1ed834b4963221a8135d76ed6874db33d3363b3d07
Instruction Fuzzy Hash: DAF06231500215EBDF21AF6C8C0A79F36A5BFC2320F198655B8249A192D77D8A53DB51

Function 00784252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,007839FE,?,00000001), ref: 00784286

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c6cd7501e152e617422b79019eebd521bb4c120aba04c8463f75b5dea204e030
Instruction ID: b3b461857bbbdfb3caacfa4822cb8373e146c21843dffc3b9e824d7fb8590610
Opcode Fuzzy Hash: c6cd7501e152e617422b79019eebd521bb4c120aba04c8463f75b5dea204e030
Instruction Fuzzy Hash: A8F03971549702DFCB34AF64D894816BBE4BF043253248A3EF1D682610C7BA9840DF50

Function 007840A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007840C6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 3443bfe9739090d18d5416a035a0bc13921093f969ddbd1d7932a43b8c17cc7f
Instruction ID: a6bbfc1f929bdd050d5c84634d03ed5f96fe39c53ef3c4f2c77a031538c359f1
Opcode Fuzzy Hash: 3443bfe9739090d18d5416a035a0bc13921093f969ddbd1d7932a43b8c17cc7f
Instruction Fuzzy Hash: E0E0CD365002245BC711A694CC46FEA779DDFC8690F054175F905D7244DD68D9818690

Function 007CBCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007CBD16

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: 6d0522970b2dff602f46dcbe0b2a24317ba0f8e67f79bcd0f8b69bc101ce093a
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: 2AE09AB0204B009BDB388A24D801BE373E0EB0A309F00095DF2AB83242EBA67C418A59

Function 0174BB38 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 0174BB49

Memory Dump Source

Source File: 00000000.00000002.2183055598.0000000001749000.00000040.00000020.00020000.00000000.sdmp, Offset: 01749000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1749000_DHL_Doc.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 3d358c92618a359d459034edbed50a4cb8cf3d520635223fe9bd26b7350f2a1a
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 5DE0E67494020DDFDB00DFB8D54969D7BB4EF04301F100161FD01D2281D7309D50CA62

Non-executed Functions

Function 007EF7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 007EF87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007EF8DC
GetWindowLongW.USER32(?,000000F0), ref: 007EF919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007EF940
SendMessageW.USER32 ref: 007EF966
_wcsncpy.LIBCMT ref: 007EF9D2
GetKeyState.USER32(00000011), ref: 007EF9F3
GetKeyState.USER32(00000009), ref: 007EFA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007EFA16
GetKeyState.USER32(00000010), ref: 007EFA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007EFA4F
SendMessageW.USER32 ref: 007EFA72
SendMessageW.USER32(?,00001030,?,007EE059), ref: 007EFB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 007EFB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 007EFB96
SetCapture.USER32(?), ref: 007EFB9F
ClientToScreen.USER32(?,?), ref: 007EFC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007EFC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 007EFC29
ReleaseCapture.USER32 ref: 007EFC34
GetCursorPos.USER32(?), ref: 007EFC69
ScreenToClient.USER32(?,?), ref: 007EFC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 007EFCD8
SendMessageW.USER32 ref: 007EFD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 007EFD41
SendMessageW.USER32 ref: 007EFD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 007EFD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 007EFD8F
GetCursorPos.USER32(?), ref: 007EFDB0
ScreenToClient.USER32(?,?), ref: 007EFDBD
GetParent.USER32(?), ref: 007EFDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 007EFE3F
SendMessageW.USER32 ref: 007EFE6F
ClientToScreen.USER32(?,?), ref: 007EFEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 007EFEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 007EFF19
SendMessageW.USER32 ref: 007EFF3C
ClientToScreen.USER32(?,?), ref: 007EFF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 007EFFB6
GetWindowLongW.USER32(?,000000F0), ref: 007F004B

Strings

F, xrefs: 007EFF42
@GUI_DRAGID, xrefs: 007EFBCC

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: ae90ef50d3a5d80870e40eebe085a44171154b224d6df7dd15f21bca48b1622d
Instruction ID: e1998f2a0d924876609eca8167b8be286addeb48d026ebc1b6fdf8f85e4b0f49
Opcode Fuzzy Hash: ae90ef50d3a5d80870e40eebe085a44171154b224d6df7dd15f21bca48b1622d
Instruction Fuzzy Hash: AD32BA74605384EFDB20CF68C888BAABBA8FF49354F144629F695C76A1C735EC81CB51

Function 007EAACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 007EB1CD

Strings

%d/%02d/%02d, xrefs: 007EAEFC

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: e591e10b903f9f4c5ba9d37a1e8215be06beb01c045a9b0b2a965f3c03ef028c
Instruction ID: 5dbe539a42c2e08a2aba6c175712966518740d6ee2dfb1f829e700c9f519cead
Opcode Fuzzy Hash: e591e10b903f9f4c5ba9d37a1e8215be06beb01c045a9b0b2a965f3c03ef028c
Instruction Fuzzy Hash: 9C12D0B1601388ABEB259F66CC49FAB7BB8FF49320F104119F915DA2E1DB789901CB51

Function 0079EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0079EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007F3AEA
IsIconic.USER32(000000FF), ref: 007F3AF3
ShowWindow.USER32(000000FF,00000009), ref: 007F3B00
SetForegroundWindow.USER32(000000FF), ref: 007F3B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007F3B20
GetCurrentThreadId.KERNEL32 ref: 007F3B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 007F3B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 007F3B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 007F3B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 007F3B54
SetForegroundWindow.USER32(000000FF), ref: 007F3B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 007F3B6C
keybd_event.USER32(00000012,00000000), ref: 007F3B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 007F3B81
keybd_event.USER32(00000012,00000000), ref: 007F3B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 007F3B8F
keybd_event.USER32(00000012,00000000), ref: 007F3B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 007F3B9E
keybd_event.USER32(00000012,00000000), ref: 007F3BA3
SetForegroundWindow.USER32(000000FF), ref: 007F3BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 007F3BCD

Strings

Shell_TrayWnd, xrefs: 007F3AE5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 2e21316739ef80db6c2a97a2df92266cad05e0e613ab56eeb5037cef523e8720
Instruction ID: fcae044ba58ea60ab6f3d4f0935a4784b801d578093aa492ca2ee597c1f27a68
Opcode Fuzzy Hash: 2e21316739ef80db6c2a97a2df92266cad05e0e613ab56eeb5037cef523e8720
Instruction Fuzzy Hash: 793164B1A4031CBFEB216BA59C4AF7F7E6CFB44B50F104015FB05EA2D1DAB55D01AAA0

Function 007BACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 007BB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007BB180
Part of subcall function 007BB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007BB1AD
Part of subcall function 007BB134: GetLastError.KERNEL32 ref: 007BB1BA

_memset.LIBCMT ref: 007BAD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 007BAD5A
CloseHandle.KERNEL32(?), ref: 007BAD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007BAD82
GetProcessWindowStation.USER32 ref: 007BAD9B
SetProcessWindowStation.USER32(00000000), ref: 007BADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 007BADBF

Part of subcall function 007BAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007BACC0), ref: 007BAB99
Part of subcall function 007BAB84: CloseHandle.KERNEL32(?,?,007BACC0), ref: 007BABAB

Strings

, xrefs: 007BAD17
winsta0, xrefs: 007BAD7D
default, xrefs: 007BADBA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 106f1e4d75f7016c18a76b5f680e1d9bb5fa246c5afee92bcd72472a963469c5
Instruction ID: 7e3ee66e3e057207c85b108164dd9499ef3b103099fa9325f9dcbe26077342c3
Opcode Fuzzy Hash: 106f1e4d75f7016c18a76b5f680e1d9bb5fa246c5afee92bcd72472a963469c5
Instruction Fuzzy Hash: 20814BB1900209BFEF11AFA4DC49BEEBB79FF04304F044119F924A6161D77A8E55DB61

Function 007C60DD Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007C6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007C5FA6,?), ref: 007C6ED8

Part of subcall function 007C6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007C5FA6,?), ref: 007C6EF1

Part of subcall function 007C725E: __wsplitpath.LIBCMT ref: 007C727B
Part of subcall function 007C725E: __wsplitpath.LIBCMT ref: 007C728E

Part of subcall function 007C72CB: GetFileAttributesW.KERNEL32(?,007C6019), ref: 007C72CC

_wcscat.LIBCMT ref: 007C6149
_wcscat.LIBCMT ref: 007C6167
__wsplitpath.LIBCMT ref: 007C618E
FindFirstFileW.KERNEL32(?,?), ref: 007C61A4
_wcscpy.LIBCMT ref: 007C6209
_wcscat.LIBCMT ref: 007C621C
_wcscat.LIBCMT ref: 007C622F
lstrcmpiW.KERNEL32(?,?), ref: 007C625D
DeleteFileW.KERNEL32(?), ref: 007C626E
MoveFileW.KERNEL32(?,?), ref: 007C6289
MoveFileW.KERNEL32(?,?), ref: 007C6298
CopyFileW.KERNEL32(?,?,00000000), ref: 007C62AD
DeleteFileW.KERNEL32(?), ref: 007C62BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007C62E1
FindClose.KERNEL32(00000000), ref: 007C62FD
FindClose.KERNEL32(00000000), ref: 007C630B

Strings

p1#v`K$v, xrefs: 007C61BA
\*.*, xrefs: 007C6138, 007C6147, 007C6165

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*$p1#v`K$v
API String ID: 1917200108-1732502266
Opcode ID: 5fd15acce0450bfdeeae771992128583e3401da6b73fa7620bc8e0cc9d033d82
Instruction ID: 269439543fcf5c614efcaf8e0ab747282c558cb89d1e35f9d4fddac4f968fbb7
Opcode Fuzzy Hash: 5fd15acce0450bfdeeae771992128583e3401da6b73fa7620bc8e0cc9d033d82
Instruction Fuzzy Hash: EF51017290821CAACB21EB91CC88EDB77BCBF05310F0905EEE545E2141DE3A9749CFA4

Function 007D6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0081DC00), ref: 007D6B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 007D6B44
GetClipboardData.USER32(0000000D), ref: 007D6B4C
CloseClipboard.USER32 ref: 007D6B58
GlobalLock.KERNEL32(00000000), ref: 007D6B74
CloseClipboard.USER32 ref: 007D6B7E
GlobalUnlock.KERNEL32(00000000), ref: 007D6B93
IsClipboardFormatAvailable.USER32(00000001), ref: 007D6BA0
GetClipboardData.USER32(00000001), ref: 007D6BA8
GlobalLock.KERNEL32(00000000), ref: 007D6BB5
GlobalUnlock.KERNEL32(00000000), ref: 007D6BE9
CloseClipboard.USER32 ref: 007D6CF6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: ed3d9d9a53d27baed63ea5036acc8ac61643bfdc8687890d815d33d14ef5d4fa
Instruction ID: 3bd5314350a0b732a2d33c563acee597242591fa88154b45993abe4f20df71ac
Opcode Fuzzy Hash: ed3d9d9a53d27baed63ea5036acc8ac61643bfdc8687890d815d33d14ef5d4fa
Instruction Fuzzy Hash: FA518E71240301ABD311BFA4CD9AF6E77B8BF94B10F10042AF59AD62D1DF78E9058B62

Function 007CF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007CF62B
FindClose.KERNEL32(00000000), ref: 007CF67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007CF6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007CF6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 007CF6E2
__swprintf.LIBCMT ref: 007CF72E
__swprintf.LIBCMT ref: 007CF767
__swprintf.LIBCMT ref: 007CF7BB

Part of subcall function 007A172B: __woutput_l.LIBCMT ref: 007A1784

__swprintf.LIBCMT ref: 007CF809
__swprintf.LIBCMT ref: 007CF858
__swprintf.LIBCMT ref: 007CF8A7
__swprintf.LIBCMT ref: 007CF8F6

Strings

%02d, xrefs: 007CF7B0, 007CF7B9, 007CF807, 007CF856, 007CF8A5, 007CF8F4
%4d%02d%02d%02d%02d%02d, xrefs: 007CF728
%4d, xrefs: 007CF761

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: 1fb7b4dbaeaffc7f294c76f5a5a2a3dfa2a14a433d37da555463c6f7a9b87841
Instruction ID: f0ef9d3bca6ee839d4c8797ab29b232a75f84e9607b3b5f6912c420772359534
Opcode Fuzzy Hash: 1fb7b4dbaeaffc7f294c76f5a5a2a3dfa2a14a433d37da555463c6f7a9b87841
Instruction Fuzzy Hash: A3A1EEB2504344EBC711FBA4C889DAFB7ECAF95704F44092EF595C2152EB38E949C762

Function 007D1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 007D1B50
_wcscmp.LIBCMT ref: 007D1B65
_wcscmp.LIBCMT ref: 007D1B7C
GetFileAttributesW.KERNEL32(?), ref: 007D1B8E
SetFileAttributesW.KERNEL32(?,?), ref: 007D1BA8
FindNextFileW.KERNEL32(00000000,?), ref: 007D1BC0
FindClose.KERNEL32(00000000), ref: 007D1BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 007D1BE7
_wcscmp.LIBCMT ref: 007D1C0E
_wcscmp.LIBCMT ref: 007D1C25
SetCurrentDirectoryW.KERNEL32(?), ref: 007D1C37
SetCurrentDirectoryW.KERNEL32(008339FC), ref: 007D1C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 007D1C5F
FindClose.KERNEL32(00000000), ref: 007D1C6C
FindClose.KERNEL32(00000000), ref: 007D1C7C

Strings

*.*, xrefs: 007D1BE2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 5b43bbc7c5a0dcccdf9d59f81a63e4bd34e3d649754108b8f1a7ca5309086198
Instruction ID: 43c158306f8ee7213fd0fef5fc711cd597680e261e0c0fda397f796feeb6440c
Opcode Fuzzy Hash: 5b43bbc7c5a0dcccdf9d59f81a63e4bd34e3d649754108b8f1a7ca5309086198
Instruction Fuzzy Hash: 37319372640319BADB10ABE0DC49BDE77BCAF46320F544157E815D3290EB78DA858A64

Function 007D1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 007D1CAB
_wcscmp.LIBCMT ref: 007D1CC0
_wcscmp.LIBCMT ref: 007D1CD7

Part of subcall function 007C6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007C6BEF

FindNextFileW.KERNEL32(00000000,?), ref: 007D1D06
FindClose.KERNEL32(00000000), ref: 007D1D11
FindFirstFileW.KERNEL32(*.*,?), ref: 007D1D2D
_wcscmp.LIBCMT ref: 007D1D54
_wcscmp.LIBCMT ref: 007D1D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 007D1D7D
SetCurrentDirectoryW.KERNEL32(008339FC), ref: 007D1D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 007D1DA5
FindClose.KERNEL32(00000000), ref: 007D1DB2
FindClose.KERNEL32(00000000), ref: 007D1DC2

Strings

*.*, xrefs: 007D1D28

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: b9f260c9864c26a329624bcfeb58ac78624b05aadfb491dd34525755e73b785c
Instruction ID: 65ac1400a2bf95e70a883656b1037e961ee97c4fc5b193d2ad75e713829208c8
Opcode Fuzzy Hash: b9f260c9864c26a329624bcfeb58ac78624b05aadfb491dd34525755e73b785c
Instruction Fuzzy Hash: 6031063260061ABADF10EFA0DC09BDE7BBDAF45320F544552F811E3290DB78DE85CA64

Function 00787D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00787DBD

Strings

^, xrefs: 00787D96
\, xrefs: 00787D89
\, xrefs: 007FF95B
[:<:]], xrefs: 00787D1D
Q\E, xrefs: 007886D6
], xrefs: 00787D9F
[, xrefs: 00787E14
\b(?=\w), xrefs: 007FF85E
\, xrefs: 00787E1D
\b(?<=\w), xrefs: 007FF877
[:>:]], xrefs: 00787D37

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _memset
String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
API String ID: 2102423945-2023335898
Opcode ID: be2ec4d665ada2f59d238aee14cde4cf6e6134cb449c75cde47d4293825f8aec
Instruction ID: 9b7eacbab52e71fe3e62d0bc6659c4977b302c14126c66d100c30f74d34b3b3c
Opcode Fuzzy Hash: be2ec4d665ada2f59d238aee14cde4cf6e6134cb449c75cde47d4293825f8aec
Instruction Fuzzy Hash: B982B171D04219CBCB28DF98C8807BDBBB1FF45310F258169D95AAB391EB789D85CB90

Function 007D091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007D09DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 007D09EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007D09FB
__wsplitpath.LIBCMT ref: 007D0A59
_wcscat.LIBCMT ref: 007D0A71
_wcscat.LIBCMT ref: 007D0A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007D0A98
SetCurrentDirectoryW.KERNEL32(?), ref: 007D0AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 007D0ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 007D0AFF
_wcscpy.LIBCMT ref: 007D0B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 007D0B4A

Strings

*.*, xrefs: 007D0B05

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: a552d2a8a6cdb98602180c11be7bdeea3e43e6510bdfd589147e91ac7cd365a9
Instruction ID: 358b01652bec18bc035b831ab329b413fe2991e8ed36d2a11c5d490367f32db3
Opcode Fuzzy Hash: a552d2a8a6cdb98602180c11be7bdeea3e43e6510bdfd589147e91ac7cd365a9
Instruction Fuzzy Hash: C4613AB25083059FD710EF60C855AAEB3E8FF89314F04491EF999C7252DB39E945CB92

Function 007BA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 007BABD7
Part of subcall function 007BABBB: GetLastError.KERNEL32(?,007BA69F,?,?,?), ref: 007BABE1
Part of subcall function 007BABBB: GetProcessHeap.KERNEL32(00000008,?,?,007BA69F,?,?,?), ref: 007BABF0
Part of subcall function 007BABBB: HeapAlloc.KERNEL32(00000000,?,007BA69F,?,?,?), ref: 007BABF7
Part of subcall function 007BABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 007BAC0E

Part of subcall function 007BAC56: GetProcessHeap.KERNEL32(00000008,007BA6B5,00000000,00000000,?,007BA6B5,?), ref: 007BAC62
Part of subcall function 007BAC56: HeapAlloc.KERNEL32(00000000,?,007BA6B5,?), ref: 007BAC69
Part of subcall function 007BAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,007BA6B5,?), ref: 007BAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007BA6D0
_memset.LIBCMT ref: 007BA6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007BA704
GetLengthSid.ADVAPI32(?), ref: 007BA715
GetAce.ADVAPI32(?,00000000,?), ref: 007BA752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007BA76E
GetLengthSid.ADVAPI32(?), ref: 007BA78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007BA79A
HeapAlloc.KERNEL32(00000000), ref: 007BA7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 007BA7C2
CopySid.ADVAPI32(00000000), ref: 007BA7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007BA7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007BA820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 007BA834

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 9f315d2e6d1b901f5b92d297882124fcce15a7d5be53c51cf6cc5c9bb6ab2e98
Instruction ID: 577225f08519ca7d25974151bff4fd10ce0bc82be6c6dad6df7ed2aaeeed8e61
Opcode Fuzzy Hash: 9f315d2e6d1b901f5b92d297882124fcce15a7d5be53c51cf6cc5c9bb6ab2e98
Instruction Fuzzy Hash: 95512B71900209BFDF15EFA5DC49AEEBBB9FF04300F048169F915AB291DB399A05CB61

Function 007C63F9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007C6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007C5FA6,?), ref: 007C6ED8

Part of subcall function 007C72CB: GetFileAttributesW.KERNEL32(?,007C6019), ref: 007C72CC

_wcscat.LIBCMT ref: 007C6441
__wsplitpath.LIBCMT ref: 007C645F
FindFirstFileW.KERNEL32(?,?), ref: 007C6474
_wcscpy.LIBCMT ref: 007C64A3
_wcscat.LIBCMT ref: 007C64B8
_wcscat.LIBCMT ref: 007C64CA
DeleteFileW.KERNEL32(?), ref: 007C64DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 007C64EB
FindClose.KERNEL32(00000000), ref: 007C6506

Strings

p1#v`K$v, xrefs: 007C64DA
\*.*, xrefs: 007C643B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*$p1#v`K$v
API String ID: 2643075503-1732502266
Opcode ID: 352d91554e8af126b780696a2547f1cd904612de373d29878858e69c75a6cf70
Instruction ID: d469b379ff0b1968498a1df1eb9ee12128435963fa91525eb6b1891ac4527b9c
Opcode Fuzzy Hash: 352d91554e8af126b780696a2547f1cd904612de373d29878858e69c75a6cf70
Instruction Fuzzy Hash: BF3128B24083849EC721EBE48889EDBB7DCAF96310F444A1EF5D5C3141EA39D64987A7

Function 00786F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UTF), xrefs: 00802C7C
ANY), xrefs: 00802E60
CR), xrefs: 00802E09
NO_START_OPT), xrefs: 00802CD1
ANYCRLF), xrefs: 00802E7D
UCP), xrefs: 00802C8F
LIMIT_MATCH=, xrefs: 00802CF2
CRLF), xrefs: 00802E43
LF), xrefs: 00802E26
BSR_UNICODE), xrefs: 00802EBA
LIMIT_RECURSION=, xrefs: 00802D7E
UTF16), xrefs: 00802C56
NO_AUTO_POSSESS), xrefs: 00802CB0
BSR_ANYCRLF), xrefs: 00802EA0

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 4b64b17504cf1fa6186b991728bb2da71dd2dad08d06f6cee472345d1f0fe2c3
Instruction ID: a6a1b366f5bf503a422ba919f38316a347f196e057041f79f78a57fcedf61221
Opcode Fuzzy Hash: 4b64b17504cf1fa6186b991728bb2da71dd2dad08d06f6cee472345d1f0fe2c3
Instruction Fuzzy Hash: 01728171E04219DBDF68DF98C8447AEB7B5FF48310F24416AE909EB281DB749E41DB90

Function 007E31BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E2BB5,?,?), ref: 007E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E328E

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 007E332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007E33C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 007E3604
RegCloseKey.ADVAPI32(00000000), ref: 007E3611

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: d5dbf977c1095fb6e33ab7e8cc789ff43f97e641de7fea21e418f54d9f4e50fb
Instruction ID: 296fe92a4ca5c315a25da6583cbacb0a12e29e1f7f8ca68483027486b1db43b4
Opcode Fuzzy Hash: d5dbf977c1095fb6e33ab7e8cc789ff43f97e641de7fea21e418f54d9f4e50fb
Instruction Fuzzy Hash: 01E15B31605240EFCB15DF29C899E2ABBE8FF89714B04896DF54ADB2A1DB34E901CB51

Function 007C2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007C2B5F
GetAsyncKeyState.USER32(000000A0), ref: 007C2BE0
GetKeyState.USER32(000000A0), ref: 007C2BFB
GetAsyncKeyState.USER32(000000A1), ref: 007C2C15
GetKeyState.USER32(000000A1), ref: 007C2C2A
GetAsyncKeyState.USER32(00000011), ref: 007C2C42
GetKeyState.USER32(00000011), ref: 007C2C54
GetAsyncKeyState.USER32(00000012), ref: 007C2C6C
GetKeyState.USER32(00000012), ref: 007C2C7E
GetAsyncKeyState.USER32(0000005B), ref: 007C2C96
GetKeyState.USER32(0000005B), ref: 007C2CA8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0a2ccc00f742258f6ccec9448362870d2855c9ffd9310d2e9e5a39721371bfeb
Instruction ID: 8e6e50b207b85be0507d3d8a6d91c75dd92a4985a887ef5925b470647ceb0a96
Opcode Fuzzy Hash: 0a2ccc00f742258f6ccec9448362870d2855c9ffd9310d2e9e5a39721371bfeb
Instruction Fuzzy Hash: CA41A3746047C96DFF759BA48804BA9BFA06B11344F04805DD9C6562C3EBAC9DC9C7B2

Function 007D6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 007D6D2E
EmptyClipboard.USER32 ref: 007D6D34
GlobalAlloc.KERNEL32(00000002,?), ref: 007D6D49
CloseClipboard.USER32 ref: 007D6DE8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 64ac68e898b2471aa125e60dcb9e46ed2a60cb59ebc17bb697bfd8007a94e7e2
Instruction ID: 2dad894843f9717f028a6ac1023988a860f27c9e40bda84b06d34dd4f149997f
Opcode Fuzzy Hash: 64ac68e898b2471aa125e60dcb9e46ed2a60cb59ebc17bb697bfd8007a94e7e2
Instruction Fuzzy Hash: 6B219F35300210EFDB11AFA4EC49B2D77A9FF54710F04801AF95ADB261DB79EC018B90

Function 007DC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 007B9ABF: CLSIDFromProgID.OLE32 ref: 007B9ADC
Part of subcall function 007B9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 007B9AF7
Part of subcall function 007B9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 007B9B05
Part of subcall function 007B9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 007B9B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 007DC235
_memset.LIBCMT ref: 007DC242
_memset.LIBCMT ref: 007DC360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 007DC38C
CoTaskMemFree.OLE32(?), ref: 007DC397

Strings

NULL Pointer assignment, xrefs: 007DC3E5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 3daa5467a97ca23ff5ad37cb98edeb529eb67a9bdbe1b5e2d0060b79b41d8b8b
Instruction ID: 6909e2a00638a792f45f04279b4a33937228a28b8020c90a7d1dada2ceb9f296
Opcode Fuzzy Hash: 3daa5467a97ca23ff5ad37cb98edeb529eb67a9bdbe1b5e2d0060b79b41d8b8b
Instruction Fuzzy Hash: A0913971D00219EBDB11DFA4DC85EDEBBB8EF08310F20812AF515A7281DB749A45CFA0

Function 007C79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007BB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007BB180
Part of subcall function 007BB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007BB1AD
Part of subcall function 007BB134: GetLastError.KERNEL32 ref: 007BB1BA

ExitWindowsEx.USER32(?,00000000), ref: 007C7A0F

Strings

SeShutdownPrivilege, xrefs: 007C79DD
@, xrefs: 007C7A02
, xrefs: 007C79FD

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: b02e2727dae7db5be15f2d4246df86922fa0406de38b3f63bedbb527f33c37d8
Instruction ID: bb3dbd91ae9434fbc827f3d4ee873e64d48083555fc39916e6f3c63441003ec4
Opcode Fuzzy Hash: b02e2727dae7db5be15f2d4246df86922fa0406de38b3f63bedbb527f33c37d8
Instruction Fuzzy Hash: EF018471658311AAF72C667C9C5BFBF7358AB04740F14982CBD53A20D2DDADAE00C9A0

Function 007D8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007D8CA8
WSAGetLastError.WSOCK32(00000000), ref: 007D8CB7
bind.WSOCK32(00000000,?,00000010), ref: 007D8CD3
listen.WSOCK32(00000000,00000005), ref: 007D8CE2
WSAGetLastError.WSOCK32(00000000), ref: 007D8CFC
closesocket.WSOCK32(00000000,00000000), ref: 007D8D10

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 6a13d06bd7dd72ab68e63d3537024ef76f86ef98cbfc14249c28724e6df23d43
Instruction ID: 72b7b0e22afc129320476537a8b14fcffce7caf60a4f0542dc1060d8d7f934a0
Opcode Fuzzy Hash: 6a13d06bd7dd72ab68e63d3537024ef76f86ef98cbfc14249c28724e6df23d43
Instruction Fuzzy Hash: C7219131600200EFCB50EF64DD49B6E77B9FF49710F148159E956A73D2CB78AD418B61

Function 007C6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 007C6554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 007C6564
Process32NextW.KERNEL32(00000000,0000022C), ref: 007C6583
__wsplitpath.LIBCMT ref: 007C65A7
_wcscat.LIBCMT ref: 007C65BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 007C65F9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: cf42f5981aab74efcfceec75e1ba28b51aa7d3059e49c34c62bce9f6762c2b6f
Instruction ID: 6a8f3fe327ecbb941268a6ede4129f8860bdd8e32e029c355b795d239e3d5b5f
Opcode Fuzzy Hash: cf42f5981aab74efcfceec75e1ba28b51aa7d3059e49c34c62bce9f6762c2b6f
Instruction Fuzzy Hash: AD216571900218ABDB10ABA4DDC9FDDB7BCAB49300F5004ADE505E7141EB799F95CB61

Function 007D923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 007DA84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 007D9296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 007D92B9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 5df01e78307ac14b355f431b99735087c88ef9558df326348bd1b187507fdb6e
Instruction ID: f408028db2ce32c2dc5d3369182e79d183fbffd2a3de6e3ecd8845055e65d6c2
Opcode Fuzzy Hash: 5df01e78307ac14b355f431b99735087c88ef9558df326348bd1b187507fdb6e
Instruction Fuzzy Hash: 5E41A071600204EFDB11BB68CC8AE7E77EDEF44728F14444DFA56AB392DA789D018B91

Function 007CEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007CEB8A
_wcscmp.LIBCMT ref: 007CEBBA
_wcscmp.LIBCMT ref: 007CEBCF
FindNextFileW.KERNEL32(00000000,?), ref: 007CEBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 007CEC0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: e5b5865c2dbf75c74e36cf21c8b380cae797a123758487521b957eeffa35cd44
Instruction ID: da8f29f43ead5a0fc3bbfb8a9887f638b8342c3b26b0b3261a1d247bfb00d6e5
Opcode Fuzzy Hash: e5b5865c2dbf75c74e36cf21c8b380cae797a123758487521b957eeffa35cd44
Instruction Fuzzy Hash: 9241AA35600302DFCB18DF28C491EAAB7E4FF49320F10455DE95A8B3A2DB39A941CBA1

Function 007E8111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 007E8160
IsWindowEnabled.USER32 ref: 007E816E
GetForegroundWindow.USER32(?,?,00000001), ref: 007E817B
IsIconic.USER32 ref: 007E8189
IsZoomed.USER32 ref: 007E8197

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 77baae40b86cac899f602ce43d4cd6d75a3869f23e3dd896fd07b7e742088d97
Instruction ID: 4ab28e0cc428f1ce611d6c0839baaf8d5741683b8aeeae21c8469001c86dba2c
Opcode Fuzzy Hash: 77baae40b86cac899f602ce43d4cd6d75a3869f23e3dd896fd07b7e742088d97
Instruction Fuzzy Hash: F9119032302254AFE7616F66DC48E6E7799EF59760B05042DF849D7241CF38D90386A6

Function 00789B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00789C32
VUUU, xrefs: 00789ED4
VUUU, xrefs: 0080BE14
VUUU, xrefs: 00789E95
VUUU, xrefs: 00789EA7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 6190203ea46dfc82b5ebac3b096693aef0853acdd729a1f419b41e23340707dc
Instruction ID: 8851eb6d80703432b066ebd07e82026ca1337eac2212b9e12f54fdb39624c808
Opcode Fuzzy Hash: 6190203ea46dfc82b5ebac3b096693aef0853acdd729a1f419b41e23340707dc
Instruction Fuzzy Hash: C9928D71E4021ACBEF64DF58C8407BDB7B1FB54314F1482AAE916EB280E7799D81CB91

Function 0079E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0079E014,76230AE0,0079DEF1,0081DC38,?,?), ref: 0079E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0079E03E

Strings

GetNativeSystemInfo, xrefs: 0079E038
kernel32.dll, xrefs: 0079E027

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 7d90d4ed9c4d4ea1de59efd29ac19b4de56edead077c2160bd157cc548b005ce
Instruction ID: 4fc652ad8c8c5122bbf4cdf5703ef2e85698e46743e35bd831bb955a7ac61505
Opcode Fuzzy Hash: 7d90d4ed9c4d4ea1de59efd29ac19b4de56edead077c2160bd157cc548b005ce
Instruction Fuzzy Hash: 24D0C7715007129FDB719FA5FC09652B6D5FF44711F288419E495D2250FBBCD8808790

Function 007C13CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007C13DC

Strings

|, xrefs: 007C140C
(, xrefs: 007C1422

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: fd16bf8dd5dcef935851f971ee9167cb477f424764f5b6b9b2fd603445831849
Instruction ID: 0c1828cc317793906cfd7eaf18d8abffcdd8717a4e36c9ce6353a987927e644b
Opcode Fuzzy Hash: fd16bf8dd5dcef935851f971ee9167cb477f424764f5b6b9b2fd603445831849
Instruction Fuzzy Hash: 51321275A006059FCB28CF69D480E6AB7F0FF49320B51C56EE59ADB3A2E774E941CB40

Function 0079B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 0079B22F

Part of subcall function 0079B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0079B5A5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: a5e8ff9c74d390a90199f82822110f73a3a61ac0a487f0cb194593ec1aa31375
Instruction ID: d17e6b88f19b92cf380d106e9f9211f460d08bdd7752c6fd7f4b407d2595513a
Opcode Fuzzy Hash: a5e8ff9c74d390a90199f82822110f73a3a61ac0a487f0cb194593ec1aa31375
Instruction Fuzzy Hash: 75A16A7011410DFADF28AF6A7E8DE7F295EFB56744B10411EFA02D66A1DB2C9C00D272

Function 007D4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007D43BF,00000000), ref: 007D4FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 007D4FD2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 10ecd9e7203937a03195bb041c3d8cd61315560908bf98a937dbc597bd4aae5a
Instruction ID: 600d64e0500d0aa73996988cbcce5062658d0139c36b957b6fa730c9742e6536
Opcode Fuzzy Hash: 10ecd9e7203937a03195bb041c3d8cd61315560908bf98a937dbc597bd4aae5a
Instruction Fuzzy Hash: D841E471604309FFEB20DF94DC85EBFB7BCEB40764F14402BF605A6291EA799E4196A0

Function 007CE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CE20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 007CE267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 007CE2B4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: a7368dc7fe1ea7a426822ac5ee04d3b012154720c1e12d3f9ce8c043ae4bc609
Instruction ID: c47d4d78adb21e92d24eb36e2418d705e51a7a6147640afe6e6422c1a0e46642
Opcode Fuzzy Hash: a7368dc7fe1ea7a426822ac5ee04d3b012154720c1e12d3f9ce8c043ae4bc609
Instruction Fuzzy Hash: A9213D75A00618EFCB00EFA5D885EADFBB8FF49314F0484A9E905AB251DB35D916CB50

Function 007BB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0079F4EA: std::exception::exception.LIBCMT ref: 0079F51E
Part of subcall function 0079F4EA: __CxxThrowException@8.LIBCMT ref: 0079F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007BB180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007BB1AD
GetLastError.KERNEL32 ref: 007BB1BA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 1ab071366a3832f2e32c600923962244367fa70ce6027b156b4aa3eef8076021
Instruction ID: 8638aa351cff4157add8521221f8f07e92c42e7ffae0f9b51289ace3eba0b6d9
Opcode Fuzzy Hash: 1ab071366a3832f2e32c600923962244367fa70ce6027b156b4aa3eef8076021
Instruction Fuzzy Hash: EB11BFB2400708AFE7189F68EC85E6BB7ADFB44310B20852EF45693251EBB4FC418B60

Function 007C6606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007C6623
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 007C6664
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007C666F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 84794d562f67fd1108b299f9ffcec7cb84cbb2a92b220c06d93ff8804ba68768
Instruction ID: 7db9b98aa8a38fc84b75d7e28843324bfb72cf29fba2e416c5da1dfcac586240
Opcode Fuzzy Hash: 84794d562f67fd1108b299f9ffcec7cb84cbb2a92b220c06d93ff8804ba68768
Instruction Fuzzy Hash: D7111E71E01228BFDB108FA5DC45FAEBBBCEB49B10F104166F900F7290D7B45A058BA5

Function 007C71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 007C7223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007C723A
FreeSid.ADVAPI32(?), ref: 007C724A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7db227b972680c736ac2771f0152e8de89e93d6b8eb4770d09930561c2aeb0d5
Instruction ID: 88b6610bd72959564f76224ad7a2f09ceedbddc5e3327311f5116c7804b527fd
Opcode Fuzzy Hash: 7db227b972680c736ac2771f0152e8de89e93d6b8eb4770d09930561c2aeb0d5
Instruction Fuzzy Hash: 8CF01D76A04309BFDF04DFE4DD89EEEBBB8FF08301F504469A606E2191E6749A448B10

Function 007CF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007CF599
FindClose.KERNEL32(00000000), ref: 007CF5C9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f316a80fda89a199163cf7e6f43863510e0f6deb2ae3d8fdd2ba6ae89fa14112
Instruction ID: 40d516a761ae1c6641f6d1ab1e7b21c06912081f30f1f61514d2bc280778087f
Opcode Fuzzy Hash: f316a80fda89a199163cf7e6f43863510e0f6deb2ae3d8fdd2ba6ae89fa14112
Instruction Fuzzy Hash: 891165726006009FD710EF68D849E2EF7E5FF85324F04851DF965D7291DB34E9018B91

Function 007CCE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,007DBE6A,?,?,00000000,?), ref: 007CCEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,007DBE6A,?,?,00000000,?), ref: 007CCEB9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 165d6612fbc53a0f30a0ed4af1663676de1a02023fdabd4ee55508d2c98781c5
Instruction ID: 1820aeb191ca595915b2e80c98050b717c3178a3f67069520d8082eeeee3ed90
Opcode Fuzzy Hash: 165d6612fbc53a0f30a0ed4af1663676de1a02023fdabd4ee55508d2c98781c5
Instruction Fuzzy Hash: 1AF08235100329EBDB11ABA4DC49FEA776DBF09351F004269F919D6181D6349A40CBA4

Function 007C411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 007C4153
keybd_event.USER32(?,7694C0D0,?,00000000), ref: 007C4166

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: a936f19ead344c0355b3eb7f99f190b3b2d46e0829ae9f575f0f6583c37fb25d
Instruction ID: 6b43bd9e18eb58d894fc20043dcae9cfa015b9eb09083931d961ef1be5ceec65
Opcode Fuzzy Hash: a936f19ead344c0355b3eb7f99f190b3b2d46e0829ae9f575f0f6583c37fb25d
Instruction Fuzzy Hash: 34F0177090434DAFDB159FA4CC05BBE7FB4FF04305F04840AF966A6192D77986169FA4

Function 007BAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007BACC0), ref: 007BAB99
CloseHandle.KERNEL32(?,?,007BACC0), ref: 007BABAB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 111f5558adc510e0fa8263898881f3ea31b9796cda5f368ee2c37880e09ada3b
Instruction ID: 64340d0f0d7df6b661cdba7a40acedb624ffc33b7a77016a7f95418affc787fa
Opcode Fuzzy Hash: 111f5558adc510e0fa8263898881f3ea31b9796cda5f368ee2c37880e09ada3b
Instruction Fuzzy Hash: 92E0BF72000610EFEB652F55FC09D777BA9EB04320711C529F45981470DB665C909B50

Function 007A81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,007A6DB3,-0000031A,?,?,00000001), ref: 007A81B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007A81BA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8745b90797e1a02769a51ae01f64caf88dcb30c460330cad02a9cbc10a536ffc
Instruction ID: 6ede9343c2f3a367e4c42b528256949a8037049457549858b039cf659c26555c
Opcode Fuzzy Hash: 8745b90797e1a02769a51ae01f64caf88dcb30c460330cad02a9cbc10a536ffc
Instruction Fuzzy Hash: C2B09231144708ABDB802BE1EC09B587F68FB08656F018010F60D48261AB7254108A92

Function 007877B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00787921

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1deda2f9c454d9ee13ae9bc1c7e762e89ab45a8048c99d32c7a4418ac4ba98b4
Instruction ID: 41ee15420fd0ff5458a0cd1dd202f4efdfc9b26a3fcd2e6f71979ea0dfc7b68a
Opcode Fuzzy Hash: 1deda2f9c454d9ee13ae9bc1c7e762e89ab45a8048c99d32c7a4418ac4ba98b4
Instruction Fuzzy Hash: 66A24C70904219CFCB28DF58C8847ADBBB1FF48314F2581A9D85AAB391D7789E81DF51

Function 007AD1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd0048895a8b88c199c9f67fef29c2f8723e22bf7bff1e5583e0040235799a7
Instruction ID: 35d562b2184778771c9ed978568be95e764f6ee521c61b7365d86007f90dea9c
Opcode Fuzzy Hash: 5cd0048895a8b88c199c9f67fef29c2f8723e22bf7bff1e5583e0040235799a7
Instruction Fuzzy Hash: D932E222D29F414DD7239634D822336A29CEFB73D4F15D737E81AB5EA6EB29D8834100

Function 007896C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 3c1e7e6910704f436f1401b6b1696cbdfb75b8091726e6e76b4b6c097aff45a9
Instruction ID: ac7f3e9d8892abdf0b3e73ab362612302bef1bd87fe77981314d711fc6f76a7c
Opcode Fuzzy Hash: 3c1e7e6910704f436f1401b6b1696cbdfb75b8091726e6e76b4b6c097aff45a9
Instruction Fuzzy Hash: D222B871648304DFDB25EF24C884B6FB7E4AF84310F14491DFA9A9B291DB79E844CB82

Function 007B038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e83d2cb1e00e21b1ccb1bc3be347c067e22820cc4694a9429fb5bb8ad0f46c4
Instruction ID: 888e75d95bf0e84bb1b81260942c41ec53f943a40b543251560b5da50ffc65a8
Opcode Fuzzy Hash: 1e83d2cb1e00e21b1ccb1bc3be347c067e22820cc4694a9429fb5bb8ad0f46c4
Instruction Fuzzy Hash: 89B1CF20D2AF518DD62396798831336B69CBFFB2D5F91D71BFC2A74D62EB2185834180

Function 007CB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 007CB6DF

Part of subcall function 007A344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,007CBDC3,00000000,?,?,?,?,007CBF70,00000000,?), ref: 007A3453
Part of subcall function 007A344A: __aulldiv.LIBCMT ref: 007A3473

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 7fcb885619866c64cea409b8574501e7540aabcd57fc610405e40bcf50213f52
Instruction ID: add3f0e4dd77de4cac049c57e223f8b98ad4783bdf53759bf7e48c798f3aba06
Opcode Fuzzy Hash: 7fcb885619866c64cea409b8574501e7540aabcd57fc610405e40bcf50213f52
Instruction Fuzzy Hash: C421AF76634510CBC72ACF38D881B92B7E1EB95310B248E6DE4E5CB2C0CB78BA05CB54

Function 007D6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 007D6ACA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: e00d5ebe34c4285a2da6cfef868bede4d4e4c1836c065e208a3044415b24ed52
Instruction ID: 1c8786183b78d45b00cd94ea3980f8f6d09e9d479beca66670c2b1a561950a4c
Opcode Fuzzy Hash: e00d5ebe34c4285a2da6cfef868bede4d4e4c1836c065e208a3044415b24ed52
Instruction Fuzzy Hash: 2FE01A3A200204AFC740EBA9D80899AB7ECAFB8751F05C426E945D7391DAB4E8048BA0

Function 007C74E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 007C750A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: c2cf3321f9a602b699a14c3224ea82166e22809163844cd20f0ed2b497247fa7
Instruction ID: b344723ac4e4af2e07778a019cc0f8345fecdf22a28b0739f7527a9096666f56
Opcode Fuzzy Hash: c2cf3321f9a602b699a14c3224ea82166e22809163844cd20f0ed2b497247fa7
Instruction Fuzzy Hash: B2D06CA416C64569E82D0724AC1BFB61B08B300782FD4858DB612A90C0BCA8AE15E831

Function 007BB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,007BAD3E), ref: 007BB124

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 656b4f7d27d45e2af0ffbcd8610d4cc3b80b2d0074567da1eb2a6616c4f23f82
Instruction ID: 9b4b545a77c9386ef58917aa44c17f59489bdf2a2d1446c621339d198ec90e90
Opcode Fuzzy Hash: 656b4f7d27d45e2af0ffbcd8610d4cc3b80b2d0074567da1eb2a6616c4f23f82
Instruction Fuzzy Hash: 64D09E321A4A4EAEDF429FA4DC06EAE3F6AEB04701F448511FA15D50A1C675D531AB50

Function 007FB340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 007FB352

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 2c7bfed8b3d836d456125e540d0c5719bd519a832993c249f0a2c18f66a8f899
Instruction ID: 6a3928e0431c23bb6272639de2026268f1fbfbafabe4a9b917afda9970759e45
Opcode Fuzzy Hash: 2c7bfed8b3d836d456125e540d0c5719bd519a832993c249f0a2c18f66a8f899
Instruction Fuzzy Hash: 15C04CF140054DDFD751CBC0C9449EEB7BCAB04301F1050919249F1110D7749B459B72

Function 007A8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 007A818F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4e27a2de4d9ec15b988bb3bc18e8c30db21bde18863842402245d6cc801159cf
Instruction ID: 35f1b704a8ac5b390981777d9ea164b9124e7881280dcc738e30ba293d13f150
Opcode Fuzzy Hash: 4e27a2de4d9ec15b988bb3bc18e8c30db21bde18863842402245d6cc801159cf
Instruction Fuzzy Hash: 8EA0113000030CABCF002B82EC088883F2CFA002A0B008020F80C00220AB22A8208A82

Function 007893F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569681ec373b03960f0dfba05f82eec5e90ea69e654710be708bca51f17347b6
Instruction ID: 6bafbcbc17222e2152e6033ce3a57b2405d4b51630beb08b302b461422f995c6
Opcode Fuzzy Hash: 569681ec373b03960f0dfba05f82eec5e90ea69e654710be708bca51f17347b6
Instruction Fuzzy Hash: B1126C70A00609EFDF04EFA5D985ABEB7F5FF48300F148569E506E7291EB39A921CB50

Function 0078E3E3 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e53a13eb7e25b40eca13c0c0429a7d332c79c0d6051f1cce202c034edc1436
Instruction ID: 3a9903a822c0019cf1c54bc8b1702f217da9fb876811bda2af648bbfafa38e84
Opcode Fuzzy Hash: 44e53a13eb7e25b40eca13c0c0429a7d332c79c0d6051f1cce202c034edc1436
Instruction Fuzzy Hash: A412AF70A4420ACFDB24EF58D484ABEB7B1FF18314F14C069E95A9B351E739AD81CB91

Function 0078AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: e99633fc6644f703d4ed5e00fa73be22f278a95d45a3ffcf3898661a2b5c172f
Instruction ID: 7804f55482cde31d6c2ea55f8312735b4adbf863f749c40d2ee184ce275807ba
Opcode Fuzzy Hash: e99633fc6644f703d4ed5e00fa73be22f278a95d45a3ffcf3898661a2b5c172f
Instruction Fuzzy Hash: 610291B0A00109DBDF04EF68D995AAEBBB5FF44300F10C469E906DB356EB39D915CB91

Function 007A02A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: f2dbaafd83355548799453ae633bdbfc208f1896ae9ebdb10d3a2321f9c4e760
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: B7C1B2322055A30ADF2D463A847443EFAA15AE3BB531A0B6DD8B3CB4D5EF28C534D660

Function 007A06D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: d19d2c6d727b3fe967fd1a7c7fa2abe95b4c2835e465e1c3dc30c701e6f0545e
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 28C1A0332055930AEF6D463AC43453EBAA15AE3BB131A0B6DD4B3CB4D5EF28D524D660

Function 0079FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: ccc0d1618ed92ba42f81920d24cd8967a93ff747d542d9c07380ea65991c1878
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 88C1C43220949309DF2D463AE47443EFBA15EA2BB531A077DD8B3CB5D5EF28C564D620

Function 007DA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 007DA2FE
DeleteObject.GDI32(00000000), ref: 007DA310
DestroyWindow.USER32 ref: 007DA31E
GetDesktopWindow.USER32 ref: 007DA338
GetWindowRect.USER32(00000000), ref: 007DA33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 007DA480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 007DA490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA4D8
GetClientRect.USER32(00000000,?), ref: 007DA4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 007DA51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA55E
GlobalLock.KERNEL32(00000000), ref: 007DA567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA576
GlobalUnlock.KERNEL32(00000000), ref: 007DA57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA586
GlobalFree.KERNEL32(00000000), ref: 007DA591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0080D9BC,00000000), ref: 007DA5B9
GlobalFree.KERNEL32(00000000), ref: 007DA5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 007DA5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 007DA60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007DA81D

Strings

static, xrefs: 007DA518, 007DA66F
DISPLAY, xrefs: 007DA680
, xrefs: 007DA7A3
AutoIt v3, xrefs: 007DA4D0

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 02b7b6ee896b2b39234cf1a40c3646a644d81699067be42d16da075b76938cbd
Instruction ID: eb6759161baf057cbac4d2b52e2bd55de2c1546d2cdc5a7dbe7faa3617d2b63d
Opcode Fuzzy Hash: 02b7b6ee896b2b39234cf1a40c3646a644d81699067be42d16da075b76938cbd
Instruction Fuzzy Hash: BF027C75900204EFDB14DFA8CD89EAE7BB9FB49310F048159F915AB2A1DB78ED41CB60

Function 007ED285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 007ED2DB
GetSysColorBrush.USER32(0000000F), ref: 007ED30C
GetSysColor.USER32(0000000F), ref: 007ED318
SetBkColor.GDI32(?,000000FF), ref: 007ED332
SelectObject.GDI32(?,00000000), ref: 007ED341
InflateRect.USER32(?,000000FF,000000FF), ref: 007ED36C
GetSysColor.USER32(00000010), ref: 007ED374
CreateSolidBrush.GDI32(00000000), ref: 007ED37B
FrameRect.USER32(?,?,00000000), ref: 007ED38A
DeleteObject.GDI32(00000000), ref: 007ED391
InflateRect.USER32(?,000000FE,000000FE), ref: 007ED3DC
FillRect.USER32(?,?,00000000), ref: 007ED40E
GetWindowLongW.USER32(?,000000F0), ref: 007ED439

Part of subcall function 007ED575: GetSysColor.USER32(00000012), ref: 007ED5AE
Part of subcall function 007ED575: SetTextColor.GDI32(?,?), ref: 007ED5B2
Part of subcall function 007ED575: GetSysColorBrush.USER32(0000000F), ref: 007ED5C8
Part of subcall function 007ED575: GetSysColor.USER32(0000000F), ref: 007ED5D3
Part of subcall function 007ED575: GetSysColor.USER32(00000011), ref: 007ED5F0
Part of subcall function 007ED575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 007ED5FE
Part of subcall function 007ED575: SelectObject.GDI32(?,00000000), ref: 007ED60F
Part of subcall function 007ED575: SetBkColor.GDI32(?,00000000), ref: 007ED618
Part of subcall function 007ED575: SelectObject.GDI32(?,?), ref: 007ED625
Part of subcall function 007ED575: InflateRect.USER32(?,000000FF,000000FF), ref: 007ED644
Part of subcall function 007ED575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007ED65B
Part of subcall function 007ED575: GetWindowLongW.USER32(00000000,000000F0), ref: 007ED670
Part of subcall function 007ED575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 007ED698

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 2379b82b2f522385af54e8f2c52c960fc0b308e39aa33885e5623062c0ace5f2
Instruction ID: a46c5e8976675729edc72160acc225efa6f1466500e338182f3e81cf32d3b1b4
Opcode Fuzzy Hash: 2379b82b2f522385af54e8f2c52c960fc0b308e39aa33885e5623062c0ace5f2
Instruction Fuzzy Hash: 9091BF72009341FFCB509FA4DC08E6BBBA9FF89325F101A19F962961E0DB75D944CB92

Function 007CDBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CDBD6
GetDriveTypeW.KERNEL32(?,0081DC54,?,\\.\,0081DC00), ref: 007CDCC3
SetErrorMode.KERNEL32(00000000,0081DC54,?,\\.\,0081DC00), ref: 007CDE29

Strings

RAID, xrefs: 007CDDC4
PhysicalDrive, xrefs: 007CDC67
Fixed, xrefs: 007CDD0B
Network, xrefs: 007CDD01
iSCSI, xrefs: 007CDDCB
SATA, xrefs: 007CDDD9
SCSI, xrefs: 007CDD93
Unknown, xrefs: 007CDCE3, 007CDD8C
SSD, xrefs: 007CDD50
CDROM, xrefs: 007CDCF7
SAS, xrefs: 007CDDD2
SSA, xrefs: 007CDDAF
Fibre, xrefs: 007CDDB6
1394, xrefs: 007CDDA8
USB, xrefs: 007CDDBD
MMC, xrefs: 007CDDE7
\\.\, xrefs: 007CDC2B
ATA, xrefs: 007CDDA1
RAMDisk, xrefs: 007CDCED
ATAPI, xrefs: 007CDD9A
Removable, xrefs: 007CDD15
Virtual, xrefs: 007CDDEE
FileBackedVirtual, xrefs: 007CDDF5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f5300def5de569c0901aa0a3d2694d5bebe9c29bc481cfb80d711b17e9cf7ced
Instruction ID: a6cefac4ecb80ab4a5cf02e99625a4bc2d42915e051d44354d1a99f4f8e76414
Opcode Fuzzy Hash: f5300def5de569c0901aa0a3d2694d5bebe9c29bc481cfb80d711b17e9cf7ced
Instruction Fuzzy Hash: 9C519F30B48302EBC620EB14C886E69F7A0FB94715F20586EF467DB295DA6CDD45D782

Function 0078CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0078CC68
__wcsnicmp.LIBCMT ref: 0078CC80
__wcsnicmp.LIBCMT ref: 0078CC98
__wcsnicmp.LIBCMT ref: 0078CCB0
__wcsnicmp.LIBCMT ref: 0078CCC8
__wcsnicmp.LIBCMT ref: 0078CCE0
__wcsnicmp.LIBCMT ref: 0078CCF8
__wcsnicmp.LIBCMT ref: 0078CD0C
__wcsnicmp.LIBCMT ref: 0078CD4D
__wcsnicmp.LIBCMT ref: 0078CD61
__wcsnicmp.LIBCMT ref: 0078CD75
__wcsnicmp.LIBCMT ref: 0078CD89

Strings

#comments-start, xrefs: 0078CCF2, 0078CD47
#comments-end, xrefs: 0078CD6F
#notrayicon, xrefs: 0078CC7A
#requireadmin, xrefs: 0078CC92
#cs, xrefs: 0078CD06, 0078CD5B
#include-once, xrefs: 0078CCC2
#ce, xrefs: 0078CD83
#pragma compile, xrefs: 0078CC62
Unterminated group of comments, xrefs: 007F2FB4
#include, xrefs: 0078CCDA
Cannot parse #include, xrefs: 007F2FA1
Bad directive syntax error, xrefs: 007F2ECB
#OnAutoItStartRegister, xrefs: 0078CCAA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: edd26f957e76c490ce91a2e7f1369e4be9fa8587ed4fa4e2823302320a6bdc32
Instruction ID: 95716e4cf926f8a699ad2c26a17c80c6c4a5ce46ddb20b819114290fde8100ec
Opcode Fuzzy Hash: edd26f957e76c490ce91a2e7f1369e4be9fa8587ed4fa4e2823302320a6bdc32
Instruction Fuzzy Hash: FE81F971680209FBDB12BA64DD56FBB3769EF55310F044029F905AA282EB7CD942C3B1

Function 007EC6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 007EC788
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 007EC83E
SendMessageW.USER32(?,00001102,00000002,?), ref: 007EC859
SendMessageW.USER32(?,000000F1,?,00000000), ref: 007ECB15

Strings

0, xrefs: 007EC89C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: ff831e8970d60f31a1cf02dd766212e4494274802998ed0817a3a3b4924718a9
Instruction ID: e897e0f1722fe5d63f2c2fe33e8aa7ed2b6bcf66337731effeee50638cc8465c
Opcode Fuzzy Hash: ff831e8970d60f31a1cf02dd766212e4494274802998ed0817a3a3b4924718a9
Instruction Fuzzy Hash: 85F116B9206380AFD7228F25CC49BAABBE4FF4D314F04452DF599D62A1C778D842CB91

Function 007E638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0081DC00), ref: 007E6449

Strings

GETCURRENTSELECTION, xrefs: 007E6603
ISCHECKED, xrefs: 007E6659
UNCHECK, xrefs: 007E66A1
GETCURRENTCOL, xrefs: 007E6724
GETLINE, xrefs: 007E678B
SELECTSTRING, xrefs: 007E6626
GETLINECOUNT, xrefs: 007E66E4
TABRIGHT, xrefs: 007E64BD
DELSTRING, xrefs: 007E6569
FINDSTRING, xrefs: 007E6596
SENDCOMMANDID, xrefs: 007E67CA
SHOWDROPDOWN, xrefs: 007E6500
TABLEFT, xrefs: 007E64A7
ISVISIBLE, xrefs: 007E6455
ISENABLED, xrefs: 007E648C
ADDSTRING, xrefs: 007E6536
GETSELECTED, xrefs: 007E66C1
EDITPASTE, xrefs: 007E675B
CURRENTTAB, xrefs: 007E64DD
HIDEDROPDOWN, xrefs: 007E6520
GETCURRENTLINE, xrefs: 007E6704
SETCURRENTSELECTION, xrefs: 007E65D6
CHECK, xrefs: 007E668B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: ee6bc5e2d8e4acf7c4443ec88ac4ac35036004edf5aeb2e9ffd8ec3fd3bb3004
Instruction ID: 13e5093e7dd8d88b99605afce0f316b03d6c6cceb9da1fbae585e69ea43ece1d
Opcode Fuzzy Hash: ee6bc5e2d8e4acf7c4443ec88ac4ac35036004edf5aeb2e9ffd8ec3fd3bb3004
Instruction Fuzzy Hash: E6C18430205285CBCB04FF11C555AAE77A5FFA9384F044859F8869B3D2DB38ED4ACB92

Function 007ED575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 007ED5AE
SetTextColor.GDI32(?,?), ref: 007ED5B2
GetSysColorBrush.USER32(0000000F), ref: 007ED5C8
GetSysColor.USER32(0000000F), ref: 007ED5D3
CreateSolidBrush.GDI32(?), ref: 007ED5D8
GetSysColor.USER32(00000011), ref: 007ED5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 007ED5FE
SelectObject.GDI32(?,00000000), ref: 007ED60F
SetBkColor.GDI32(?,00000000), ref: 007ED618
SelectObject.GDI32(?,?), ref: 007ED625
InflateRect.USER32(?,000000FF,000000FF), ref: 007ED644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007ED65B
GetWindowLongW.USER32(00000000,000000F0), ref: 007ED670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 007ED698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 007ED6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 007ED6DD
DrawFocusRect.USER32(?,?), ref: 007ED6E8
GetSysColor.USER32(00000011), ref: 007ED6F6
SetTextColor.GDI32(?,00000000), ref: 007ED6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 007ED712
SelectObject.GDI32(?,007ED2A5), ref: 007ED729
DeleteObject.GDI32(?), ref: 007ED734
SelectObject.GDI32(?,?), ref: 007ED73A
DeleteObject.GDI32(?), ref: 007ED73F
SetTextColor.GDI32(?,?), ref: 007ED745
SetBkColor.GDI32(?,?), ref: 007ED74F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: e4fb60f8d247c87528d507d4c23b397ea25d8703ec17e176087799082dae1ee5
Instruction ID: 37a34931da0b88f0530ddafbac7f130b14129502f218decf7683c8b514b71fbe
Opcode Fuzzy Hash: e4fb60f8d247c87528d507d4c23b397ea25d8703ec17e176087799082dae1ee5
Instruction Fuzzy Hash: 87512A72901208EFDF109FA9DC49EAEBB79FB08324F204515FA15AB2A1D7759A40DF90

Function 007EB6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 007EB7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007EB7C1
CharNextW.USER32(0000014E), ref: 007EB7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 007EB831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 007EB847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007EB858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 007EB875
SetWindowTextW.USER32(?,0000014E), ref: 007EB8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 007EB8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 007EB90E
_memset.LIBCMT ref: 007EB933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 007EB97C
_memset.LIBCMT ref: 007EB9DB
SendMessageW.USER32 ref: 007EBA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 007EBA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 007EBB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 007EBB2C
GetMenuItemInfoW.USER32(?), ref: 007EBB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007EBBA3
DrawMenuBar.USER32(?), ref: 007EBBB2
SetWindowTextW.USER32(?,0000014E), ref: 007EBBDA

Strings

0, xrefs: 007EBB4F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: e19dee64f44edccccef6ab2de9779ab96637caca3b60dbbf1983acadb519349b
Instruction ID: e44895cb7f3580a4c2d075793e399e69ed0e341b7d2f876e8283e5ad83849e88
Opcode Fuzzy Hash: e19dee64f44edccccef6ab2de9779ab96637caca3b60dbbf1983acadb519349b
Instruction Fuzzy Hash: 9DE180B1901258EBDF209FA6CC84AEF7F78FF09714F108156F915AA291D7789941CF60

Function 007E764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007E778A
GetDesktopWindow.USER32 ref: 007E779F
GetWindowRect.USER32(00000000), ref: 007E77A6
GetWindowLongW.USER32(?,000000F0), ref: 007E7808
DestroyWindow.USER32(?), ref: 007E7834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007E785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007E787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007E78A1
SendMessageW.USER32(?,00000421,?,?), ref: 007E78B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007E78C9
IsWindowVisible.USER32(?), ref: 007E78E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 007E7904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 007E7918
GetWindowRect.USER32(?,?), ref: 007E7930
MonitorFromPoint.USER32(?,?,00000002), ref: 007E7956
GetMonitorInfoW.USER32 ref: 007E7970
CopyRect.USER32(?,?), ref: 007E7987
SendMessageW.USER32(?,00000412,00000000), ref: 007E79F2

Strings

(, xrefs: 007E7965
tooltips_class32, xrefs: 007E7856
0, xrefs: 007E7735

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 93d14010942adb39d947525d6f6599631dada38439581bfec526e802a5d5adb9
Instruction ID: abbb8130687c46cecb099806ca46f1d421747e07a9cafe0f100cd45072d4d59e
Opcode Fuzzy Hash: 93d14010942adb39d947525d6f6599631dada38439581bfec526e802a5d5adb9
Instruction Fuzzy Hash: 83B18C71609340AFDB48DF65C889B6ABBE4FF88310F00891DF5999B292D775EC05CB92

Function 007C6CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 007C6CFB
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 007C6D21
_wcscpy.LIBCMT ref: 007C6D4F
_wcscmp.LIBCMT ref: 007C6D5A
_wcscat.LIBCMT ref: 007C6D70
_wcsstr.LIBCMT ref: 007C6D7B
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 007C6D97
_wcscat.LIBCMT ref: 007C6DE0
_wcscat.LIBCMT ref: 007C6DE7
_wcsncpy.LIBCMT ref: 007C6E12

Strings

StringFileInfo\, xrefs: 007C6D6A
%u.%u.%u.%u, xrefs: 007C6E75
\VarFileInfo\Translation, xrefs: 007C6D8F
DefaultLangCodepage, xrefs: 007C6DFA
04090000, xrefs: 007C6DCD

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 869d93b4897aa3a01f58ce16e10d95e833818df2212188f22d5562c5f750502d
Instruction ID: 886d9611f6356034f32b2f450eb08c748e1768ae0f62f298007226e6f1a99793
Opcode Fuzzy Hash: 869d93b4897aa3a01f58ce16e10d95e833818df2212188f22d5562c5f750502d
Instruction Fuzzy Hash: 5041B772600304FBEB01AB64DC8BFBF776CEF95710F044569F901E6282EA7D9A0196A5

Function 0079A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0079A939
GetSystemMetrics.USER32(00000007), ref: 0079A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0079A96C
GetSystemMetrics.USER32(00000008), ref: 0079A974
GetSystemMetrics.USER32(00000004), ref: 0079A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0079A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0079A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0079A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0079AA0D
GetClientRect.USER32(00000000,000000FF), ref: 0079AA2B
GetStockObject.GDI32(00000011), ref: 0079AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 0079AA52

Part of subcall function 0079B63C: GetCursorPos.USER32(000000FF), ref: 0079B64F
Part of subcall function 0079B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0079B66C
Part of subcall function 0079B63C: GetAsyncKeyState.USER32(00000001), ref: 0079B691
Part of subcall function 0079B63C: GetAsyncKeyState.USER32(00000002), ref: 0079B69F

SetTimer.USER32(00000000,00000000,00000028,0079AB87), ref: 0079AA79

Strings

AutoIt v3 GUI, xrefs: 0079A9F1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3493b631e86327be85c71ad092e36af05b403778ace0ed6739c7b2ca41419a2f
Instruction ID: d09de5a2a4801f999592b256c0d91ea3d0c648d31d98d31aab3b4c0895197a1e
Opcode Fuzzy Hash: 3493b631e86327be85c71ad092e36af05b403778ace0ed6739c7b2ca41419a2f
Instruction Fuzzy Hash: 49B18B75A0120AEFDF14DFA8DC49BAE7BB5FB18314F114219FA15A7290DB78E840CB91

Function 00782EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00782F7A
IsWindow.USER32(?), ref: 007F22FD

Strings

CLASS, xrefs: 007F2128
LAST, xrefs: 007F20B6
INSTANCE, xrefs: 007F223C
ACTIVE, xrefs: 007F20CC
ALL, xrefs: 007F2264
TITLE, xrefs: 007F2292
REGEXPTITLE, xrefs: 007F20F8
REGEXPCLASS, xrefs: 007F2149
HANDLE, xrefs: 007F20E2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 62970417-1919597938
Opcode ID: 218d29c74a88b9e8a7f02421d232f16c19d5b3dbd9365f9941467c9a5b89c90a
Instruction ID: 3f8af158e6ca2cb5844cb255fd03676dcfa573a934890269a944018288fcdc40
Opcode Fuzzy Hash: 218d29c74a88b9e8a7f02421d232f16c19d5b3dbd9365f9941467c9a5b89c90a
Instruction Fuzzy Hash: 8ED1D830108746EBCB04EF50C885AAABBB0FF54344F504A19F556977A2DB38E95BCBD1

Function 007E3639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E3735
RegCreateKeyExW.ADVAPI32(?,?,00000000,0081DC00,00000000,?,00000000,?,?), ref: 007E37A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007E37EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 007E3874
RegCloseKey.ADVAPI32(?), ref: 007E3B94
RegCloseKey.ADVAPI32(00000000), ref: 007E3BA1

Strings

REG_DWORD, xrefs: 007E3A65
REG_BINARY, xrefs: 007E3B2F
REG_SZ, xrefs: 007E38B2
REG_MULTI_SZ, xrefs: 007E395C
REG_QWORD, xrefs: 007E3AE2
REG_EXPAND_SZ, xrefs: 007E3811

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 59f936d6139fdda63c3d153e5e58357d13ea8a3b71e27c3dfd4f86bd336eae00
Instruction ID: b7b18de34358e80b79cda3562e9fabbcdfd0b44afea3043ce8c1a68c55319331
Opcode Fuzzy Hash: 59f936d6139fdda63c3d153e5e58357d13ea8a3b71e27c3dfd4f86bd336eae00
Instruction Fuzzy Hash: E1025A75204601DFCB15EF15C899A2AB7E5FF89710F05845CF95A9B3A2CB38ED01CB81

Function 007E6BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007E6C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E6D16

Strings

SELECTALL, xrefs: 007E6D75
DESELECT, xrefs: 007E6DFC
GETSELECTEDCOUNT, xrefs: 007E6CF9
GETSUBITEMCOUNT, xrefs: 007E6CA1
FINDITEM, xrefs: 007E6E81
VIEWCHANGE, xrefs: 007E6ECD
SELECT, xrefs: 007E6DA8
ISSELECTED, xrefs: 007E6D21
SELECTINVERT, xrefs: 007E6DDE
GETITEMCOUNT, xrefs: 007E6C84
GETSELECTED, xrefs: 007E6E3C
GETTEXT, xrefs: 007E6CBF
SELECTCLEAR, xrefs: 007E6D8D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 656c63bcf6423e52f20c9f3ab1e5b101faca6ad82b73c0967ac9b30537ccf00b
Instruction ID: 3cf9f3993d209d9cdb1cec30cdd43df0e4da096c656bdd05f6c932c6c2449d74
Opcode Fuzzy Hash: 656c63bcf6423e52f20c9f3ab1e5b101faca6ad82b73c0967ac9b30537ccf00b
Instruction Fuzzy Hash: CEA18230204381DBCB14FF21C855A6AB7A5FF99354F14496CB9A69B3D2DB38EC09CB91

Function 007BCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007BCF91
__swprintf.LIBCMT ref: 007BD032
_wcscmp.LIBCMT ref: 007BD045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 007BD09A
_wcscmp.LIBCMT ref: 007BD0D6
GetClassNameW.USER32(?,?,00000400), ref: 007BD10D
GetDlgCtrlID.USER32(?), ref: 007BD15F
GetWindowRect.USER32(?,?), ref: 007BD195
GetParent.USER32(?), ref: 007BD1B3
ScreenToClient.USER32(00000000), ref: 007BD1BA
GetClassNameW.USER32(?,?,00000100), ref: 007BD234
_wcscmp.LIBCMT ref: 007BD248
GetWindowTextW.USER32(?,?,00000400), ref: 007BD26E
_wcscmp.LIBCMT ref: 007BD282

Strings

%s%u, xrefs: 007BD02C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: a636bdf97a2a2b7c9660d44c091a69617f9d04df5781977413c7060721a59c6c
Instruction ID: ee89a4a5fd18731ff6f7f2e653a8281d2a3d0f2b1ba1646a7e2ef0c687b25cd3
Opcode Fuzzy Hash: a636bdf97a2a2b7c9660d44c091a69617f9d04df5781977413c7060721a59c6c
Instruction Fuzzy Hash: 92A1C071604746EFD725DF64C884BEAB7A8FF44314F008619F9A9D2190EB38ED45CB91

Function 007BD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 007BD8EB
_wcscmp.LIBCMT ref: 007BD8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 007BD924
CharUpperBuffW.USER32(?,00000000), ref: 007BD941
_wcscmp.LIBCMT ref: 007BD95F
_wcsstr.LIBCMT ref: 007BD970
GetClassNameW.USER32(00000018,?,00000400), ref: 007BD9A8
_wcscmp.LIBCMT ref: 007BD9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 007BD9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 007BDA28
_wcscmp.LIBCMT ref: 007BDA38
GetClassNameW.USER32(00000010,?,00000400), ref: 007BDA60
GetWindowRect.USER32(00000004,?), ref: 007BDAC9

Strings

ThumbnailClass, xrefs: 007BD9B3, 007BDA33
@, xrefs: 007BD8C6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 57830bc56b074f579d450f292a2a3beab5483774b1972e3f399e23555fefcad1
Instruction ID: eb4dcc9d519e518070deb8a7be79d4366e322c20d16994774eff8a157e20d789
Opcode Fuzzy Hash: 57830bc56b074f579d450f292a2a3beab5483774b1972e3f399e23555fefcad1
Instruction Fuzzy Hash: 8781C5710083059BDB25DF50C885FEA7BE8FF84714F04846AFD899A096EB38ED45CBA1

Function 007BD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007BD753

Strings

[ALL, xrefs: 007BD7F9
HANDLE=, xrefs: 007BD74C
[HANDLE:, xrefs: 007BD75F
[REGEXPTITLE:, xrefs: 007BD77B
[LAST, xrefs: 007BD800
LAST, xrefs: 007BD718
CLASSNAME=, xrefs: 007BD790
ACTIVE, xrefs: 007BD72E
ALL, xrefs: 007BD7E7
[ACTIVE, xrefs: 007BD740
[CLASS:, xrefs: 007BD7A3
REGEXP=, xrefs: 007BD768

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 4f232bc8529825417b292c050eb8269c32c7ad8875ec5efe8c880327377f8b5d
Instruction ID: e777bdf6d1f2acce1e096665ed0328191f343c205459e92fd9e840dcdf1f6d79
Opcode Fuzzy Hash: 4f232bc8529825417b292c050eb8269c32c7ad8875ec5efe8c880327377f8b5d
Instruction Fuzzy Hash: 3A316D31A84205EADB25FB60DE5BFEDB7A4AF60721F200129F451B11D1FF6DAE048791

Function 007BEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 007BEAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 007BEAC2
SetWindowTextW.USER32(?,?), ref: 007BEAD9
GetDlgItem.USER32(?,000003EA), ref: 007BEAEE
SetWindowTextW.USER32(00000000,?), ref: 007BEAF4
GetDlgItem.USER32(?,000003E9), ref: 007BEB04
SetWindowTextW.USER32(00000000,?), ref: 007BEB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 007BEB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 007BEB45
GetWindowRect.USER32(?,?), ref: 007BEB4E
SetWindowTextW.USER32(?,?), ref: 007BEBB9
GetDesktopWindow.USER32 ref: 007BEBBF
GetWindowRect.USER32(00000000), ref: 007BEBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 007BEC12
GetClientRect.USER32(?,?), ref: 007BEC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 007BEC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 007BEC6F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: f5e57355e4acea4af5bf61fb1d17416fc47728f7a5d66b00accb9ec323abf702
Instruction ID: 07aecdf53bedddcf2550fd6d4badc368beda48ff578c5a16624df84f1176ee9a
Opcode Fuzzy Hash: f5e57355e4acea4af5bf61fb1d17416fc47728f7a5d66b00accb9ec323abf702
Instruction Fuzzy Hash: 4A512E71900709EFDB219FA8CD89FAFBBF5FF04704F004918E556A66A0D775A944CB50

Function 007D79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 007D79C6
LoadCursorW.USER32(00000000,00007F00), ref: 007D79D1
LoadCursorW.USER32(00000000,00007F03), ref: 007D79DC
LoadCursorW.USER32(00000000,00007F8B), ref: 007D79E7
LoadCursorW.USER32(00000000,00007F01), ref: 007D79F2
LoadCursorW.USER32(00000000,00007F81), ref: 007D79FD
LoadCursorW.USER32(00000000,00007F88), ref: 007D7A08
LoadCursorW.USER32(00000000,00007F80), ref: 007D7A13
LoadCursorW.USER32(00000000,00007F86), ref: 007D7A1E
LoadCursorW.USER32(00000000,00007F83), ref: 007D7A29
LoadCursorW.USER32(00000000,00007F85), ref: 007D7A34
LoadCursorW.USER32(00000000,00007F82), ref: 007D7A3F
LoadCursorW.USER32(00000000,00007F84), ref: 007D7A4A
LoadCursorW.USER32(00000000,00007F04), ref: 007D7A55
LoadCursorW.USER32(00000000,00007F02), ref: 007D7A60
LoadCursorW.USER32(00000000,00007F89), ref: 007D7A6B
GetCursorInfo.USER32(?), ref: 007D7A7B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 8bd89100ccb9d407ad127586c8072c52e90e07fdb2d6a4f71f135534e9537857
Instruction ID: 20d315091deb6b4c225b1c315d2109eb17031a82d76688489ea487b191ecf98d
Opcode Fuzzy Hash: 8bd89100ccb9d407ad127586c8072c52e90e07fdb2d6a4f71f135534e9537857
Instruction Fuzzy Hash: 113105B0D083196ADB509FBA8C8995FBEF8FB44750F504527A50DA7280EA78A500CFA1

Function 0078C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 0079E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,0078C8B7,?,00002000,?,?,00000000,?,0078419E,?,?,?,0081DC00), ref: 0079E984

Part of subcall function 0078660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007853B1,?,?,007861FF,?,00000000,00000001,00000000), ref: 0078662F

__wsplitpath.LIBCMT ref: 0078C93E

Part of subcall function 007A1DFC: __wsplitpath_helper.LIBCMT ref: 007A1E3C

_wcscpy.LIBCMT ref: 0078C953
_wcscat.LIBCMT ref: 0078C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0078C978
SetCurrentDirectoryW.KERNEL32(?), ref: 0078CABE

Part of subcall function 0078B337: _wcscpy.LIBCMT ref: 0078B36F

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 007F3098
>>>AUTOIT SCRIPT<<<, xrefs: 007F311B
EA06, xrefs: 007F30C9
Unterminated string, xrefs: 007F3470
Error opening the file, xrefs: 007F30B4, 007F313D
AU3!, xrefs: 0078C90C
Bad directive syntax error, xrefs: 007F3429

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: dfbca30cfe641c1667bca7f426001f186a443eb615f34c99f8253e1f6389f4ec
Instruction ID: f4abe8c31fcd3ad8d0f03325364eb781dc8bb2c83d904d438384871ca7fdefb8
Opcode Fuzzy Hash: dfbca30cfe641c1667bca7f426001f186a443eb615f34c99f8253e1f6389f4ec
Instruction Fuzzy Hash: D112CD71548345DFC725EF24C885AAFBBE4BF99300F00491EF58993262DB38DA49CB62

Function 007ECE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007ECEFB
DestroyWindow.USER32(?,?), ref: 007ECF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 007ECFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 007ED016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007ED025
DestroyWindow.USER32(?), ref: 007ED042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00780000,00000000), ref: 007ED075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007ED094
GetDesktopWindow.USER32 ref: 007ED0A9
GetWindowRect.USER32(00000000), ref: 007ED0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 007ED0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 007ED0DA

Part of subcall function 0079B526: GetWindowLongW.USER32(?,000000EB), ref: 0079B537

Strings

tooltips_class32, xrefs: 007ECFED, 007ED06E
0, xrefs: 007ECF1B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: faf11f230019eb1f2336968a0238b8e4c84d9827f91bd9452ddc36ff1fc4cd8b
Instruction ID: ba4ef1e083970f87c935e5da4df93d0a8f8bc7ffadb22096d319c142d702c7fc
Opcode Fuzzy Hash: faf11f230019eb1f2336968a0238b8e4c84d9827f91bd9452ddc36ff1fc4cd8b
Instruction Fuzzy Hash: 757188B4140349AFDB20CF28CC89F667BA5FB8D704F084519F995872A1D779ED42CB62

Function 007EF351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

DragQueryPoint.SHELL32(?,?), ref: 007EF37A

Part of subcall function 007ED7DE: ClientToScreen.USER32(?,?), ref: 007ED807
Part of subcall function 007ED7DE: GetWindowRect.USER32(?,?), ref: 007ED87D
Part of subcall function 007ED7DE: PtInRect.USER32(?,?,007EED5A), ref: 007ED88D

SendMessageW.USER32(?,000000B0,?,?), ref: 007EF3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007EF3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007EF411
_wcscat.LIBCMT ref: 007EF441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 007EF458
SendMessageW.USER32(?,000000B0,?,?), ref: 007EF471
SendMessageW.USER32(?,000000B1,?,?), ref: 007EF488
SendMessageW.USER32(?,000000B1,?,?), ref: 007EF4AA
DragFinish.SHELL32(?), ref: 007EF4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 007EF59C

Strings

@GUI_DROPID, xrefs: 007EF4D1
@GUI_DRAGID, xrefs: 007EF510
@GUI_DRAGFILE, xrefs: 007EF54B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 1baac2cb2004bab086c7b510b72994160152a0b64bec6376d5c981a4801497c8
Instruction ID: c31864666845cb9009aefb7f6b6a8efca21ce9f8527d88122a50f9212abe6380
Opcode Fuzzy Hash: 1baac2cb2004bab086c7b510b72994160152a0b64bec6376d5c981a4801497c8
Instruction Fuzzy Hash: F1615A71108340AFC711EF64DC89D9FBBE8FF99714F000A1EF595961A1DB359A09CB62

Function 007CAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 007CAB3D
VariantCopy.OLEAUT32(?,?), ref: 007CAB46
VariantClear.OLEAUT32(?), ref: 007CAB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 007CAC40
__swprintf.LIBCMT ref: 007CAC70
VarR8FromDec.OLEAUT32(?,?), ref: 007CAC9C
VariantInit.OLEAUT32(?), ref: 007CAD4D
SysFreeString.OLEAUT32(00000016), ref: 007CADDF
VariantClear.OLEAUT32(?), ref: 007CAE35
VariantClear.OLEAUT32(?), ref: 007CAE44
VariantInit.OLEAUT32(00000000), ref: 007CAE80

Strings

Default, xrefs: 007CACFD
%4d%02d%02d%02d%02d%02d, xrefs: 007CAC6A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 77932af468201dca96ae362355b57ac403b826e6d1504d45df917d1f711e6b9d
Instruction ID: ad14811280dde2d7a93d7fe9ec4b19bf9e8f070fc8db2d08f3911eea40b4393a
Opcode Fuzzy Hash: 77932af468201dca96ae362355b57ac403b826e6d1504d45df917d1f711e6b9d
Instruction Fuzzy Hash: AAD100B1A00619FBCB249F65D889F6AB7B5FF04706F14805DE405AB181DB3CEC40DBA2

Function 007E716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007E71FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007E7247

Strings

EXISTS, xrefs: 007E72B0
EXPAND, xrefs: 007E72E1
GETITEMCOUNT, xrefs: 007E7311
ISCHECKED, xrefs: 007E73B2
UNCHECK, xrefs: 007E740B
GETSELECTED, xrefs: 007E733F
GETTOTALCOUNT, xrefs: 007E722A
GETTEXT, xrefs: 007E7382
COLLAPSE, xrefs: 007E728D
SELECT, xrefs: 007E73E0
CHECK, xrefs: 007E7267

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 00e944d3805df57dd04c2af878bad49bdae67bb1332223e1a9f9f919469fdd54
Instruction ID: 5f1bc15e3ed8784aff57611856a3d96374771fa521f722bf5510c66e75c30579
Opcode Fuzzy Hash: 00e944d3805df57dd04c2af878bad49bdae67bb1332223e1a9f9f919469fdd54
Instruction Fuzzy Hash: 55918170204741DBCB09EF10C855A6EB7A5BF99310F04485CF9965B3A3DB38ED0ADB91

Function 007EE4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007EE5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,007EBEAF), ref: 007EE607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007EE647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007EE68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007EE6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,007EBEAF), ref: 007EE6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 007EE6DF
DestroyIcon.USER32(?,?,?,?,?,007EBEAF), ref: 007EE6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 007EE70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 007EE717

Part of subcall function 007A0FA7: __wcsicmp_l.LIBCMT ref: 007A1030

Strings

.icl, xrefs: 007EE521
.dll, xrefs: 007EE564
.exe, xrefs: 007EE541

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 072f58bd00f50858df2a2edf3687391040d3b2bbec0e7dc7667c281e42f1f70d
Instruction ID: 1a5ba8c2886156e48693a127c6a676c54d48a0a2c15882b7571ebd79cbedf126
Opcode Fuzzy Hash: 072f58bd00f50858df2a2edf3687391040d3b2bbec0e7dc7667c281e42f1f70d
Instruction Fuzzy Hash: F261E071540255FAEB20DF65CC4AFFE7BA8BB18724F104A05F911E61D1EB78A990CBA0

Function 007CD219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

CharLowerBuffW.USER32(?,?), ref: 007CD292
GetDriveTypeW.KERNEL32 ref: 007CD2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007CD327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007CD35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007CD38C

Strings

close cd wait, xrefs: 007CD377
closed, xrefs: 007CD2A6, 007CD2AF
close, xrefs: 007CD298
type cdaudio alias cd wait, xrefs: 007CD30A
wait, xrefs: 007CD349
open , xrefs: 007CD2EE
open, xrefs: 007CD2B9
set cd door , xrefs: 007CD32D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: 2b25fa779a28c67f1f5a859457d15ee3e8ad6a4ead0d839e25b3e409e835b708
Instruction ID: 0c64209bbf97b677e0fff2989ac2b67ee056446a6a1b66a6dfb6cbb53eb3b70c
Opcode Fuzzy Hash: 2b25fa779a28c67f1f5a859457d15ee3e8ad6a4ead0d839e25b3e409e835b708
Instruction Fuzzy Hash: 3D512A71504705EFC700EF20D88596AB7E4FF98758F10886DF895A7291DB39EE0ACB92

Function 007C26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,007F3973,00000016,0000138C,00000016,?,00000016,0081DDB4,00000000,?), ref: 007C26F1
LoadStringW.USER32(00000000,?,007F3973,00000016), ref: 007C26FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,007F3973,00000016,0000138C,00000016,?,00000016,0081DDB4,00000000,?,00000016), ref: 007C271C
LoadStringW.USER32(00000000,?,007F3973,00000016), ref: 007C271F
__swprintf.LIBCMT ref: 007C276F
__swprintf.LIBCMT ref: 007C2780
_wprintf.LIBCMT ref: 007C2829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007C2840

Strings

Line %d:, xrefs: 007C277A
^ ERROR, xrefs: 007C27D5
%s (%d) : ==> %s: %s %s, xrefs: 007C2824
Line %d (File "%s"):, xrefs: 007C2769
Error: , xrefs: 007C27F7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: df7dda8559a9ef5ca3bc730520255aa95666dba64256ebfb353c681bdb2e7946
Instruction ID: e608fb1c64efde0f6176ce29cd59e1505f372671f7349c75d01bd2b4b22a7072
Opcode Fuzzy Hash: df7dda8559a9ef5ca3bc730520255aa95666dba64256ebfb353c681bdb2e7946
Instruction Fuzzy Hash: 68414272840219FACB15FBE0DD8AEEEB778EF55344F500069B501B6092EA786F49CB61

Function 007CD0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007CD0D8
__swprintf.LIBCMT ref: 007CD0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 007CD137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 007CD15C
_memset.LIBCMT ref: 007CD17B
_wcsncpy.LIBCMT ref: 007CD1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 007CD1EC
CloseHandle.KERNEL32(00000000), ref: 007CD1F7
RemoveDirectoryW.KERNEL32(?), ref: 007CD200
CloseHandle.KERNEL32(00000000), ref: 007CD20A

Strings

:, xrefs: 007CD11B
\, xrefs: 007CD110
\??\%s, xrefs: 007CD0F4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 3b3e70b2ec620033ef1159fbd47f827eb24bfb1152faf510aebb4a90cce99e84
Instruction ID: d03df1d2987794f6db4e6ec57f5ee1cc32df82619546eb87a521458322f5df05
Opcode Fuzzy Hash: 3b3e70b2ec620033ef1159fbd47f827eb24bfb1152faf510aebb4a90cce99e84
Instruction Fuzzy Hash: D23190B6500209ABDB21DFA4DC49FEB77BCFF89740F1041BAF509D2161EB74AA458B24

Function 007EE731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,007EBEF4,?,?), ref: 007EE754
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,007EBEF4,?,?,00000000,?), ref: 007EE76B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,007EBEF4,?,?,00000000,?), ref: 007EE776
CloseHandle.KERNEL32(00000000,?,?,?,?,007EBEF4,?,?,00000000,?), ref: 007EE783
GlobalLock.KERNEL32(00000000), ref: 007EE78C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,007EBEF4,?,?,00000000,?), ref: 007EE79B
GlobalUnlock.KERNEL32(00000000), ref: 007EE7A4
CloseHandle.KERNEL32(00000000,?,?,?,?,007EBEF4,?,?,00000000,?), ref: 007EE7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,007EBEF4,?,?,00000000,?), ref: 007EE7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,0080D9BC,?), ref: 007EE7D5
GlobalFree.KERNEL32(00000000), ref: 007EE7E5
GetObjectW.GDI32(00000000,00000018,?), ref: 007EE809
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 007EE834
DeleteObject.GDI32(00000000), ref: 007EE85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007EE872

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 6ab47e8521b3f16eb6a15035d13aa6b1050b1b2341df14b9ec2827565b184acd
Instruction ID: cddd1ddfa8bd2636e2285db73e3b60ac2bbf9dd6d2b56bcf5851c27d71862529
Opcode Fuzzy Hash: 6ab47e8521b3f16eb6a15035d13aa6b1050b1b2341df14b9ec2827565b184acd
Instruction Fuzzy Hash: 1F414975601305EFDB519FA5CC88EAABBB8FF89711F108458F90AD7260D774AD41CB60

Function 007D05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 007D076F
_wcscat.LIBCMT ref: 007D0787
_wcscat.LIBCMT ref: 007D0799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007D07AE
SetCurrentDirectoryW.KERNEL32(?), ref: 007D07C2
GetFileAttributesW.KERNEL32(?), ref: 007D07DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 007D07F4
SetCurrentDirectoryW.KERNEL32(?), ref: 007D0806

Strings

*.*, xrefs: 007D0845

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: e3e8ecf0e63db47fde02491625ecb23967389348b1d7ab00721c895f7d59c3b9
Instruction ID: d9a72a25f8216f3ac0d3f07f01bc79dfcc55734c1a8b793ac372d67731ffa3c2
Opcode Fuzzy Hash: e3e8ecf0e63db47fde02491625ecb23967389348b1d7ab00721c895f7d59c3b9
Instruction Fuzzy Hash: A1817E715043019FCB24EF64C849A6EB7F8BBC9314F18982FF885D7351EA38E9558B92

Function 007EEEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007EEF3B
GetFocus.USER32 ref: 007EEF4B
GetDlgCtrlID.USER32(00000000), ref: 007EEF56
_memset.LIBCMT ref: 007EF081
GetMenuItemInfoW.USER32 ref: 007EF0AC
GetMenuItemCount.USER32(00000000), ref: 007EF0CC
GetMenuItemID.USER32(?,00000000), ref: 007EF0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 007EF113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 007EF15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007EF193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 007EF1C8

Strings

0, xrefs: 007EF079

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 82870587a4cc7c38be7474ea4119b9e55d9ebcfaf6e4d0bca0e353a77f8554f3
Instruction ID: 837e1b98b62b0734d9dc6f6f0003a6ce0ba894ede965f13bd6877eefd533cfa4
Opcode Fuzzy Hash: 82870587a4cc7c38be7474ea4119b9e55d9ebcfaf6e4d0bca0e353a77f8554f3
Instruction Fuzzy Hash: 52818E7120A389EFDB10CF16D888A6BBBE5FB8C314F10492DF99997291D734D905CB92

Function 007BA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 007BABD7
Part of subcall function 007BABBB: GetLastError.KERNEL32(?,007BA69F,?,?,?), ref: 007BABE1
Part of subcall function 007BABBB: GetProcessHeap.KERNEL32(00000008,?,?,007BA69F,?,?,?), ref: 007BABF0
Part of subcall function 007BABBB: HeapAlloc.KERNEL32(00000000,?,007BA69F,?,?,?), ref: 007BABF7
Part of subcall function 007BABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 007BAC0E

Part of subcall function 007BAC56: GetProcessHeap.KERNEL32(00000008,007BA6B5,00000000,00000000,?,007BA6B5,?), ref: 007BAC62
Part of subcall function 007BAC56: HeapAlloc.KERNEL32(00000000,?,007BA6B5,?), ref: 007BAC69
Part of subcall function 007BAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,007BA6B5,?), ref: 007BAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007BA8CB
_memset.LIBCMT ref: 007BA8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007BA8FF
GetLengthSid.ADVAPI32(?), ref: 007BA910
GetAce.ADVAPI32(?,00000000,?), ref: 007BA94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007BA969
GetLengthSid.ADVAPI32(?), ref: 007BA986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007BA995
HeapAlloc.KERNEL32(00000000), ref: 007BA99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 007BA9BD
CopySid.ADVAPI32(00000000), ref: 007BA9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007BA9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007BAA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 007BAA2F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: b7a1db8d1664df16bec95d83389af2b8fd230eb3481c8f6fbf286527a35cca87
Instruction ID: 3eb1b35b7d906db4a02fcf0cb3d8fe52e23897b84f6499e9c5ea8ccdc0bf7f09
Opcode Fuzzy Hash: b7a1db8d1664df16bec95d83389af2b8fd230eb3481c8f6fbf286527a35cca87
Instruction Fuzzy Hash: F1511CB1900209BFDF15EF94DD49AEEBBB9FF04300F148119F915AB290DB399A05CB61

Function 007CCC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 007CCCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 007CCCC5
__swprintf.LIBCMT ref: 007CCD1E
__swprintf.LIBCMT ref: 007CCD37
_wprintf.LIBCMT ref: 007CCDED
_wprintf.LIBCMT ref: 007CCE0B

Strings

"%s" (%d) : ==> %s:, xrefs: 007CCE06
^ ERROR, xrefs: 007CCD8F
"%s" (%d) : ==> %s:%s%s, xrefs: 007CCDE8
Line %d (File "%s"):, xrefs: 007CCD18, 007CCD31
Error: , xrefs: 007CCDB5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: 223ef7251ebb5a271a9b716001fceffb67ff5775dd437801e11098b9ca9e04f1
Instruction ID: 1470df322b5bf01a9de11b0931e61295a6b587e33a1c1b1cdadad3ab8e949ab1
Opcode Fuzzy Hash: 223ef7251ebb5a271a9b716001fceffb67ff5775dd437801e11098b9ca9e04f1
Instruction Fuzzy Hash: 25516C71940609EACB16FBE0CD4AEEEBB78EF05304F100169F505721A2EB396F55DB61

Function 007CCA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 007CCA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 007CCAB0
__swprintf.LIBCMT ref: 007CCB09
__swprintf.LIBCMT ref: 007CCB22
_wprintf.LIBCMT ref: 007CCBCD
_wprintf.LIBCMT ref: 007CCBEB

Strings

"%s" (%d) : ==> %s:, xrefs: 007CCBE6
^ ERROR , xrefs: 007CCB64
"%s" (%d) : ==> %s:%s%s, xrefs: 007CCBC8
Line %d (File "%s"):, xrefs: 007CCB03, 007CCB1C
Error: , xrefs: 007CCB95

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: 8c7df1dddb0f1c03e77392052563e56b297d39d391ccb33275aadb1a6e9c7bf1
Instruction ID: 0b9854f66a82f06099f14882e646cfadbfa37b2967d2df4836145c5832d4b512
Opcode Fuzzy Hash: 8c7df1dddb0f1c03e77392052563e56b297d39d391ccb33275aadb1a6e9c7bf1
Instruction Fuzzy Hash: F1517E71940609EACF16FBE0CD4AEEEBB78AF05340F100169F50572192EA786F99DB61

Function 007C55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C55D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 007C5664
GetMenuItemCount.USER32(00841708), ref: 007C56ED
DeleteMenu.USER32(00841708,00000005,00000000,000000F5,?,?), ref: 007C577D
DeleteMenu.USER32(00841708,00000004,00000000), ref: 007C5785
DeleteMenu.USER32(00841708,00000006,00000000), ref: 007C578D
DeleteMenu.USER32(00841708,00000003,00000000), ref: 007C5795
GetMenuItemCount.USER32(00841708), ref: 007C579D
SetMenuItemInfoW.USER32(00841708,00000004,00000000,00000030), ref: 007C57D3
GetCursorPos.USER32(?), ref: 007C57DD
SetForegroundWindow.USER32(00000000), ref: 007C57E6
TrackPopupMenuEx.USER32(00841708,00000000,?,00000000,00000000,00000000), ref: 007C57F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 007C5805

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 07109b97e3776a1950fe35418d6955aec0574c808783fe6b916a4ebc9f0879ed
Instruction ID: 6985aa3ed772975125d26874d457e0063462aa35341efc59dccdbf342090f2df
Opcode Fuzzy Hash: 07109b97e3776a1950fe35418d6955aec0574c808783fe6b916a4ebc9f0879ed
Instruction Fuzzy Hash: 1871D270640A15BEEB219F64CC49FAABF65FF00768F24420DF9196A1D1C7BA6C90DB90

Function 007BA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007BA1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007BA211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007BA22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007BA249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 007BA273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 007BA29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 007BA2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 007BA2AB

Strings

SOFTWARE\Classes\, xrefs: 007BA17D
\CLSID, xrefs: 007BA193
\IPC$, xrefs: 007BA1F3

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: ca8e93e87431810b3272d21d3ee9bd859cc074920a503fdbc60b086e407fc7d2
Instruction ID: 6e5eb4d10773b0609cdc47df8f626dcd97d68d8fffb55c8aef34974795decf70
Opcode Fuzzy Hash: ca8e93e87431810b3272d21d3ee9bd859cc074920a503fdbc60b086e407fc7d2
Instruction Fuzzy Hash: 6141E676C5062DEADB21EBA4DC89DEDB7B8FF44310F004129E815A3261EB789E05CB91

Function 007E3C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E2BB5,?,?), ref: 007E3C1D

Strings

HKCC, xrefs: 007E3CD1
HKEY_USERS, xrefs: 007E3D04
HKCU, xrefs: 007E3CF3
HKLM, xrefs: 007E3C81
HKU, xrefs: 007E3D15
HKEY_CURRENT_CONFIG, xrefs: 007E3CC0
HKEY_LOCAL_MACHINE, xrefs: 007E3C6C
HKEY_CLASSES_ROOT, xrefs: 007E3C96
HKEY_CURRENT_USER, xrefs: 007E3CE2
HKCR, xrefs: 007E3CAB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: b4a9792efb901cf95852eba3dab9d5a385d97b790d688eb4f0c1100abe3488fa
Instruction ID: 3c4ac92bb014dd55c8ae5a95f5dd5e95d370e8963d2ebbfdc2a7fb7dff17a9b5
Opcode Fuzzy Hash: b4a9792efb901cf95852eba3dab9d5a385d97b790d688eb4f0c1100abe3488fa
Instruction Fuzzy Hash: 7C41603020128ADBDF00EF51EC49AEA3365FF66300F105455EC955B392EB78EE0ACB60

Function 007C25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,007F36F4,00000010,?,Bad directive syntax error,0081DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 007C25D6
LoadStringW.USER32(00000000,?,007F36F4,00000010), ref: 007C25DD
_wprintf.LIBCMT ref: 007C2610
__swprintf.LIBCMT ref: 007C2632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 007C26A1

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 007C260B
Line %d:, xrefs: 007C262C
Line %d (File "%s"):, xrefs: 007C2647
Error: , xrefs: 007C266F
., xrefs: 007C2687

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: afab0d822b67dcb4a76c6d53d3baa992980f2f07d0dbc0ea60c60a958688d69c
Instruction ID: d6f3ec548119db2e7d5570bce375941f1615522cfea0475e922e7a871df6057a
Opcode Fuzzy Hash: afab0d822b67dcb4a76c6d53d3baa992980f2f07d0dbc0ea60c60a958688d69c
Instruction Fuzzy Hash: A321683184021AEFCF12BB90CC0AEEE7B79FF19304F000459F515A21A2EA79A619DB61

Function 007C7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 007C7B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 007C7B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007C7B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 007C7B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 007C7B8C

Strings

play PlayMe wait, xrefs: 007C7B76
close PlayMe, xrefs: 007C7B53, 007C7B80
status PlayMe mode, xrefs: 007C7B3D
open , xrefs: 007C7AF1
play PlayMe, xrefs: 007C7B87
alias PlayMe, xrefs: 007C7B1B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 1aa0f4762f409eb4050d38e75077f0cd77701fb0888cc62b7f97aa195653f9cd
Instruction ID: 9a21b375698f93316d05da176b664fecd538b5c50a1c957df5a665ffec73cbd3
Opcode Fuzzy Hash: 1aa0f4762f409eb4050d38e75077f0cd77701fb0888cc62b7f97aa195653f9cd
Instruction Fuzzy Hash: 971190E0A80259B9D724B661CC4AEFF7B7CEBD1B00F00042D7421A61C1DE681E48CBB1

Function 007C778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 007C7794

Part of subcall function 0079DC38: timeGetTime.WINMM(?,7694B400,007F58AB), ref: 0079DC3C

Sleep.KERNEL32(0000000A), ref: 007C77C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 007C77E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 007C7806
SetActiveWindow.USER32 ref: 007C7825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 007C7833
SendMessageW.USER32(00000010,00000000,00000000), ref: 007C7852
Sleep.KERNEL32(000000FA), ref: 007C785D
IsWindow.USER32 ref: 007C7869
EndDialog.USER32(00000000), ref: 007C787A

Strings

BUTTON, xrefs: 007C77F8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 2d09f0578e108330bc459a85c52e2c84b7eac6005779ad594a5f2b31e98227ac
Instruction ID: 81fa3d150dc2d6364f41459688466657383edc153f27d21a2dfd9adc65adcd39
Opcode Fuzzy Hash: 2d09f0578e108330bc459a85c52e2c84b7eac6005779ad594a5f2b31e98227ac
Instruction Fuzzy Hash: 49213BB4204309AFE7095FA0EC8DF263F79FB55349B00402CF51696266EF6A9D10DB60

Function 007D02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

CoInitialize.OLE32(00000000), ref: 007D034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007D03DE
SHGetDesktopFolder.SHELL32(?), ref: 007D03F2
CoCreateInstance.OLE32(0080DA8C,00000000,00000001,00833CF8,?), ref: 007D043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007D04AD
CoTaskMemFree.OLE32(?,?), ref: 007D0505
_memset.LIBCMT ref: 007D0542
SHBrowseForFolderW.SHELL32(?), ref: 007D057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007D05A1
CoTaskMemFree.OLE32(00000000), ref: 007D05A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007D05DF
CoUninitialize.OLE32(00000001,00000000), ref: 007D05E1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 0ef9432dac49f43f47720fc9926fa6e0b4884dbf4d9b909a5a9c31202642b99a
Instruction ID: df876be880f3be2ae9a56c0c09ee3618e01caa39cac67ff23d1f5ce92f572789
Opcode Fuzzy Hash: 0ef9432dac49f43f47720fc9926fa6e0b4884dbf4d9b909a5a9c31202642b99a
Instruction Fuzzy Hash: 96B1D875A00209EFDB14DFA4D889EAEBBB9FF48314F148469E906EB251D734ED41CB60

Function 007C2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007C2ED6
SetKeyboardState.USER32(?), ref: 007C2F41
GetAsyncKeyState.USER32(000000A0), ref: 007C2F61
GetKeyState.USER32(000000A0), ref: 007C2F78
GetAsyncKeyState.USER32(000000A1), ref: 007C2FA7
GetKeyState.USER32(000000A1), ref: 007C2FB8
GetAsyncKeyState.USER32(00000011), ref: 007C2FE4
GetKeyState.USER32(00000011), ref: 007C2FF2
GetAsyncKeyState.USER32(00000012), ref: 007C301B
GetKeyState.USER32(00000012), ref: 007C3029
GetAsyncKeyState.USER32(0000005B), ref: 007C3052
GetKeyState.USER32(0000005B), ref: 007C3060

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2dc43da3cca3db49ea93b1f5c1d4aeac6bb5b67ac55df63405ccee08211b3c4f
Instruction ID: c9ea133bcf11fe9ae98e429219d21d982b7f62beb0bf004de83be860214968b5
Opcode Fuzzy Hash: 2dc43da3cca3db49ea93b1f5c1d4aeac6bb5b67ac55df63405ccee08211b3c4f
Instruction Fuzzy Hash: E551E821A0478869FB35EBA48815FEEBFF49F11340F08859DD5C2561C3DA9C9B8DC7A2

Function 007BED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 007BED1E
GetWindowRect.USER32(00000000,?), ref: 007BED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 007BED8E
GetDlgItem.USER32(?,00000002), ref: 007BED99
GetWindowRect.USER32(00000000,?), ref: 007BEDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 007BEE01
GetDlgItem.USER32(?,000003E9), ref: 007BEE0F
GetWindowRect.USER32(00000000,?), ref: 007BEE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 007BEE63
GetDlgItem.USER32(?,000003EA), ref: 007BEE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 007BEE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 007BEE9B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 0e82015b988b0c20d5cca4f3e175f8cd581973023a8f08d7a59afa160d257d9c
Instruction ID: cb843ef00c925358b04594241fc1da82e1c16d0b3e96cc1c735cb8d4d1aa3132
Opcode Fuzzy Hash: 0e82015b988b0c20d5cca4f3e175f8cd581973023a8f08d7a59afa160d257d9c
Instruction Fuzzy Hash: 8751FDB1B00205AFDB18CFA9DD85BAEBBBAFB98700F148129F519D7290D7759D008B50

Function 0079B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0079B759,?,00000000,?,?,?,?,0079B72B,00000000,?), ref: 0079BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0079B72B), ref: 0079B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0079B72B,00000000,?,?,0079B2EF,?,?), ref: 0079B88D
DestroyAcceleratorTable.USER32(00000000), ref: 007FD8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0079B72B,00000000,?,?,0079B2EF,?,?), ref: 007FD8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0079B72B,00000000,?,?,0079B2EF,?,?), ref: 007FD8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0079B72B,00000000,?,?,0079B2EF,?,?), ref: 007FD90A
DeleteObject.GDI32(00000000), ref: 007FD91C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 5fe0d397ca4cd2631ed5cba6df4d3dfa87e672b5eefe3f4d6193ad75b8ab7194
Instruction ID: 27e6ca78c7ec2f224419d20d63edccec9515abb5269a8444d7496d27a1b2cf2b
Opcode Fuzzy Hash: 5fe0d397ca4cd2631ed5cba6df4d3dfa87e672b5eefe3f4d6193ad75b8ab7194
Instruction Fuzzy Hash: 0B616934501704DFDF359F98FA88B35B7F6FBA5325F15461AE58686A60C778AC80CB80

Function 0079B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0079B526: GetWindowLongW.USER32(?,000000EB), ref: 0079B537

GetSysColor.USER32(0000000F), ref: 0079B438

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 1d6d11928e036883d50d2e7eebc7e32e774c9ce8a59e4fa44ba609dd18aae14a
Instruction ID: 2b6305132abd3c9848866adeeaa37cbb4227450cd35617bb336ade5295528427
Opcode Fuzzy Hash: 1d6d11928e036883d50d2e7eebc7e32e774c9ce8a59e4fa44ba609dd18aae14a
Instruction Fuzzy Hash: 9A4181311002849FDF205F68FD89BB93B66BB46731F144261FE658A1F6D7388C41EB61

Function 007C690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 007C6923
_wcscpy.LIBCMT ref: 007C6934
__wsplitpath.LIBCMT ref: 007C6958
__wsplitpath.LIBCMT ref: 007C6979
_wcscpy.LIBCMT ref: 007C699B
_wcscpy.LIBCMT ref: 007C69B9
_wcscpy.LIBCMT ref: 007C69C7
_wcscat.LIBCMT ref: 007C69D6
_wcscat.LIBCMT ref: 007C6A2B
_wcscat.LIBCMT ref: 007C6A61
_wcscat.LIBCMT ref: 007C6A73

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: a689d040574c762865e4e5401ded34fb7cfb1dc599554d2b1de2fae451a3a8de
Instruction ID: ec09046628f6c37da611c3b42ce8ecc4117ec2f06910c58a3c220b80beed915b
Opcode Fuzzy Hash: a689d040574c762865e4e5401ded34fb7cfb1dc599554d2b1de2fae451a3a8de
Instruction Fuzzy Hash: 55410F7784521CAECF61DB94CC85DDE73BCEB85310F0045AAF659A2051EA34ABE58F90

Function 007CD76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(0081DC00,0081DC00,0081DC00), ref: 007CD7CE
GetDriveTypeW.KERNEL32(?,00833A70,00000061), ref: 007CD898
_wcscpy.LIBCMT ref: 007CD8C2

Strings

cdrom, xrefs: 007CD7EA
all, xrefs: 007CD7D4
network, xrefs: 007CD82C
unknown, xrefs: 007CD859
removable, xrefs: 007CD800
ramdisk, xrefs: 007CD842
fixed, xrefs: 007CD816

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 5f48a6961629b640b09a837a9c8bbf372551c08af10e32f98451e10357387bc1
Instruction ID: 53b900d5cc3847875b0d33827698a2aa73f433fb741a751e7d4bd4f406bde1c1
Opcode Fuzzy Hash: 5f48a6961629b640b09a837a9c8bbf372551c08af10e32f98451e10357387bc1
Instruction Fuzzy Hash: 3A515C35144200AFC710EF14D895FAAB7E5FF85314F10892DB59A972A2EB39ED09CB92

Function 0078936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007893AB
__itow.LIBCMT ref: 007893DF

Part of subcall function 007A1557: _xtow@16.LIBCMT ref: 007A1578

Strings

False, xrefs: 007F4C93
0x%p, xrefs: 007F4CAD
True, xrefs: 007F4C8C
%.15g, xrefs: 007893A5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 2d747efdc769696ad875a1d9e01e89d98f7556961f0ee0c640e5a7c8a49c65ba
Instruction ID: 5df522592641f550bd4172ac395524066969300b290ab73d50f098c5a6d8a28f
Opcode Fuzzy Hash: 2d747efdc769696ad875a1d9e01e89d98f7556961f0ee0c640e5a7c8a49c65ba
Instruction Fuzzy Hash: 9D41F871504208EBEB24EF74D945E7A77E8EF89310F2444AEE24AD7291EA39D941CB60

Function 007EA1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 007EA259
CreateCompatibleDC.GDI32(00000000), ref: 007EA260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 007EA273
SelectObject.GDI32(00000000,00000000), ref: 007EA27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 007EA286
DeleteDC.GDI32(00000000), ref: 007EA28F
GetWindowLongW.USER32(?,000000EC), ref: 007EA299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 007EA2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 007EA2B9

Strings

static, xrefs: 007EA1F1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 2fafd6dd9da14d009c215b7841ed43375df86c215e1273a7894e88ff99732e43
Instruction ID: 37c22e95b1c3855f62b1413b76ccf2ccc3f13aaff410170fb6f97f835eba6be9
Opcode Fuzzy Hash: 2fafd6dd9da14d009c215b7841ed43375df86c215e1273a7894e88ff99732e43
Instruction Fuzzy Hash: 62318C31101215BBDF215FA5DC49FEA3B6DFF5D360F110214FA29A61A0CB3AE811DBA4

Function 007C6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007C6F1D
gethostname.WSOCK32(?,00000100), ref: 007C6F37
gethostbyname.WSOCK32(?), ref: 007C6F44
_wcscpy.LIBCMT ref: 007C6F6C
inet_ntoa.WSOCK32(?), ref: 007C6F8A
_strcat.LIBCMT ref: 007C6F98
_wcscpy.LIBCMT ref: 007C6FAF
WSACleanup.WSOCK32 ref: 007C6FBD
_wcscpy.LIBCMT ref: 007C6FCB

Strings

0.0.0.0, xrefs: 007C6F66

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: ef0659e9c3423d4814e3cb6138ba8d18e1e96960d5e5c5aa8d2f184d1ab661c8
Instruction ID: b3c55f23e6cafcd48127b1e8bfd69c7e39bf856f9edf15ffa28a8f7e354c692f
Opcode Fuzzy Hash: ef0659e9c3423d4814e3cb6138ba8d18e1e96960d5e5c5aa8d2f184d1ab661c8
Instruction Fuzzy Hash: 43110A72504219EBDB25ABB0AC4DFDA77ACEF45710F00056DF105D6081EF78DE818B90

Function 007A500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007A5047

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

__gmtime64_s.LIBCMT ref: 007A50E0
__gmtime64_s.LIBCMT ref: 007A5116
__gmtime64_s.LIBCMT ref: 007A5133
__allrem.LIBCMT ref: 007A5189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A51A5
__allrem.LIBCMT ref: 007A51BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A51DA
__allrem.LIBCMT ref: 007A51F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007A520F
__invoke_watson.LIBCMT ref: 007A5280

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 4304418ed17b1d99d2d69cf275e6a96d75c9415bfb16589e15540577801fe4f0
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: E171E6B2A01B16EBD7149E78CC55BAA73A8BF92364F144329F410D76C1E778ED408BD0

Function 007C4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C4DF8
GetMenuItemInfoW.USER32(00841708,000000FF,00000000,00000030), ref: 007C4E59
SetMenuItemInfoW.USER32(00841708,00000004,00000000,00000030), ref: 007C4E8F
Sleep.KERNEL32(000001F4), ref: 007C4EA1
GetMenuItemCount.USER32(?), ref: 007C4EE5
GetMenuItemID.USER32(?,00000000), ref: 007C4F01
GetMenuItemID.USER32(?,-00000001), ref: 007C4F2B
GetMenuItemID.USER32(?,?), ref: 007C4F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007C4FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C4FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C4FEB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 4ef0f14ff270f10f46860ff57d12c70c5324c5894d47210b0d455fa3a10a13c1
Instruction ID: 438b7dbfeafa510ed0c9593b4418a31c3f6905d224cb3f8af1bdbba01600945b
Opcode Fuzzy Hash: 4ef0f14ff270f10f46860ff57d12c70c5324c5894d47210b0d455fa3a10a13c1
Instruction Fuzzy Hash: C4616C71900249AFEB21CFA4DC98EAE7BB8FB45318F18015DF841A7251D739ED45DB20

Function 007E9C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007E9C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 007E9C9B
GetWindowLongW.USER32(?,000000F0), ref: 007E9CBF
_memset.LIBCMT ref: 007E9CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007E9CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 007E9D5A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: c2cf9302efcb93190c2888801aaab3a6a42827a172cebb96149999184382487a
Instruction ID: 583063f4801156358a0be46367a75e63bd4beb5e8a29be7bf2458b1da0687443
Opcode Fuzzy Hash: c2cf9302efcb93190c2888801aaab3a6a42827a172cebb96149999184382487a
Instruction Fuzzy Hash: 27616CB6A00248AFDB10DFA4CC85EEE77B8EB0D714F14415AFA14E72A1D778AD41DB50

Function 007B94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 007B94FE
SafeArrayAllocData.OLEAUT32(?), ref: 007B9549
VariantInit.OLEAUT32(?), ref: 007B955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 007B957B
VariantCopy.OLEAUT32(?,?), ref: 007B95BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 007B95D2
VariantClear.OLEAUT32(?), ref: 007B95E7
SafeArrayDestroyData.OLEAUT32(?), ref: 007B95F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007B95FD
VariantClear.OLEAUT32(?), ref: 007B960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007B961A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: ecbc584bf6bb0466f4d38aed80a2d65e7e5538771d20a1fe9ffed6a27cdf7556
Instruction ID: ac90964c0913c82404d5b49cbc4bf3eaef432064a64c56e83a80e84f290ff888
Opcode Fuzzy Hash: ecbc584bf6bb0466f4d38aed80a2d65e7e5538771d20a1fe9ffed6a27cdf7556
Instruction Fuzzy Hash: 28412C75900219EFCB01EFE4DC88ADEBB79FF08354F108065E612A7261DB35EA45CBA5

Function 007DADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

CoInitialize.OLE32 ref: 007DADF6
CoUninitialize.OLE32 ref: 007DAE01
CoCreateInstance.OLE32(?,00000000,00000017,0080D8FC,?), ref: 007DAE61
IIDFromString.OLE32(?,?), ref: 007DAED4
VariantInit.OLEAUT32(?), ref: 007DAF6E
VariantClear.OLEAUT32(?), ref: 007DAFCF

Strings

Failed to create object, xrefs: 007DAE6C, 007DAF22
NULL Pointer assignment, xrefs: 007DAEA6
Invalid parameter, xrefs: 007DAEED

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 40d7d1c0250ee7679b4b657f00e427bbf114799f46dc21a579b05748b6714e61
Instruction ID: c0465111f63d5001b36487cc3a6c1e2d5da7c8e831d7bb5dfc3fa331b5f8ae5b
Opcode Fuzzy Hash: 40d7d1c0250ee7679b4b657f00e427bbf114799f46dc21a579b05748b6714e61
Instruction Fuzzy Hash: 69616671208301EFC710EF54C889B6ABBF8BF88714F14495AF9859B291C778ED48CB92

Function 007D8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007D8168
inet_addr.WSOCK32(?,?,?), ref: 007D81AD
gethostbyname.WSOCK32(?), ref: 007D81B9
IcmpCreateFile.IPHLPAPI ref: 007D81C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007D8237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007D824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007D82C2
WSACleanup.WSOCK32 ref: 007D82C8

Strings

Ping, xrefs: 007D81EB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 765ab8a37f0cb2d1b3810f746ef1e691d4c5c5b88bca10e71d594d018a70da38
Instruction ID: c34ddca00d147d2fe64286832266d79cf8f7b638a0ef582085e32adef710b1c8
Opcode Fuzzy Hash: 765ab8a37f0cb2d1b3810f746ef1e691d4c5c5b88bca10e71d594d018a70da38
Instruction Fuzzy Hash: 72517D31644700AFDB61AF64CC49B2ABBF4BF48320F04496AF955DB3A1DB78E905CB42

Function 007CE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CE396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 007CE40C
GetLastError.KERNEL32 ref: 007CE416
SetErrorMode.KERNEL32(00000000,READY), ref: 007CE483

Strings

UNKNOWN, xrefs: 007CE43B
NOTREADY, xrefs: 007CE442
READONLY, xrefs: 007CE44E
INVALID, xrefs: 007CE455
READY, xrefs: 007CE45C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 1bdfdef05581c448b2bced9b917cc90d45013bd2dfcab631ba94d41ab38e5d1b
Instruction ID: 1ba6d5949bbd8377e0f3ef82b6abe4f9771a13ad6e529af66c623fe5fc981c4a
Opcode Fuzzy Hash: 1bdfdef05581c448b2bced9b917cc90d45013bd2dfcab631ba94d41ab38e5d1b
Instruction Fuzzy Hash: 3D316135A40249EFDB05EBA4C849FADB7B4FF44300F14802DF515EB291DB789A42CB91

Function 007BB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 007BB98C
GetDlgCtrlID.USER32 ref: 007BB997
GetParent.USER32 ref: 007BB9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 007BB9B6
GetDlgCtrlID.USER32(?), ref: 007BB9BF
GetParent.USER32(?), ref: 007BB9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 007BB9DE

Strings

ListBox, xrefs: 007BB949
ComboBox, xrefs: 007BB911

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: bf70bf39528e74256c1e2a8df0d14c8be17ab143d211d71983c54e7be087a6a1
Instruction ID: 3eee3951f98da25576738a0a0ddfe03263650956b1c39fca9f45320a5dc26f35
Opcode Fuzzy Hash: bf70bf39528e74256c1e2a8df0d14c8be17ab143d211d71983c54e7be087a6a1
Instruction Fuzzy Hash: 2521A4B4A40204EFDB05ABA4CC85EFEBBB5EF55300F100115F961972A1DBB95815DB60

Function 007BB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 007BBA73
GetDlgCtrlID.USER32 ref: 007BBA7E
GetParent.USER32 ref: 007BBA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 007BBA9D
GetDlgCtrlID.USER32(?), ref: 007BBAA6
GetParent.USER32(?), ref: 007BBAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 007BBAC5

Strings

ListBox, xrefs: 007BBA32
ComboBox, xrefs: 007BB9FA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 1d4cd57aba0f48de7e622164c84a5f086a21bfcaa726c03d60bea333f23611bd
Instruction ID: 9ded3c6ad9176026aa23736d85480d0bfac711869c95776f8c120d5890186334
Opcode Fuzzy Hash: 1d4cd57aba0f48de7e622164c84a5f086a21bfcaa726c03d60bea333f23611bd
Instruction Fuzzy Hash: A62183B4A40204BFDB01ABA4CC85FFEBBB5FF55300F104015F961972A1DBB959199B60

Function 007BBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007BBAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 007BBAF8
_wcscmp.LIBCMT ref: 007BBB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 007BBB85

Strings

list, xrefs: 007BBB67
largeicons, xrefs: 007BBB19
details, xrefs: 007BBB33
smallicons, xrefs: 007BBB4D
SHELLDLL_DefView, xrefs: 007BBB04

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: a1a59e779e4934da9f65262630ec1a740f2a9b97a1fbc1735a57f5e18a84277c
Instruction ID: 3e84c88de032aa31472325703d1d25b4bac1d7d4c8a3e2b789c732431c6ee28c
Opcode Fuzzy Hash: a1a59e779e4934da9f65262630ec1a740f2a9b97a1fbc1735a57f5e18a84277c
Instruction Fuzzy Hash: 551106B6608317FEFA206634DC0AEE7379CEBA1720F200122FD15E50D5EBEE68214594

Function 007DB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007DB2D5
CoInitialize.OLE32(00000000), ref: 007DB302
CoUninitialize.OLE32 ref: 007DB30C
GetRunningObjectTable.OLE32(00000000,?), ref: 007DB40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 007DB539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 007DB56D
CoGetObject.OLE32(?,00000000,0080D91C,?), ref: 007DB590
SetErrorMode.KERNEL32(00000000), ref: 007DB5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 007DB623
VariantClear.OLEAUT32(0080D91C), ref: 007DB633

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 1de4a544a5178f3ef55fca698c2fd7c79d77ba13339417e5fa2fe1e3db3268e3
Instruction ID: ade932a046c020b8b0f45245a2dbce5917d01814976fd914303e040f37db1d7e
Opcode Fuzzy Hash: 1de4a544a5178f3ef55fca698c2fd7c79d77ba13339417e5fa2fe1e3db3268e3
Instruction Fuzzy Hash: 36C1E0B1608301EFC700EF64C884A6ABBE9BF89348F05495EF58A9B351DB75ED05CB52

Function 007AACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 007AACC1

Part of subcall function 007A7CF4: __mtinitlocknum.LIBCMT ref: 007A7D06
Part of subcall function 007A7CF4: EnterCriticalSection.KERNEL32(00000000,?,007A7ADD,0000000D), ref: 007A7D1F

__calloc_crt.LIBCMT ref: 007AACD2

Part of subcall function 007A6986: __calloc_impl.LIBCMT ref: 007A6995
Part of subcall function 007A6986: Sleep.KERNEL32(00000000,000003BC,0079F507,?,0000000E), ref: 007A69AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 007AACED
GetStartupInfoW.KERNEL32(?,00836E28,00000064,007A5E91,00836C70,00000014), ref: 007AAD46
__calloc_crt.LIBCMT ref: 007AAD91
GetFileType.KERNEL32(00000001), ref: 007AADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 007AAE11

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 79295dbd8f65716efd41893675a99865f9c1b408ea4ae1ca410df633e817a6eb
Instruction ID: c126863480864a37fb52ec95582fc18e0760d662f2a53f462e97591d21bc8e89
Opcode Fuzzy Hash: 79295dbd8f65716efd41893675a99865f9c1b408ea4ae1ca410df633e817a6eb
Instruction Fuzzy Hash: 0B81C271909355AFDB14CF68C8455ADBBF0BF8B320B24436DE4A6AB3D1D7389802CB52

Function 007C67E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007C67FD
__swprintf.LIBCMT ref: 007C680A

Part of subcall function 007A172B: __woutput_l.LIBCMT ref: 007A1784

FindResourceW.KERNEL32(?,?,0000000E), ref: 007C6834
LoadResource.KERNEL32(?,00000000), ref: 007C6840
LockResource.KERNEL32(00000000), ref: 007C684D
FindResourceW.KERNEL32(?,?,00000003), ref: 007C686D
LoadResource.KERNEL32(?,00000000), ref: 007C687F
SizeofResource.KERNEL32(?,00000000), ref: 007C688E
LockResource.KERNEL32(?), ref: 007C689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007C68F9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 49559ad6ec58bfacc12c3635ca19c2484e7bd188f9b973b446ec200ad39f714a
Instruction ID: 78b25f832accb51e6f2f869c97472128ae1a60ecd6c652c35a4d3b6ae061869c
Opcode Fuzzy Hash: 49559ad6ec58bfacc12c3635ca19c2484e7bd188f9b973b446ec200ad39f714a
Instruction Fuzzy Hash: 50315E7590021AABDB119FA0DD99EBA7BA9FF09341F004429F912D2150E778D951DBA0

Function 007FDD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0079B496
SetTextColor.GDI32(?,000000FF), ref: 0079B4A0
SetBkMode.GDI32(?,00000001), ref: 0079B4B5
GetStockObject.GDI32(00000005), ref: 0079B4BD
GetClientRect.USER32(?), ref: 007FDD63
SendMessageW.USER32(?,00001328,00000000,?), ref: 007FDD7A
GetWindowDC.USER32(?), ref: 007FDD86
GetPixel.GDI32(00000000,?,?), ref: 007FDD95
ReleaseDC.USER32(?,00000000), ref: 007FDDA7
GetSysColor.USER32(00000005), ref: 007FDDC5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 45ec083f64cd750b93fc51e7ef5e3f49acee105e18ee44bc3bf38f661546f281
Instruction ID: cb1ee01cfaa9c886cf13ed83146df824f4f5fb80e6efe102cadefea774adafc6
Opcode Fuzzy Hash: 45ec083f64cd750b93fc51e7ef5e3f49acee105e18ee44bc3bf38f661546f281
Instruction Fuzzy Hash: EA115B31500345EFDBA16FE4EC09BA97F62FB09325F108625FA66951F2CB360951EF21

Function 007BCB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,007BCF50), ref: 007BCE90

Strings

NAME, xrefs: 007BCCC2
CLASS, xrefs: 007BCC10
INSTANCE, xrefs: 007BCD9E
REGEXPCLASS, xrefs: 007BCC56
CLASSNN, xrefs: 007BCC33
TEXT, xrefs: 007BCDC7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 8cc2315ff0ee3244406d36db4054c46cbecaea4ff9243b774fed2c0f72b13c07
Instruction ID: 9e2dbd4e77a48483d126c01a705194db252bdf70167d8a0ac56359229175625b
Opcode Fuzzy Hash: 8cc2315ff0ee3244406d36db4054c46cbecaea4ff9243b774fed2c0f72b13c07
Instruction Fuzzy Hash: 1291A030A00606EADB19EFA0C486BEAFB75FF05300F50C559E559E7241DF38A95ACBE0

Function 00783093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007830DC
CoUninitialize.OLE32(?,00000000), ref: 00783181
UnregisterHotKey.USER32(?), ref: 007832A9
DestroyWindow.USER32(?), ref: 007F5079
FreeLibrary.KERNEL32(?), ref: 007F50F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 007F5125

Strings

close all, xrefs: 007830D7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 80df1c514e3412e243cac68830b31b7ad331a065af0b6b5236ec2cdf3c41d12b
Instruction ID: ad37ef0f0b456eb6bd27cdda1de1b96de315df54b7ec17b224e9320647956b5b
Opcode Fuzzy Hash: 80df1c514e3412e243cac68830b31b7ad331a065af0b6b5236ec2cdf3c41d12b
Instruction Fuzzy Hash: 73914C70640606CFC715FF68C899E68F3A4FF15B04F5482A9E50AA7262DF38AE56CF50

Function 0079CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0079CC15

Part of subcall function 0079CCCD: GetClientRect.USER32(?,?), ref: 0079CCF6
Part of subcall function 0079CCCD: GetWindowRect.USER32(?,?), ref: 0079CD37
Part of subcall function 0079CCCD: ScreenToClient.USER32(?,?), ref: 0079CD5F

GetDC.USER32 ref: 007FD137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 007FD14A
SelectObject.GDI32(00000000,00000000), ref: 007FD158
SelectObject.GDI32(00000000,00000000), ref: 007FD16D
ReleaseDC.USER32(?,00000000), ref: 007FD175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 007FD200

Strings

U, xrefs: 007FD0D5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 3006c51c05a632e9f9fca64910a9faee188690a98848b49f738c0fcc09ac033b
Instruction ID: dd2385784f840400a8a98efc1be2ca8225c78238e12427e984302825a8d4c754
Opcode Fuzzy Hash: 3006c51c05a632e9f9fca64910a9faee188690a98848b49f738c0fcc09ac033b
Instruction Fuzzy Hash: 2F71CE3040020DEFCF329F64D885ABA7BB6FF59310F144269EE655A2A6C7398C81DF60

Function 007EECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

Part of subcall function 0079B63C: GetCursorPos.USER32(000000FF), ref: 0079B64F
Part of subcall function 0079B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0079B66C
Part of subcall function 0079B63C: GetAsyncKeyState.USER32(00000001), ref: 0079B691
Part of subcall function 0079B63C: GetAsyncKeyState.USER32(00000002), ref: 0079B69F

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 007EED3C
ImageList_EndDrag.COMCTL32 ref: 007EED42
ReleaseCapture.USER32 ref: 007EED48
SetWindowTextW.USER32(?,00000000), ref: 007EEDF0
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 007EEE03
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 007EEEDC

Strings

@GUI_DROPID, xrefs: 007EEE33
@GUI_DRAGFILE, xrefs: 007EEE77

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 0ff51e62b69362e7b4afdb07370e9df35157b761b3e68ced29575e391462f254
Instruction ID: 112aaae9e9bfb2e117f7b4a1abcd55b7cfcace4d5faba36ed52125f0a00ed2de
Opcode Fuzzy Hash: 0ff51e62b69362e7b4afdb07370e9df35157b761b3e68ced29575e391462f254
Instruction Fuzzy Hash: E7519974245344AFEB10EF20DC9AF6A77E4FB98304F00491DF595972E2DB78A944CB62

Function 007D45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007D45FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 007D462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 007D466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 007D4682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007D468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007D46BF
InternetCloseHandle.WININET(00000000), ref: 007D4706

Part of subcall function 007D5052: GetLastError.KERNEL32(?,?,007D43CC,00000000,00000000,00000001), ref: 007D5067

Strings

, xrefs: 007D46B8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: d5145cdd1caf1f1381e40952701496f29adf0d071b09954cf97d5a0efa16180b
Instruction ID: 1975b9694e80bcf473427611fce248eb0608d6613ab9e5a56e85c61b1094c2e5
Opcode Fuzzy Hash: d5145cdd1caf1f1381e40952701496f29adf0d071b09954cf97d5a0efa16180b
Instruction Fuzzy Hash: B2414DB1501205BFEB129FA4CC89FBB77BCFF09754F104126FA069A291D7B8D9448BA4

Function 007DB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0081DC00), ref: 007DB715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0081DC00), ref: 007DB749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 007DB8C1
SysFreeString.OLEAUT32(?), ref: 007DB8EB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 577af75b87dd6389608f9ee648cba286896671c888d37908601ce13567a5dbf6
Instruction ID: 26ec190903913b8d6f992981ec4a9d3be9f8ff94c25c57da9ff4a45e0f9ceacf
Opcode Fuzzy Hash: 577af75b87dd6389608f9ee648cba286896671c888d37908601ce13567a5dbf6
Instruction Fuzzy Hash: CCF13D75A00209EFCF04DFA4C888EAEB7B9FF89315F118459F905AB250DB35AE45CB90

Function 007E24D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E24F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007E2688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007E26AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007E26EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007E270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007E286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007E28A1
CloseHandle.KERNEL32(?), ref: 007E28D0
CloseHandle.KERNEL32(?), ref: 007E2947

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 8a6673456897e535265e5c0c5f0c46e4803e38f899abce8f58b863ad8eb376cb
Instruction ID: 2eef0511e608d39e50ad70bf80823548df759eee1d0d7537ee22e81fd92974d3
Opcode Fuzzy Hash: 8a6673456897e535265e5c0c5f0c46e4803e38f899abce8f58b863ad8eb376cb
Instruction Fuzzy Hash: 22D1D231205340DFCB15EF25C855B6ABBE9BF88310F14855DF9999B2A2DB38DC41CB52

Function 007EB33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 007EB3F4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 53c45ec61463d8132e91ba1a0b009f2413e0d5bcbb22caa026d1ba19f40b944a
Instruction ID: c37beb6911e63c09213c31d0fc73b8bddad8a746ea0c8de14cd6bcfa6bfbc270
Opcode Fuzzy Hash: 53c45ec61463d8132e91ba1a0b009f2413e0d5bcbb22caa026d1ba19f40b944a
Instruction Fuzzy Hash: 70518230602284FBEF209F6ADCCABAE3F64FB0A714F644011F615D61E2D779E9509B51

Function 0079A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 007FDB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 007FDB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 007FDB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 007FDB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 007FDB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0079A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 007FDBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 007FDBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0079A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 007FDBC8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: ba5e2999c821cf0eb3e8f5a3de9185f10ff3a41e836dcac28fb83b79586003a5
Instruction ID: 3284f2c4fa3eef93753079f36cebac0a1b7c9d5861d15f68798e696412b632ed
Opcode Fuzzy Hash: ba5e2999c821cf0eb3e8f5a3de9185f10ff3a41e836dcac28fb83b79586003a5
Instruction Fuzzy Hash: E5516670601209EFDF20DFA8DC86FAA37B9FB58754F110518FA4696290D7B8AC80DB90

Function 007C7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007C6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007C5FA6,?), ref: 007C6ED8

Part of subcall function 007C6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007C5FA6,?), ref: 007C6EF1

Part of subcall function 007C72CB: GetFileAttributesW.KERNEL32(?,007C6019), ref: 007C72CC

lstrcmpiW.KERNEL32(?,?), ref: 007C75CA
_wcscmp.LIBCMT ref: 007C75E2
MoveFileW.KERNEL32(?,?), ref: 007C75FB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 741f60dcacf1a388940377a289b7fb09c01cd39764c5a2aa147d2dba93bfd2b1
Instruction ID: 59b09b80e3fe61c7833f27458e05de9752597cd3cbfa0b2d7438a030d089933f
Opcode Fuzzy Hash: 741f60dcacf1a388940377a289b7fb09c01cd39764c5a2aa147d2dba93bfd2b1
Instruction Fuzzy Hash: 965132B2A092199EDF54EB94D885EDD73BCAF48320F00459EF605E3141EA7896C5CF74

Function 0079EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,007FDAD1,00000004,00000000,00000000), ref: 0079EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,007FDAD1,00000004,00000000,00000000), ref: 0079EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,007FDAD1,00000004,00000000,00000000), ref: 007FDC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,007FDAD1,00000004,00000000,00000000), ref: 007FDCF2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0b74172a46cdc9488a48bfa65d3ddb8380c7788979f0bb2f2808aa3a38f32738
Instruction ID: 2afb9cd4f7f241ded3deacfcdfce5a80d26b59004e125889804e5703789766b5
Opcode Fuzzy Hash: 0b74172a46cdc9488a48bfa65d3ddb8380c7788979f0bb2f2808aa3a38f32738
Instruction Fuzzy Hash: B141E6B1215380DEDF75CB28AD8DE3A7AA7FB55305F19440DE28782A61D67DAC80D321

Function 007BB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,007BAEF1,00000B00,?,?), ref: 007BB26C
HeapAlloc.KERNEL32(00000000,?,007BAEF1,00000B00,?,?), ref: 007BB273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,007BAEF1,00000B00,?,?), ref: 007BB288
GetCurrentProcess.KERNEL32(?,00000000,?,007BAEF1,00000B00,?,?), ref: 007BB290
DuplicateHandle.KERNEL32(00000000,?,007BAEF1,00000B00,?,?), ref: 007BB293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,007BAEF1,00000B00,?,?), ref: 007BB2A3
GetCurrentProcess.KERNEL32(007BAEF1,00000000,?,007BAEF1,00000B00,?,?), ref: 007BB2AB
DuplicateHandle.KERNEL32(00000000,?,007BAEF1,00000B00,?,?), ref: 007BB2AE
CreateThread.KERNEL32(00000000,00000000,007BB2D4,00000000,00000000,00000000), ref: 007BB2C8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: b84a492c391f69425708835290c8039c82b7da82af14b7cc84c09f655a9b97d9
Instruction ID: 05aee5084555021fa1adcac5655103e0c258e15fa5e30059c62029473e95e09b
Opcode Fuzzy Hash: b84a492c391f69425708835290c8039c82b7da82af14b7cc84c09f655a9b97d9
Instruction Fuzzy Hash: 1001CDB6240304BFE750AFA5DC4EF6B7BACFB88711F018415FA05DB2A1DA749800CB61

Function 007DC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 007DC49E
NULL Pointer assignment, xrefs: 007DC876, 007DC887

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 1f1530be79d87e7b2d845c8e6d14e489e9209012238f219f7618ceeff66917dc
Instruction ID: a759bb6d0d196d088c4e8ea93e16e3bc63d9e45732bfe44e921e0ff28eba2a25
Opcode Fuzzy Hash: 1f1530be79d87e7b2d845c8e6d14e489e9209012238f219f7618ceeff66917dc
Instruction Fuzzy Hash: 0EE1A171A0021AABDF15DFA4D985FAE77B5EF48314F14802AF905AB381D778ED41CB90

Function 007DBB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DBB5C
VariantInit.OLEAUT32(?), ref: 007DBC2D
VariantInit.OLEAUT32(?), ref: 007DBD2E
VariantClear.OLEAUT32(?), ref: 007DBD38
VariantClear.OLEAUT32(?), ref: 007DBD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 007DBBBD, 007DBCEB, 007DBDA7
Incorrect Object type in FOR..IN loop, xrefs: 007DBD11

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 0a73661d7a477264a0cdb6c0a02c7615e51ee0bf5ff4a64830d0a0ec46f9eb40
Instruction ID: 1033cf3cad50d05634d54a9e438e592b8affe67aa935a2bad11e028c17ebe9d6
Opcode Fuzzy Hash: 0a73661d7a477264a0cdb6c0a02c7615e51ee0bf5ff4a64830d0a0ec46f9eb40
Instruction Fuzzy Hash: BC918071A00215EBDF24CFA5C848FAEBBB9FF85710F11855AF515AB380DB789944CBA0

Function 007E9A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 007E9B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 007E9B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 007E9B47
_wcscat.LIBCMT ref: 007E9BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 007E9BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007E9BE7

Strings

SysListView32, xrefs: 007E9AEB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 76f1768f562ef8153e4f73c0898a0f783658296d927eaf1277e620f36e271889
Instruction ID: c0f2eb58dede30fb98f2278f4a870d68a68098d53a3232293de1b74c28ed54e2
Opcode Fuzzy Hash: 76f1768f562ef8153e4f73c0898a0f783658296d927eaf1277e620f36e271889
Instruction Fuzzy Hash: 9C41A071A00348EBDB219FA4DC89BEE77A8EF0C354F10452AF645E7291D6799D84CB60

Function 007E172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 007C6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 007C6554
Part of subcall function 007C6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 007C6564
Part of subcall function 007C6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 007C65F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 007E179A
GetLastError.KERNEL32 ref: 007E17AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007E17D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 007E1855
GetLastError.KERNEL32(00000000), ref: 007E1860
CloseHandle.KERNEL32(00000000), ref: 007E1895

Strings

SeDebugPrivilege, xrefs: 007E17B8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f5976505ea0919fc0a13b4e01f53812533e21e817b61b0a6ec2329b79d8267da
Instruction ID: d9dec85c16cd436a4baae4843ed1b22d2b5ff68f544e0379ebaf19bc0ff3f00c
Opcode Fuzzy Hash: f5976505ea0919fc0a13b4e01f53812533e21e817b61b0a6ec2329b79d8267da
Instruction Fuzzy Hash: 9741AE72601200EFDB05EF98C8AAF6DB7A5AF48710F05805CF9069F2C2DB78A9058B91

Function 007C5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007C58B8

Strings

stop, xrefs: 007C5889
question, xrefs: 007C5871
blank, xrefs: 007C583A
info, xrefs: 007C5859
warning, xrefs: 007C58A1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9f2b048196a59af308f614253cb0a86c085b4b32ac10866440fa68cbf93216a1
Instruction ID: 6279a9542e2365296a8425ff4239adcf6b36a91e70c67b37f89d5f9656b8db70
Opcode Fuzzy Hash: 9f2b048196a59af308f614253cb0a86c085b4b32ac10866440fa68cbf93216a1
Instruction Fuzzy Hash: 8B110D35209B43FEEB015B549C82E6A23DCEF65320F20003EF510F5281F76DBA8043A4

Function 007CA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 007CA806

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: ca647d33679d441e11c98582782cf729d11ccbf4765b63a3bf75c246d5abe87a
Instruction ID: 2b2515698d483feafc929ef803d8894433eed39f42c72e9bf7ea910cbc100ca4
Opcode Fuzzy Hash: ca647d33679d441e11c98582782cf729d11ccbf4765b63a3bf75c246d5abe87a
Instruction Fuzzy Hash: CBC17C75A0421AEFDB00CF98D485BAEB7F4FF0831AF20806DE606E7251D738A941CB95

Function 007C6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 007C6B63
LoadStringW.USER32(00000000), ref: 007C6B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 007C6B80
LoadStringW.USER32(00000000), ref: 007C6B87
_wprintf.LIBCMT ref: 007C6BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007C6BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 007C6BA8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 2ed81b9ec55381bbd14af62b303bdaadb8ea0df7da21a3a0a4d87021c66063f6
Instruction ID: 1fe525dac007d5fe6e8b2bf8a8963fbadc83898256fe576da56c32203ac6c769
Opcode Fuzzy Hash: 2ed81b9ec55381bbd14af62b303bdaadb8ea0df7da21a3a0a4d87021c66063f6
Instruction Fuzzy Hash: 62011DF6900318BFEB51ABE49D89EE6776CEB08304F0044A5BB46E2141EA749E848B74

Function 007E2B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E2BB5,?,?), ref: 007E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E2BF6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: f98590546d978a6ebaf70dd5aed0af49d44dd678203b0ad87d035f950bccd767
Instruction ID: fd51a082f385538fc3de3c524b8af9d31021486273fd833cf2cc200999dd31ae
Opcode Fuzzy Hash: f98590546d978a6ebaf70dd5aed0af49d44dd678203b0ad87d035f950bccd767
Instruction Fuzzy Hash: AE917C71605200EFCB01EF55C899F6EB7E9BF48310F14881DF956972A2DB38E906CB51

Function 007D95BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 007D9691
WSAGetLastError.WSOCK32(00000000), ref: 007D969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 007D96C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007D96E9
WSAGetLastError.WSOCK32(00000000), ref: 007D96F8
htons.WSOCK32(?,?,?,00000000,?), ref: 007D97AA
inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,0081DC00), ref: 007D9765

Part of subcall function 007BD2FF: _strlen.LIBCMT ref: 007BD309

_strlen.LIBCMT ref: 007D9800

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorLast_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3480843537-0
Opcode ID: b144a7e84e2d9ec0422993ded7012f91a8c035fa0909168941b0e883e027f071
Instruction ID: 12b9c53ca26c85fade1fc1e200fab4a2ce12dad7e8211db79c4935ab76ad5165
Opcode Fuzzy Hash: b144a7e84e2d9ec0422993ded7012f91a8c035fa0909168941b0e883e027f071
Instruction Fuzzy Hash: 4F819B71504240EBC720EF64DC89E6BBBB9EF85714F104A1EF6559B291EB38DD04CBA2

Function 007AA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 007AA991

Part of subcall function 007A7D7C: __FF_MSGBANNER.LIBCMT ref: 007A7D91
Part of subcall function 007A7D7C: __NMSG_WRITE.LIBCMT ref: 007A7D98
Part of subcall function 007A7D7C: __malloc_crt.LIBCMT ref: 007A7DB8

__lock.LIBCMT ref: 007AA9A4
__lock.LIBCMT ref: 007AA9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00836DE0,00000018,007B5E7B,?,00000000,00000109), ref: 007AAA0C
EnterCriticalSection.KERNEL32(8000000C,00836DE0,00000018,007B5E7B,?,00000000,00000109), ref: 007AAA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 007AAA39

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 18645e8c0fc6ae8e59c86275237f5fe27c7e278a8dd990190760f919de327f5c
Instruction ID: 28c982e330147bc113ff3aa015b632d9c82ee5a95dccea6150eaf794eb74ec37
Opcode Fuzzy Hash: 18645e8c0fc6ae8e59c86275237f5fe27c7e278a8dd990190760f919de327f5c
Instruction Fuzzy Hash: 1641F471A00706ABEB149F68DA4475DBBE0BF83325F14C319E525AB2D2DB7C9940CB92

Function 007E8ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 007E8EE4
GetDC.USER32(00000000), ref: 007E8EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007E8EF7
ReleaseDC.USER32(00000000,00000000), ref: 007E8F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 007E8F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 007E8F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,007EBD19,?,?,000000FF,00000000,?,000000FF,?), ref: 007E8F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 007E8FAA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 38cefe079147cda87b7948fb24a9f257a71072e8a501fb5680e818506ac727cf
Instruction ID: 8b3aa0cc23030525213fa9ef4e080a7acf9b8af2fd653673ba81d1aa054ac760
Opcode Fuzzy Hash: 38cefe079147cda87b7948fb24a9f257a71072e8a501fb5680e818506ac727cf
Instruction Fuzzy Hash: 3B316D72201654BFEB508F95CC49FEA3BA9FF49715F044065FE089A191CA799841CBB0

Function 007D16DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

Part of subcall function 0079C6F4: _wcscpy.LIBCMT ref: 0079C717

_wcstok.LIBCMT ref: 007D184E
_wcscpy.LIBCMT ref: 007D18DD
_memset.LIBCMT ref: 007D1910

Strings

X, xrefs: 007D1948

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 6af7a29cc492e1a5b173364164e6ed825834d79826f1ee267193369b4c0c4efd
Instruction ID: f0f9f02960b9df328f67df9255e071eed997db309b9825067bc214537d957aef
Opcode Fuzzy Hash: 6af7a29cc492e1a5b173364164e6ed825834d79826f1ee267193369b4c0c4efd
Instruction Fuzzy Hash: 79C15C71604340EFC724EF64C899A5AB7E4BF85350F44892DF899973A2DB38ED05CB82

Function 007F0133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

GetSystemMetrics.USER32(0000000F), ref: 007F016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 007F038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007F03AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 007F03D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007F03FF
ShowWindow.USER32(00000003,00000000), ref: 007F0421
DefDlgProcW.USER32(?,00000005,?,?), ref: 007F0440

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: 9e7846fc64dd1dbe3e6dd0e5dc9a62d050442a5b3ce22252831de8d90e94037f
Instruction ID: 4c0c9220b7245d66c355603051a8f8d4caa71f06ece420a8af8c12fe3f69ec3b
Opcode Fuzzy Hash: 9e7846fc64dd1dbe3e6dd0e5dc9a62d050442a5b3ce22252831de8d90e94037f
Instruction Fuzzy Hash: 4AA19E7560061AEFDB18CF68C9897BDBBB1BF48741F048119EE54AB392D738AD50CB90

Function 0079AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff62f430372c9727a53d76648ec0636f26a172dc53f3dd6d3023a7a1dba2bfe8
Instruction ID: 19ebc0ec9104a26e492ba4ce731b56b2b501cdfe710e8ae9f04b7ce73f928cd2
Opcode Fuzzy Hash: ff62f430372c9727a53d76648ec0636f26a172dc53f3dd6d3023a7a1dba2bfe8
Instruction Fuzzy Hash: 3E7177B1901509FFCF14CF98DC89ABEBB79FF85310F248159F915AA250C738AA01CBA1

Function 007E2230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E225A
_memset.LIBCMT ref: 007E2323
ShellExecuteExW.SHELL32(?), ref: 007E2368

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

Part of subcall function 0079C6F4: _wcscpy.LIBCMT ref: 0079C717

CloseHandle.KERNEL32(00000000), ref: 007E242F
FreeLibrary.KERNEL32(00000000), ref: 007E243E

Strings

@, xrefs: 007E2334

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: 9859c98384acaa9d61125f94a0e93c37060d45f99465eb68f50c9d6f7e04f744
Instruction ID: 92096eea4273c037a7b94c8a3fd58227bc406f66d9a9b66a32ef339e3dfa2aef
Opcode Fuzzy Hash: 9859c98384acaa9d61125f94a0e93c37060d45f99465eb68f50c9d6f7e04f744
Instruction Fuzzy Hash: 10718D71A00659DFCF05EFA5D8859AEBBF9FF48310F108459E845AB392DB38AD01CB90

Function 007C3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 007C3C02
GetKeyboardState.USER32(?), ref: 007C3C17
SetKeyboardState.USER32(?), ref: 007C3C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 007C3CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 007C3CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 007C3D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 007C3D26

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b3b42ad00aadbb3b051fd99ef6b6f8e15d39d2191a0ea2c909c40580370372b8
Instruction ID: 094b1cb5f7da618f58ba65913fc9722a4388c348f0dcf644709ca1145fb9d145
Opcode Fuzzy Hash: b3b42ad00aadbb3b051fd99ef6b6f8e15d39d2191a0ea2c909c40580370372b8
Instruction Fuzzy Hash: A051D4A06047D53DFB3687648C55FBABFA96B06300F0CC48DE0D65A8C2D699EE84E760

Function 007E3D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 007E3DA1
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007E3DCB
FreeLibrary.KERNEL32(00000000), ref: 007E3E80

Part of subcall function 007E3D72: RegCloseKey.ADVAPI32(?), ref: 007E3DE8
Part of subcall function 007E3D72: FreeLibrary.KERNEL32(?), ref: 007E3E3A
Part of subcall function 007E3D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 007E3E5D

RegDeleteKeyW.ADVAPI32(?,?), ref: 007E3E25

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d791101103690f29f226e33c27dd63e5bb29ca2b4c46ba3048a48c68f06e065e
Instruction ID: ed3e51de05946d0c06760876a8ddddb9d8de2e08ef02f4825ed795d0d71fa969
Opcode Fuzzy Hash: d791101103690f29f226e33c27dd63e5bb29ca2b4c46ba3048a48c68f06e065e
Instruction Fuzzy Hash: F431EAB1902249BFDB559BD5DC89AFFB7BCEF0C300F00416AE512A3150DA749F899BA0

Function 007E8FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 007E8FE7
GetWindowLongW.USER32(0150D898,000000F0), ref: 007E901A
GetWindowLongW.USER32(0150D898,000000F0), ref: 007E904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 007E9081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007E90AB
GetWindowLongW.USER32(00000000,000000F0), ref: 007E90BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007E90D6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: cb3b14dd83ada5a202b64851d8d1cd320f5b1a1125098743ab810b59e6c1cd20
Instruction ID: 1f1833b3ab26888d17089b7c71fe3aa111787086e4985058ad203c6fd944e631
Opcode Fuzzy Hash: cb3b14dd83ada5a202b64851d8d1cd320f5b1a1125098743ab810b59e6c1cd20
Instruction Fuzzy Hash: 68313376701256EFDB608F99DC88F6437A5FB5A314F150164F6198F2B2CB76A840CB81

Function 007C08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007C08F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007C0918
SysAllocString.OLEAUT32(00000000), ref: 007C091B
SysAllocString.OLEAUT32(?), ref: 007C0939
SysFreeString.OLEAUT32(?), ref: 007C0942
StringFromGUID2.OLE32(?,?,00000028), ref: 007C0967
SysAllocString.OLEAUT32(?), ref: 007C0975

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 92baef40a8db50b724bf10f7d73bf59a47472b877fa000cf836e4342427cd97f
Instruction ID: 12a411b112f435d711cd1629e174ca60796eea73674e4bc97d6583f044dd6280
Opcode Fuzzy Hash: 92baef40a8db50b724bf10f7d73bf59a47472b877fa000cf836e4342427cd97f
Instruction Fuzzy Hash: C2217F76601219EFEF109BA8DC88EBB73ECFB09360B408129F915DB161D674EC458BE4

Function 007C2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007C2485
__wcsnicmp.LIBCMT ref: 007C24A6
__wcsnicmp.LIBCMT ref: 007C24C0

Strings

#requireadmin, xrefs: 007C24A0
#notrayicon, xrefs: 007C247D
#OnAutoItStartRegister, xrefs: 007C24BA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 41de88704759878bac95d7b6f6e80e78dfbf9bb4fba03dba8bfb86b125163937
Instruction ID: 226e9a5f66621710d5462a79853886c1ca3f1c97524a267bc47131e0d34f5bb0
Opcode Fuzzy Hash: 41de88704759878bac95d7b6f6e80e78dfbf9bb4fba03dba8bfb86b125163937
Instruction Fuzzy Hash: C6217932200251A7D725BA34AC16FBB739CEFA5310F60802DF446D7183E66D9E93C3A0

Function 007C0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007C09CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007C09F1
SysAllocString.OLEAUT32(00000000), ref: 007C09F4
SysAllocString.OLEAUT32 ref: 007C0A15
SysFreeString.OLEAUT32 ref: 007C0A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 007C0A38
SysAllocString.OLEAUT32(?), ref: 007C0A46

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 806896f3832a1a14225ed544638a810f31d57f06b9542603a04969b323a2c74a
Instruction ID: c91406bfea6537d8483494cc05ed2fbe95d64f775195905359a5c2e0e4011592
Opcode Fuzzy Hash: 806896f3832a1a14225ed544638a810f31d57f06b9542603a04969b323a2c74a
Instruction Fuzzy Hash: 52213275600204EFDB109BE8DC89EAE77ECFF08360740C129F949CB261D674EC4187A4

Function 007EA2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0079D1BA
Part of subcall function 0079D17C: GetStockObject.GDI32(00000011), ref: 0079D1CE
Part of subcall function 0079D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0079D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 007EA32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 007EA33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 007EA345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 007EA354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 007EA360

Strings

Msctls_Progress32, xrefs: 007EA2FE

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 59437dcfe32604ec041430bad15960f880d876c0f7e4d3dffc33e3d0fceac95d
Instruction ID: bcd8f6f56374608efd5cf18067dcc35a67907cf5fd0f6faa9acd964af26159df
Opcode Fuzzy Hash: 59437dcfe32604ec041430bad15960f880d876c0f7e4d3dffc33e3d0fceac95d
Instruction Fuzzy Hash: FF1190B115021DBEEF115FA1CC85EEB7F6DFF09798F014115BA08A60A0C676AC21DBA4

Function 0079CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0079CCF6
GetWindowRect.USER32(?,?), ref: 0079CD37
ScreenToClient.USER32(?,?), ref: 0079CD5F
GetClientRect.USER32(?,?), ref: 0079CE8C
GetWindowRect.USER32(?,?), ref: 0079CEA5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 3aae3156a5358daa1fad2e2a8e046297386c6379f5ae6cb3486d4e2336e1573c
Instruction ID: a3caf7cd8effd1453852f4c8c50bc895b185922f55b0c924b3f69938bfc42115
Opcode Fuzzy Hash: 3aae3156a5358daa1fad2e2a8e046297386c6379f5ae6cb3486d4e2336e1573c
Instruction Fuzzy Hash: ADB16C79A00249DBDF11CFA8C5807EDBBB1FF08310F149529ED5AEB254DB38AA50CB64

Function 007E1BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 007E1C18
Process32FirstW.KERNEL32(00000000,?), ref: 007E1C26
__wsplitpath.LIBCMT ref: 007E1C54

Part of subcall function 007A1DFC: __wsplitpath_helper.LIBCMT ref: 007A1E3C

_wcscat.LIBCMT ref: 007E1C69
Process32NextW.KERNEL32(00000000,?), ref: 007E1CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 007E1CF1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: 7de589d382cee9193ba09fb3e3d96206dfc0c6bdeb74bb9d555bbe1466000ffe
Instruction ID: 8047d47e0fe3a9990237d9de02739dfb04ee75669dad12af94064463b14bbe18
Opcode Fuzzy Hash: 7de589d382cee9193ba09fb3e3d96206dfc0c6bdeb74bb9d555bbe1466000ffe
Instruction Fuzzy Hash: 6B516DB1104340AFD720EF64DC86EABBBE8EF88754F40491EF58697251EB74D904CBA2

Function 007E2FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E2BB5,?,?), ref: 007E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E30AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007E30EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 007E3112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 007E313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 007E317E
RegCloseKey.ADVAPI32(00000000), ref: 007E318B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: cd76c01e873549a73b991b2ba79fce04ed52a2011ccd76a0360be63bdb07afd8
Instruction ID: f22d9b8a4ffed761d9d4e7949fa2395eae4f09ea04120d28293fd028e7b0b97b
Opcode Fuzzy Hash: cd76c01e873549a73b991b2ba79fce04ed52a2011ccd76a0360be63bdb07afd8
Instruction Fuzzy Hash: CE516831208344EFC701EF64C899E6ABBE9FF88304F04491DF5558B2A1DB79EA05CB52

Function 007E84DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 007E8540
GetMenuItemCount.USER32(00000000), ref: 007E8577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007E859F
GetMenuItemID.USER32(?,?), ref: 007E860E
GetSubMenu.USER32(?,?), ref: 007E861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 007E866D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 5200a1f33cfd31db427824a0a09bd6734cf1dd99b7f13b86c26fac1b644c8b42
Instruction ID: 1e5937cc5e28dbbf2b58d4b23d92250cfd9687c8137612c6c328816b4287f781
Opcode Fuzzy Hash: 5200a1f33cfd31db427824a0a09bd6734cf1dd99b7f13b86c26fac1b644c8b42
Instruction Fuzzy Hash: D2519C31A01615EFCF41EFA5C845AAEB7F4BF48310F144459E91ABB352CF38AE418B91

Function 007C4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C4B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C4B5B
IsMenu.USER32(00000000), ref: 007C4B7B
CreatePopupMenu.USER32 ref: 007C4BAF
GetMenuItemCount.USER32(000000FF), ref: 007C4C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 007C4C3E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 3b651d6eeaebd0aea6b782f21d69d839edc5920c9c2527627964210edb886037
Instruction ID: a9d0e250761264f7924565d9256d8785e1322a6b388ab92de32fd45c4f62849b
Opcode Fuzzy Hash: 3b651d6eeaebd0aea6b782f21d69d839edc5920c9c2527627964210edb886037
Instruction Fuzzy Hash: 0351BCB0602309EBDF20CF68C898FADBBF4AF45318F14415DE8259B2A1D3799D44CB61

Function 007D8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0081DC00), ref: 007D8E7C
WSAGetLastError.WSOCK32(00000000), ref: 007D8E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 007D8EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 007D8EC5
_strlen.LIBCMT ref: 007D8EF7
WSAGetLastError.WSOCK32(00000000), ref: 007D8F6A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: dc937721dd1f587811ac625a00075380e4a4409b545a2fe1a8b065e92b06b798
Instruction ID: 805f4237e6af0ce7904c4b6753c074a920c031cccd968b88db9850fac416945f
Opcode Fuzzy Hash: dc937721dd1f587811ac625a00075380e4a4409b545a2fe1a8b065e92b06b798
Instruction Fuzzy Hash: 3C41AF71500204EBCB54EBA4CD9AEAEB7B9AF48314F10465AF51A97291DF38AE00CB61

Function 0079ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

BeginPaint.USER32(?,?,?), ref: 0079AC2A
GetWindowRect.USER32(?,?), ref: 0079AC8E
ScreenToClient.USER32(?,?), ref: 0079ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0079ACBC
EndPaint.USER32(?,?,?,?,?), ref: 0079AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 007FE673

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: ca2eedc5706930b3a0b12159098bb0328eb0d6032cb0f9aa582221e46a50599a
Instruction ID: f73d41ae04ffda5112a71d6d0718b001b61f4e059ca0554c757b775a541cdc5b
Opcode Fuzzy Hash: ca2eedc5706930b3a0b12159098bb0328eb0d6032cb0f9aa582221e46a50599a
Instruction Fuzzy Hash: 0D41B774105305AFCF10DF54DC88F767BE8FB66320F140669FA64872A1D7399885DBA2

Function 007EE397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00841628,00000000,00841628,00000000,00000000,00841628,?,007FDC5D,00000000,?,00000000,00000000,00000000,?,007FDAD1,00000004), ref: 007EE40B
EnableWindow.USER32(00000000,00000000), ref: 007EE42F
ShowWindow.USER32(00841628,00000000), ref: 007EE48F
ShowWindow.USER32(00000000,00000004), ref: 007EE4A1
EnableWindow.USER32(00000000,00000001), ref: 007EE4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 007EE4E8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: d5f62d2339e46b68471009f7e0d3e5095d1bb4f3b6980b7046cf615111be490a
Instruction ID: a3eb220c4fed440767046e1e6ee2763a8b3da9e8fb7927ae61b44f39a233368c
Opcode Fuzzy Hash: d5f62d2339e46b68471009f7e0d3e5095d1bb4f3b6980b7046cf615111be490a
Instruction Fuzzy Hash: 78416F306025C0EFDB22CF65C499B947BE1BF0A304F1885A9FA588F2E2C739A841CB51

Function 007C98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007C98D1

Part of subcall function 0079F4EA: std::exception::exception.LIBCMT ref: 0079F51E
Part of subcall function 0079F4EA: __CxxThrowException@8.LIBCMT ref: 0079F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 007C9908
EnterCriticalSection.KERNEL32(?), ref: 007C9924
LeaveCriticalSection.KERNEL32(?), ref: 007C999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007C99B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 007C99D2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: b8489804e60ae11b33167e6aecc231957128dbd16094889376f14530d4b560d6
Instruction ID: 5f20c0b5022a647e55326490f6e2421596e2dea330018ff86f8c5d1b2ca799af
Opcode Fuzzy Hash: b8489804e60ae11b33167e6aecc231957128dbd16094889376f14530d4b560d6
Instruction Fuzzy Hash: 9D315031900205EBDF50DFA5DC89E6AB778FF84310B1480A9F905EB256D774EE10DBA0

Function 007D9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,007D77F4,?,?,00000000,00000001), ref: 007D9B53

Part of subcall function 007D6544: GetWindowRect.USER32(?,?), ref: 007D6557

GetDesktopWindow.USER32 ref: 007D9B7D
GetWindowRect.USER32(00000000), ref: 007D9B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 007D9BB6

Part of subcall function 007C7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007C7AD0

GetCursorPos.USER32(?), ref: 007D9BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007D9C44

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 91ae6beb7f27f4790161bdad1bdbd644d4d71297ae6795bbe1a2f21858b49a5d
Instruction ID: 90798fe130a5104a89942f60f42b99ad65ca64722dd6ca6863492bad84d12daf
Opcode Fuzzy Hash: 91ae6beb7f27f4790161bdad1bdbd644d4d71297ae6795bbe1a2f21858b49a5d
Instruction Fuzzy Hash: F631C1B2104305ABC710DF68DC49F9AB7E9FF88314F00091AF695E7281DA75E908CB91

Function 007BAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007BAFAE
OpenProcessToken.ADVAPI32(00000000), ref: 007BAFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 007BAFC4
CloseHandle.KERNEL32(00000004), ref: 007BAFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007BAFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 007BB012

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: a60f1c8b967e1f3b1981996c4ba03026247076396753481e3cb0f89ea4f737d7
Instruction ID: f949cbc488764f36182481422548bca4901afc04a34a6fd5c0ee38f2d3321b4e
Opcode Fuzzy Hash: a60f1c8b967e1f3b1981996c4ba03026247076396753481e3cb0f89ea4f737d7
Instruction Fuzzy Hash: B52149B2104209BFDB02AFA4DD09FEE7BA9BB44304F044015FA01A2161D37ADD21EB61

Function 007EEBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0079AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0079AFE3
Part of subcall function 0079AF83: SelectObject.GDI32(?,00000000), ref: 0079AFF2
Part of subcall function 0079AF83: BeginPath.GDI32(?), ref: 0079B009
Part of subcall function 0079AF83: SelectObject.GDI32(?,00000000), ref: 0079B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 007EEC20
LineTo.GDI32(00000000,00000003,?), ref: 007EEC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 007EEC42
LineTo.GDI32(00000000,00000000,?), ref: 007EEC52
EndPath.GDI32(00000000), ref: 007EEC62
StrokePath.GDI32(00000000), ref: 007EEC72

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 21576fde026902809939ec3e1cc97426967e9c015db0a75fac85e28023b512ea
Instruction ID: d466e5937fcd2e4e2a0e6c026719cf3b62aee1e515a6cd265f280eec0ff93418
Opcode Fuzzy Hash: 21576fde026902809939ec3e1cc97426967e9c015db0a75fac85e28023b512ea
Instruction Fuzzy Hash: A6110576000249BFEF129FA0DC88EEA7F6DFB08350F048122BE099A160D7719D95DBA0

Function 007BE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007BE1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 007BE1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007BE1D8
ReleaseDC.USER32(00000000,00000000), ref: 007BE1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 007BE1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 007BE209

Part of subcall function 007B9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,007B9A05,00000000,00000000,?,007B9DDB), ref: 007BA53A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 4980424026964a18ac7ddbc9dc3ffe95cfdc460ae64ef95e8afa9ef55376dd61
Instruction ID: c88c8315cf2817e0d9b4263e0bc5fc1fa6b045865bad6af3ac543e84b63dfa08
Opcode Fuzzy Hash: 4980424026964a18ac7ddbc9dc3ffe95cfdc460ae64ef95e8afa9ef55376dd61
Instruction Fuzzy Hash: DC0184B5A00718BFEB109BE58C45B9EBFB8EB48351F004066EA04A7390D6719C00CBA0

Function 007A7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 007A7B47

Part of subcall function 007A123A: __initp_misc_winsig.LIBCMT ref: 007A125E
Part of subcall function 007A123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 007A7F51
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 007A7F65
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 007A7F78
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 007A7F8B
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 007A7F9E
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 007A7FB1
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 007A7FC4
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 007A7FD7
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 007A7FEA
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 007A7FFD
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 007A8010
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 007A8023
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 007A8036
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 007A8049
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 007A805C
Part of subcall function 007A123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 007A806F

__mtinitlocks.LIBCMT ref: 007A7B4C

Part of subcall function 007A7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(0083AC68,00000FA0,?,?,007A7B51,007A5E77,00836C70,00000014), ref: 007A7E41

__mtterm.LIBCMT ref: 007A7B55

Part of subcall function 007A7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,007A7B5A,007A5E77,00836C70,00000014), ref: 007A7D3F
Part of subcall function 007A7BBD: _free.LIBCMT ref: 007A7D46
Part of subcall function 007A7BBD: DeleteCriticalSection.KERNEL32(0083AC68,?,?,007A7B5A,007A5E77,00836C70,00000014), ref: 007A7D68

__calloc_crt.LIBCMT ref: 007A7B7A
GetCurrentThreadId.KERNEL32 ref: 007A7BA3

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 22e358ef8c380828c5a9f968ee6ffeb4736117d930aeb882e9498f345164debf
Instruction ID: b4dd751df62866a550c037c5e1344534e2f935b171163be70e559a9ff84085d3
Opcode Fuzzy Hash: 22e358ef8c380828c5a9f968ee6ffeb4736117d930aeb882e9498f345164debf
Instruction Fuzzy Hash: 91F06DF210D31299EA2C77747C0AA4A2794ABC3730F244BA9F8A0C90D2EF2D8C41C1B5

Function 007827EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 0078281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00782825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00782830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0078283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00782843
MapVirtualKeyW.USER32(00000012,00000000), ref: 0078284B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 7873e097b40c427caff3dcb18cde926083871470089aba01123c299814756f51
Instruction ID: f7aacb1d76b9a2bf59546aae5dc8b3b7246222ec950360a1e02bf567ecc48e5d
Opcode Fuzzy Hash: 7873e097b40c427caff3dcb18cde926083871470089aba01123c299814756f51
Instruction Fuzzy Hash: 31016CB0901B597DE3008F6A8C85B52FFA8FF15354F00411B915C47941C7F5A864CBE5

Function 007C9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: ee956c9b3655fb0de0cc8d85bbb0652eac66b7e3c8339a2503abf1af784e64f6
Instruction ID: f5c7e700a42600ecc07538557629d58aa40a0fd8a053e6d46c5b1516c69c4f3a
Opcode Fuzzy Hash: ee956c9b3655fb0de0cc8d85bbb0652eac66b7e3c8339a2503abf1af784e64f6
Instruction Fuzzy Hash: 5B01A432102711EBD7951B94EC4CEEF7769FF88702B04442DF603920A4DB78E800DB50

Function 007C7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007C7C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 007C7C1D
GetWindowThreadProcessId.USER32(?,?), ref: 007C7C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007C7C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007C7C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007C7C4C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: dc36361574e5b565175d1c72805a3f72c930a92a49176c751e3990f7c0d37ab0
Instruction ID: 160ebd5ffd74bf398bfeb3cc37bbbe370cb24645a2e567c5d17bc02f0b6822c3
Opcode Fuzzy Hash: dc36361574e5b565175d1c72805a3f72c930a92a49176c751e3990f7c0d37ab0
Instruction Fuzzy Hash: 6CF03A72241258BBE7615B929C0EEEF7F7CEFC6B11F000018FA1192051EBA15A41D6B5

Function 007C9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 007C9A33
EnterCriticalSection.KERNEL32(?,?,?,?,007F5DEE,?,?,?,?,?,0078ED63), ref: 007C9A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,007F5DEE,?,?,?,?,?,0078ED63), ref: 007C9A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,007F5DEE,?,?,?,?,?,0078ED63), ref: 007C9A5E

Part of subcall function 007C93D1: CloseHandle.KERNEL32(?,?,007C9A6B,?,?,?,007F5DEE,?,?,?,?,?,0078ED63), ref: 007C93DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 007C9A71
LeaveCriticalSection.KERNEL32(?,?,?,?,007F5DEE,?,?,?,?,?,0078ED63), ref: 007C9A78

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 8b6eca98c5faa343f964d5e3186945d463d2fefb83c97b50b0a9e98f68ab2a16
Instruction ID: 03e767a25a990ec7a16ba9827eb6ba032aa0859aa8f226a6538e75e3c8273f74
Opcode Fuzzy Hash: 8b6eca98c5faa343f964d5e3186945d463d2fefb83c97b50b0a9e98f68ab2a16
Instruction Fuzzy Hash: 5DF08C33142311ABD7912BE4EC8DEEF7739FF88302B140429F603A10A5DBB9A911DB60

Function 00781CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0079F4EA: std::exception::exception.LIBCMT ref: 0079F51E
Part of subcall function 0079F4EA: __CxxThrowException@8.LIBCMT ref: 0079F533

__swprintf.LIBCMT ref: 00781EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00781D49

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 11e3733801c82201ae95a57789aa9f1f9de62c812f59567dc50a84cb592701d2
Instruction ID: c50fcdd80956b3240e81191f0cbabe58cf29907b13035a017f52db1834a00943
Opcode Fuzzy Hash: 11e3733801c82201ae95a57789aa9f1f9de62c812f59567dc50a84cb592701d2
Instruction Fuzzy Hash: 21918971144205EFC725FF24C989C7ABBA8FF85700F404919F986972A2DB38ED05CB92

Function 007DAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007DB006
CharUpperBuffW.USER32(?,?), ref: 007DB115
VariantClear.OLEAUT32(?), ref: 007DB298

Part of subcall function 007C9DC5: VariantInit.OLEAUT32(00000000), ref: 007C9E05
Part of subcall function 007C9DC5: VariantCopy.OLEAUT32(?,?), ref: 007C9E0E
Part of subcall function 007C9DC5: VariantClear.OLEAUT32(?), ref: 007C9E1A

Strings

AUTOIT.ERROR, xrefs: 007DB11B
Incorrect Parameter format, xrefs: 007DB03E, 007DB20B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 615e93f363b6873bbd36f129fff660ba1695301961f3cfce9c6e405dbf982065
Instruction ID: bfa878b7f3194afc459bcc852995c0720a38550bb6e37f7eafedd08879d7b4d0
Opcode Fuzzy Hash: 615e93f363b6873bbd36f129fff660ba1695301961f3cfce9c6e405dbf982065
Instruction Fuzzy Hash: 5F914975608301DFCB10EF64C48596ABBF4BF89704F04486EF89A9B361DB35E945CB92

Function 007C5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079C6F4: _wcscpy.LIBCMT ref: 0079C717

_memset.LIBCMT ref: 007C5438
GetMenuItemInfoW.USER32(?), ref: 007C5467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007C5513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 007C553D

Strings

0, xrefs: 007C5430

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 0e359fc64f9460ac89244b63cfe346dc9849b8deae6d66b1845128d51e2ecf0e
Instruction ID: ed752c4d1dee749c99d8abf2d31e1777cfb1c61611562b0cf0870d4ad4087fa4
Opcode Fuzzy Hash: 0e359fc64f9460ac89244b63cfe346dc9849b8deae6d66b1845128d51e2ecf0e
Instruction Fuzzy Hash: E75133322047419BD7149F28D844FABB7EAEF95364F14062DF895C3190DBAAEDC48B52

Function 007C0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007C027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007C02B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007C02C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007C0344

Strings

DllGetClassObject, xrefs: 007C02B7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 3b5a4e985e3691e056c9eed3b979e93f3bea8a856fa058307d877930303effcd
Instruction ID: 0923ad3081a6c1f705efae347c545c8612b6ad083d5822cb5213db285df3aac0
Opcode Fuzzy Hash: 3b5a4e985e3691e056c9eed3b979e93f3bea8a856fa058307d877930303effcd
Instruction Fuzzy Hash: B3415971604204EFDB05CFA4C884F9ABBA9EF44310B1480ADA909DF246D7B9DA44CBE0

Function 007C5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C5075
GetMenuItemInfoW.USER32 ref: 007C5091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 007C50D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00841708,00000000), ref: 007C5120

Strings

0, xrefs: 007C506D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: c8343834a4b103fea76ba383420ad1416ca2cf1cfde2bde635c55d111aeafbcf
Instruction ID: f640ea30fb6954733a516f94ae39d5ca8fda9aa0c883a5752e9271674900dcd9
Opcode Fuzzy Hash: c8343834a4b103fea76ba383420ad1416ca2cf1cfde2bde635c55d111aeafbcf
Instruction Fuzzy Hash: A641B271204705EFD720DF24D888F6ABBE4AF85324F184A1EF96597291D735F980CB62

Function 007CE698 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 007CE742
GetLastError.KERNEL32(?,00000000), ref: 007CE768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007CE78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007CE7B9

Strings

p1#v`K$v, xrefs: 007CE78D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID: p1#v`K$v
API String ID: 3321077145-1068180069
Opcode ID: 1d4fb398faaecc1cc0bda1b77177ad2945777694a3b64d1c5a85b4620d921a56
Instruction ID: 3f1af55fa012aa193d8d42b0881f5df2b6c0e0963af31df7aa09755657116366
Opcode Fuzzy Hash: 1d4fb398faaecc1cc0bda1b77177ad2945777694a3b64d1c5a85b4620d921a56
Instruction Fuzzy Hash: 4A414939200610DFCF11EF14C849A5DBBE5BF59720F098098E946AB7A2CB38FD00DB91

Function 007E0567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 007E0587

Strings

cdecl, xrefs: 007E05DE
none, xrefs: 007E0662
stdcall, xrefs: 007E0609
winapi, xrefs: 007E05F8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: 78ea6d6e3a29dc209b79aa848ac2b19c4c3fbd11e772dfeebd80c8bfbc83bda7
Instruction ID: c52459fc59f982db2401abce0818440e225f73cb30ed5dcdc11761f8838bdfc8
Opcode Fuzzy Hash: 78ea6d6e3a29dc209b79aa848ac2b19c4c3fbd11e772dfeebd80c8bfbc83bda7
Instruction Fuzzy Hash: 6E31F030600246EFCF00EFA4C845AEEB3B4FF45314B008629E826A77D1DBB9E955CB90

Function 007BB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 007BB88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 007BB8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 007BB8D1

Strings

ListBox, xrefs: 007BB84D
ComboBox, xrefs: 007BB815

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 0e478820f8adcfcb57173fec962753bd3b384c2a4300530abd7ee9db49c6db1c
Instruction ID: d0606bf0a4f47287c191313596622cba92e45f47518e9c969b3bac8fa0028670
Opcode Fuzzy Hash: 0e478820f8adcfcb57173fec962753bd3b384c2a4300530abd7ee9db49c6db1c
Instruction Fuzzy Hash: F421E1B5A40208FFDB14ABA4D88AAFE77BCEF55350B104129F421A61E0DBBC5D0697A0

Function 007D43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007D4401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007D4427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 007D4457
InternetCloseHandle.WININET(00000000), ref: 007D449E

Part of subcall function 007D5052: GetLastError.KERNEL32(?,?,007D43CC,00000000,00000000,00000001), ref: 007D5067

Strings

, xrefs: 007D4450

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 81ef63745239dc65e424dcef0fb4ca88a542bedeacb0cd8e2153e9c0279f77d4
Instruction ID: 7d0581a91161a0305c1f4ffda5e1758e4e75d969ec79286252e30d685ceff729
Opcode Fuzzy Hash: 81ef63745239dc65e424dcef0fb4ca88a542bedeacb0cd8e2153e9c0279f77d4
Instruction Fuzzy Hash: A8218EB2600208BFE7119FA4CC85EBFBAFCFB48748F10811BF109A6240EA788D459771

Function 007E90E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0079D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0079D1BA
Part of subcall function 0079D17C: GetStockObject.GDI32(00000011), ref: 0079D1CE
Part of subcall function 0079D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0079D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 007E915C
LoadLibraryW.KERNEL32(?), ref: 007E9163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 007E9178
DestroyWindow.USER32(?), ref: 007E9180

Strings

SysAnimate32, xrefs: 007E9137

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 43e95b6db945b3ac2f843e1b8017af1f4ec3540ba08c7415f87f9c1976ab725b
Instruction ID: 7f9b2b00c04ba2895e45995ead6c48d49210e9ef80b22e78eef76c32ed691dde
Opcode Fuzzy Hash: 43e95b6db945b3ac2f843e1b8017af1f4ec3540ba08c7415f87f9c1976ab725b
Instruction Fuzzy Hash: CB21C27220124AFBEF204E66DC88EBA77ADFF9D364F100218FA1096190D775DC51A761

Function 007C9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007C9588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007C95B9
GetStdHandle.KERNEL32(0000000C), ref: 007C95CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 007C9605

Strings

nul, xrefs: 007C9600

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 5de6bb05b7de9ae63d45bbe81206f0a83b3f63b52f97853df783a9c1f347904b
Instruction ID: 7d2008c98cb3ad461f4fd90c8cfbcd47eaafa21801d3f9bfdb9d2f31edba1257
Opcode Fuzzy Hash: 5de6bb05b7de9ae63d45bbe81206f0a83b3f63b52f97853df783a9c1f347904b
Instruction Fuzzy Hash: 20218170500305ABDB619F65EC09F9A77E4BF44720F204A1DFAA1D72D0D774E951CB10

Function 007C9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007C9653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007C9683
GetStdHandle.KERNEL32(000000F6), ref: 007C9694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007C96CE

Strings

nul, xrefs: 007C96C9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: bf6389f4fbdff569676bdb73a23ac8316ca934990e212efd10f6fc717df5ff41
Instruction ID: c9fb601d33fab4850fd61f20d8c946a5365f2a39257f4e8f7b661c9917dafcde
Opcode Fuzzy Hash: bf6389f4fbdff569676bdb73a23ac8316ca934990e212efd10f6fc717df5ff41
Instruction Fuzzy Hash: F2216D716003059BDB609F699C49F9AB7F8BF85720F200A1DFAA1E72D0EB74D941CB50

Function 007CDAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CDB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 007CDB5E
__swprintf.LIBCMT ref: 007CDB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,0081DC00), ref: 007CDBB5

Strings

%lu, xrefs: 007CDB71

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 252df032b49003a3a8c215271c9512f436aac6878fd21e92b7bbb1d880e9cd69
Instruction ID: 55e89f70d72c7f07ab72b6e9974e06b5de696933d20c3d8fba60936eedf6483f
Opcode Fuzzy Hash: 252df032b49003a3a8c215271c9512f436aac6878fd21e92b7bbb1d880e9cd69
Instruction Fuzzy Hash: 5A214175A00208EFCB11EFA4CD85EAEBBB8EF89704B114069F509D7251DB75EE41CB61

Function 007BC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 007BC84A
Part of subcall function 007BC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 007BC85D
Part of subcall function 007BC82D: GetCurrentThreadId.KERNEL32 ref: 007BC864
Part of subcall function 007BC82D: AttachThreadInput.USER32(00000000), ref: 007BC86B

GetFocus.USER32 ref: 007BCA05

Part of subcall function 007BC876: GetParent.USER32(?), ref: 007BC884

GetClassNameW.USER32(?,?,00000100), ref: 007BCA4E
EnumChildWindows.USER32(?,007BCAC4), ref: 007BCA76
__swprintf.LIBCMT ref: 007BCA90

Strings

%s%d, xrefs: 007BCA8A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: 289b6ca7a046c70c7f6d740db2ea9287d2acf4b446e8167ae434f9305ea9eb91
Instruction ID: af765a933f702444e8ebeda9d5f87ec7432d43a25d882536601c8d028856dda7
Opcode Fuzzy Hash: 289b6ca7a046c70c7f6d740db2ea9287d2acf4b446e8167ae434f9305ea9eb91
Instruction Fuzzy Hash: 23118475500305BBDB12BFA08C89FE9376DAF44714F00C066FE18AA182DB789545DB71

Function 007E1945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007E19F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 007E1A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 007E1B49
CloseHandle.KERNEL32(?), ref: 007E1BBF

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 60d4eb691e6cfa0e5e1d8d74442b088014cfff5315d7407efd3a425c276f591d
Instruction ID: 499f10e87cead398c850eea9ec23e1fae916ee3f2c06c97dff6a20883ec99667
Opcode Fuzzy Hash: 60d4eb691e6cfa0e5e1d8d74442b088014cfff5315d7407efd3a425c276f591d
Instruction Fuzzy Hash: E48176B0601205EBDF11EF55C89ABADBBE5BF08710F548459F905AF382D7B8E941CB90

Function 007EE062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 007EE1D5
SendMessageW.USER32(?,000000B0,?,?), ref: 007EE20D
IsDlgButtonChecked.USER32(?,00000001), ref: 007EE248
GetWindowLongW.USER32(?,000000EC), ref: 007EE269
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 007EE281

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$ButtonCheckedLongWindow
String ID:
API String ID: 3188977179-0
Opcode ID: 3d07f1ef63e92047e7a7772169fc771fb5e513682c617b5425796126d8741b94
Instruction ID: e5b09b2b4b68f69777768920eb61214193461276ef3659ddd4cd6c2c71229088
Opcode Fuzzy Hash: 3d07f1ef63e92047e7a7772169fc771fb5e513682c617b5425796126d8741b94
Instruction Fuzzy Hash: C861C134602288EFDB21CF59C884FAA77BAFB4D300F144859F959973A1C779A980CB11

Function 007C1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007C1CB4
VariantClear.OLEAUT32(00000013), ref: 007C1D26
VariantClear.OLEAUT32(00000000), ref: 007C1D81
VariantClear.OLEAUT32(?), ref: 007C1DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 007C1E26

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: d5a84e2f90c776e8b033aa227958ed83edfef048d0f26bd5de3357ce4e6df091
Instruction ID: 09a3055962ffef7dfe594d7f0e1a670bde890fc4b84fe282b6622191cb7de3eb
Opcode Fuzzy Hash: d5a84e2f90c776e8b033aa227958ed83edfef048d0f26bd5de3357ce4e6df091
Instruction Fuzzy Hash: 635149B5A00209EFDB14CF58C880EAAB7B8FF4D314B15856DE95ADB305D334E951CBA0

Function 007E0688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 007E06EE
GetProcAddress.KERNEL32(00000000,?), ref: 007E077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 007E079B
GetProcAddress.KERNEL32(00000000,?), ref: 007E07E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 007E07FB

Part of subcall function 0079E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,007CA574,?,?,00000000,00000008), ref: 0079E675
Part of subcall function 0079E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,007CA574,?,?,00000000,00000008), ref: 0079E699

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 44ec0909d8f878790e668695256adc3dd4f4727e29253d122f6fdcdf4d15f837
Instruction ID: dc77fe0e74ce8b801170e6f0b48fee30735c482e21586c5fba2404b72beb3778
Opcode Fuzzy Hash: 44ec0909d8f878790e668695256adc3dd4f4727e29253d122f6fdcdf4d15f837
Instruction Fuzzy Hash: D7513775A01245DFCF10EFA8C885DADB7B5BF5C310B04805AEA15AB392DB78ED85CB90

Function 007E2E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E2BB5,?,?), ref: 007E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E2EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007E2F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 007E2F75
RegCloseKey.ADVAPI32(?,?), ref: 007E2FA1
RegCloseKey.ADVAPI32(00000000), ref: 007E2FAE

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: ff3803a34ef792d2021fdbed8560cb7ae430ecb4508d24377b4c28418c4a1c98
Instruction ID: 3470f586f10ecc1cc10105b9f7e96294563dbd9baf7bb2b3774cbc2e291a4dfa
Opcode Fuzzy Hash: ff3803a34ef792d2021fdbed8560cb7ae430ecb4508d24377b4c28418c4a1c98
Instruction Fuzzy Hash: D3515972208244EFD705EF64C895E6AB7F8FF88304F04481DF5959B2A2DB78E905CB52

Function 007ECCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abc4ba76f5dc5581f1df5c426df2554e6246a6e8967b39d3fd9710417293baa
Instruction ID: d51375ea1395f60857658951f43c3961e7aab3595ddd422c6e4c9567e2ac9585
Opcode Fuzzy Hash: 5abc4ba76f5dc5581f1df5c426df2554e6246a6e8967b39d3fd9710417293baa
Instruction Fuzzy Hash: 2141087DA02284AFCB21DF69CC48FA97F68FB0D310F150165F919A72D1C739AD42C690

Function 007D1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007D12B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007D12DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 007D131C

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 007D1341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 007D1349

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 6f029dc8013c2605e235b4657ad32902616fde05b70509561d2e2e12c6261227
Instruction ID: 2e7fb835526fce476092ac608cbe7716b2ce71a192c6d10f99d15de99e159ba7
Opcode Fuzzy Hash: 6f029dc8013c2605e235b4657ad32902616fde05b70509561d2e2e12c6261227
Instruction Fuzzy Hash: 06411E35A00205EFDF01EF64C995AADBBF5FF08314B148099E90AAB3A2DB35ED01DB51

Function 0079B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0079B64F
ScreenToClient.USER32(00000000,000000FF), ref: 0079B66C
GetAsyncKeyState.USER32(00000001), ref: 0079B691
GetAsyncKeyState.USER32(00000002), ref: 0079B69F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 39c78d54ccd0e4048b701be8e4adcc348613de24502e734668f35a652d084964
Instruction ID: 30bbe963abd77c82b64dfa295b9f03da291d247107e6c659d5f2a0c516258958
Opcode Fuzzy Hash: 39c78d54ccd0e4048b701be8e4adcc348613de24502e734668f35a652d084964
Instruction Fuzzy Hash: 06418F31508119FBCF259F64D844EE9BBB5FB09320F204319F829922D0CB38AD90DF91

Function 007BB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007BB369
PostMessageW.USER32(?,00000201,00000001), ref: 007BB413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 007BB41B
PostMessageW.USER32(?,00000202,00000000), ref: 007BB429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 007BB431

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7f64d1928b3d654bc433018d66418b68dfbfa1b37a6230d4c381685d427275c7
Instruction ID: 132a21c39b7500bcdb47c695df5e02398b8ab27ab8b4bdd645883b50bf01fcc0
Opcode Fuzzy Hash: 7f64d1928b3d654bc433018d66418b68dfbfa1b37a6230d4c381685d427275c7
Instruction Fuzzy Hash: 0E319AB1A00219EBDF04CFA8D94DBDE7BB5FB04319F104229F921AB1D1C7B49954CB90

Function 007BDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 007BDBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 007BDBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 007BDC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 007BDC52
_wcsstr.LIBCMT ref: 007BDC5C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 27097764e49b4981c367f402a340963a56d15035c8a2ee22bb62a26d5aefedc0
Instruction ID: 4d5b4dc77acaf857c3abea7347f25a232803c0bdf08a3b6346c961d5b3c36d00
Opcode Fuzzy Hash: 27097764e49b4981c367f402a340963a56d15035c8a2ee22bb62a26d5aefedc0
Instruction Fuzzy Hash: A521C572204244AFEB255B799C49FBB7FA8EF45760F108039F809CA191EAA9DC4196A0

Function 007BBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007BBC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007BBCC2
__itow.LIBCMT ref: 007BBCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007BBD00
__itow.LIBCMT ref: 007BBD11

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 9542f22c69be5b638b0ab7ad0b9cfcd676e6e625d9f88186cc036e83b490d065
Instruction ID: 7f72f711f315b2f74be1cbd72d5475736d3694e7d56a2b71b1c502a001eedbdc
Opcode Fuzzy Hash: 9542f22c69be5b638b0ab7ad0b9cfcd676e6e625d9f88186cc036e83b490d065
Instruction Fuzzy Hash: 0421C675740318BFDB20AA658C4AFDE7A68EF99710F000464FE05EB181DBAC894587E1

Function 007C6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 007850E6: _wcsncpy.LIBCMT ref: 007850FA

GetFileAttributesW.KERNEL32(?,?,?,?,007C60C3), ref: 007C6369
GetLastError.KERNEL32(?,?,?,007C60C3), ref: 007C6374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007C60C3), ref: 007C6388
_wcsrchr.LIBCMT ref: 007C63AA

Part of subcall function 007C6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007C60C3), ref: 007C63E0

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: dce4de65c0b8e4652c9045e33968cddaf043afdf2f32eb89c2e686728d39b0f3
Instruction ID: a513b1305045639b775a4081c797e68be3c88b88419ca57b4f9df1883e33d714
Opcode Fuzzy Hash: dce4de65c0b8e4652c9045e33968cddaf043afdf2f32eb89c2e686728d39b0f3
Instruction Fuzzy Hash: CE21E731504255DBEF15EBB8AC86FEA33ACFF06360F10046DF045D70C1EB68D9818A65

Function 007D8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007DA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 007DA84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007D8BD3
WSAGetLastError.WSOCK32(00000000), ref: 007D8BE2
connect.WSOCK32(00000000,?,00000010), ref: 007D8BFE

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 94035030e4702b7f5a30e451f27608b727308682c973a1a3cc34f10723788a12
Instruction ID: 66b9e73e299bb5f4b98b740ecd5f653736c38926997703b52fbcfc666cbc5cae
Opcode Fuzzy Hash: 94035030e4702b7f5a30e451f27608b727308682c973a1a3cc34f10723788a12
Instruction Fuzzy Hash: 67218E32200214AFCB50AF68CC89F7E77A9EF49710F04445EF916AB392CB78EC018B61

Function 007D8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 007D8441
GetForegroundWindow.USER32 ref: 007D8458
GetDC.USER32(00000000), ref: 007D8494
GetPixel.GDI32(00000000,?,00000003), ref: 007D84A0
ReleaseDC.USER32(00000000,00000003), ref: 007D84DB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 61fbe25e0e4685f290627d18ccc7c2abe501489762b234d5b7c118c861fdd55d
Instruction ID: 43c7347ed98a2732c564a6d6aa289dd15c762d315f48cefc3a974120eb5951aa
Opcode Fuzzy Hash: 61fbe25e0e4685f290627d18ccc7c2abe501489762b234d5b7c118c861fdd55d
Instruction Fuzzy Hash: 47218175A00204EFD750EFA4D889AAEBBF5FF48301F048479E85A97351DB74AD00CBA0

Function 0079AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0079AFE3
SelectObject.GDI32(?,00000000), ref: 0079AFF2
BeginPath.GDI32(?), ref: 0079B009
SelectObject.GDI32(?,00000000), ref: 0079B033

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 3930da1917249c60dcb5641b583a3a25be70f30f80b988b7aeecc32cad1b9f9d
Instruction ID: abea04f721aff1e536ef3259d68b55700fdf8fa4b903212cb96a17474463f86b
Opcode Fuzzy Hash: 3930da1917249c60dcb5641b583a3a25be70f30f80b988b7aeecc32cad1b9f9d
Instruction Fuzzy Hash: B72180B4800309EFDF10DF99FD4C7AA7B69BB22355F15431AE525921A0D3B8C895CF91

Function 007A217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007A21A9
CreateThread.KERNEL32(?,?,007A22DF,00000000,?,?), ref: 007A21ED
GetLastError.KERNEL32 ref: 007A21F7
_free.LIBCMT ref: 007A2200
__dosmaperr.LIBCMT ref: 007A220B

Part of subcall function 007A7C0E: __getptd_noexit.LIBCMT ref: 007A7C0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 48233f39e246823e83d813b1d0a216e97df1b7e68f36564635e5bbfba1ff5423
Instruction ID: 59943610edd12fa944270abeb3438f21143963b4b23f2589bd097c860fa90f80
Opcode Fuzzy Hash: 48233f39e246823e83d813b1d0a216e97df1b7e68f36564635e5bbfba1ff5423
Instruction Fuzzy Hash: 8F110873204306EFDB15AFA8DC45E5B3B98FF83770B110629F91486182EB39D80286A0

Function 007BABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 007BABD7
GetLastError.KERNEL32(?,007BA69F,?,?,?), ref: 007BABE1
GetProcessHeap.KERNEL32(00000008,?,?,007BA69F,?,?,?), ref: 007BABF0
HeapAlloc.KERNEL32(00000000,?,007BA69F,?,?,?), ref: 007BABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 007BAC0E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b0b7da98ebe1cc8f3f9709a01f35c3476a4ddd33df45c7346c9084b6922c7832
Instruction ID: 0d487da4a1d8778219cf739c83741b49bf1d5855bac204bba439406888b11ffa
Opcode Fuzzy Hash: b0b7da98ebe1cc8f3f9709a01f35c3476a4ddd33df45c7346c9084b6922c7832
Instruction Fuzzy Hash: B80114B1201204BFDB515FAADC88EAB7FADFF8A755B100429F945C3260DA719C80CBB1

Function 007C7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007C7A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007C7A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007C7A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 007C7A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007C7AD0

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: bcb9aac699a82aca41016c66d25d3d4950d4d71cb27ef69d62cdf497f279b0bb
Instruction ID: aed9673ae4d04fa0ae7c4fe8b8b63f128f6015dc9dfddd7c71c5e6af3b199902
Opcode Fuzzy Hash: bcb9aac699a82aca41016c66d25d3d4950d4d71cb27ef69d62cdf497f279b0bb
Instruction Fuzzy Hash: 5C012935D04619EBDF04AFE9DC88AEDBB78FB1C711F008459E502B2250DF389650CBA1

Function 007B9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 007B9ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 007B9AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 007B9B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 007B9B15
CLSIDFromString.OLE32(?,?), ref: 007B9B21

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: dbd3b38347ff53e602820488d8590ec5134aa314ed22f1839ee1fe7471213571
Instruction ID: 759303e039b822a4619bbd6c2534f0b063d337a338bf7415acba7c187c19f1cb
Opcode Fuzzy Hash: dbd3b38347ff53e602820488d8590ec5134aa314ed22f1839ee1fe7471213571
Instruction Fuzzy Hash: 25014FBA610219FFDB114F94ED44BEA7AEDEF44751F148434FA05D2210D774DD409BA0

Function 007BAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007BAA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007BAA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007BAA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007BAA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007BAAAF

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 09560d5f9739a1e97a36f0dfc3c27aacb1111d9877ef55df0ae034f088cfc52a
Instruction ID: 4ac9df1761a74a0e3478eb8ed7bd7e4686ef0f096a5178d209753296be522dfa
Opcode Fuzzy Hash: 09560d5f9739a1e97a36f0dfc3c27aacb1111d9877ef55df0ae034f088cfc52a
Instruction Fuzzy Hash: 67F04975200304BFEB116FE4AC89FAB7BACFF4A754F404429F945C72A0DA649C41CA71

Function 007BAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 007BAADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 007BAAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007BAAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 007BAAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007BAB10

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a40fc4f9ee9859c5d1f027d998f1993e0e2e3d246c0defc073a5469054974f17
Instruction ID: d36e24bb388b6982245fdc1a37f80be36542193d34f5122e68bcf3d38fabe77c
Opcode Fuzzy Hash: a40fc4f9ee9859c5d1f027d998f1993e0e2e3d246c0defc073a5469054974f17
Instruction Fuzzy Hash: E9F04F753103087FEB111FA4EC88FA73B6EFF45754F000029F955C71A0DA6498418A61

Function 007BEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 007BEC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 007BECAB
MessageBeep.USER32(00000000), ref: 007BECC3
KillTimer.USER32(?,0000040A), ref: 007BECDF
EndDialog.USER32(?,00000001), ref: 007BECF9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 5e455daeee7b61c7aaecfe8f21d9572dcc7455ab8f9afeade29f1d019b6621db
Instruction ID: 84425b8fac153cd9b72bf52274839e1f341ab9319a5ff3fde70190c600187392
Opcode Fuzzy Hash: 5e455daeee7b61c7aaecfe8f21d9572dcc7455ab8f9afeade29f1d019b6621db
Instruction Fuzzy Hash: E201A430500704ABEB345B50DE5EBD67BB8FF10705F000559B593A15E0DBF8AA88CB90

Function 0079B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0079B0BA
StrokeAndFillPath.GDI32(?,?,007FE680,00000000,?,?,?), ref: 0079B0D6
SelectObject.GDI32(?,00000000), ref: 0079B0E9
DeleteObject.GDI32 ref: 0079B0FC
StrokePath.GDI32(?), ref: 0079B117

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 619769019ab34a1bf6da359ec34ac2fcb555ff60ee7f5b2299a70178fba39e7b
Instruction ID: 4fc2f5642deab794ac0d3f92c21a51add77be76e2752a1501951d151bc8f62a4
Opcode Fuzzy Hash: 619769019ab34a1bf6da359ec34ac2fcb555ff60ee7f5b2299a70178fba39e7b
Instruction Fuzzy Hash: E9F0F238004708EFCF219FA9FD0C7943B64BB62362F088318E829840F0C73889A6CF50

Function 007CF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007CF2DA
CoCreateInstance.OLE32(0080DA7C,00000000,00000001,0080D8EC,?), ref: 007CF2F2
CoUninitialize.OLE32 ref: 007CF555

Strings

.lnk, xrefs: 007CF28B, 007CF290, 007CF29E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 7c6343007591c615680f8562de2e05203d67826d0fdca7c14091a2506b94a987
Instruction ID: 47d51b33767b0005b2d41a9ea14d566f349cca64dee0fd8124fd7b416fb00953
Opcode Fuzzy Hash: 7c6343007591c615680f8562de2e05203d67826d0fdca7c14091a2506b94a987
Instruction Fuzzy Hash: FBA13BB1104201AFD701EF64DC85EABB7E8EF98314F00491DF15597192DB74EA09CB62

Function 007CE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 0078660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007853B1,?,?,007861FF,?,00000000,00000001,00000000), ref: 0078662F

CoInitialize.OLE32(00000000), ref: 007CE85D
CoCreateInstance.OLE32(0080DA7C,00000000,00000001,0080D8EC,?), ref: 007CE876
CoUninitialize.OLE32 ref: 007CE893

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

Strings

.lnk, xrefs: 007CE83B, 007CE84D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 38ac4b5830ba17d8e496e18fcf51487b249edb2e69988f85dfe3e35e013cd8ef
Instruction ID: 014122702e0c020fb125e1321182b9c05fd205e314598af592dce0b2e77511ce
Opcode Fuzzy Hash: 38ac4b5830ba17d8e496e18fcf51487b249edb2e69988f85dfe3e35e013cd8ef
Instruction Fuzzy Hash: A8A135756043019FCB10EF14C888E2ABBE5BF89710F15895CF9969B3A1CB35ED45CB92

Function 007A325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 007A32ED

Part of subcall function 007AE0D0: __87except.LIBCMT ref: 007AE10B

Strings

pow, xrefs: 007A32C5, 007A32E2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: cb0e3891407df8530e8b1f48c8c925e3aed28d653ee50f8149106ce4ec91eae8
Instruction ID: 9c50a196617b9035c4d41f3b96e5e0e2d72bf50200e98ad0109086566ac206f3
Opcode Fuzzy Hash: cb0e3891407df8530e8b1f48c8c925e3aed28d653ee50f8149106ce4ec91eae8
Instruction Fuzzy Hash: 80513531A0D20596CB157B18C9457BA6B98FBC3710F208F68F4C5822E9EE3C8ED49A42

Function 007C4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0081DC50,?,0000000F,0000000C,00000016,0081DC50,?), ref: 007C4645

Part of subcall function 0078936C: __swprintf.LIBCMT ref: 007893AB
Part of subcall function 0078936C: __itow.LIBCMT ref: 007893DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 007C46C5

Strings

THIS, xrefs: 007C4703
REMOVE, xrefs: 007C4676

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 5f23034963414d312e00981ef1a94d66aa7deefc379a7dc4badaeab4ca5a1a1f
Instruction ID: 4956e4900ab2c690233e79d080f48b4e39d96bfbebdb19c4fb016d43d520d81a
Opcode Fuzzy Hash: 5f23034963414d312e00981ef1a94d66aa7deefc379a7dc4badaeab4ca5a1a1f
Instruction Fuzzy Hash: 43416B74A00209DFCF01EFA4C895EADB7B5FF49314F14846DE916AB2A2DB389D45CB50

Function 007BC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007BBC08,?,?,00000034,00000800,?,00000034), ref: 007C4335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 007BC1D3

Part of subcall function 007C42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007BBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 007C4300

Part of subcall function 007C422F: GetWindowThreadProcessId.USER32(?,?), ref: 007C425A
Part of subcall function 007C422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,007BBBCC,00000034,?,?,00001004,00000000,00000000), ref: 007C426A
Part of subcall function 007C422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,007BBBCC,00000034,?,?,00001004,00000000,00000000), ref: 007C4280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007BC240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007BC28D

Strings

@, xrefs: 007BC2A5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 6299381100223067bb03468e37d33a22784864d311c47ef9d22c6ef844fcff92
Instruction ID: 66ec436585a9bd38b77d0cf4279ef500858c2d0e3287fb8f7b2fb976a59bb5cc
Opcode Fuzzy Hash: 6299381100223067bb03468e37d33a22784864d311c47ef9d22c6ef844fcff92
Instruction Fuzzy Hash: F2414C72A00218AFDB11DFA4CC96FEEB7B8BF09700F004099FA55B7181DA756E45CB61

Function 007EA63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0081DC00,00000000,?,?,?,?), ref: 007EA6D8
GetWindowLongW.USER32 ref: 007EA6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 007EA705

Strings

SysTreeView32, xrefs: 007EA6AA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 5fb770483141dad5ef9bfcdcb9d9c312d66c48419ace503f27a2ddea986770cc
Instruction ID: b74463e8fd6e533425201ff58386d40e6008ed1d26e8cfc0009457449f66fcbd
Opcode Fuzzy Hash: 5fb770483141dad5ef9bfcdcb9d9c312d66c48419ace503f27a2ddea986770cc
Instruction Fuzzy Hash: E431AD31241649ABDF218E79DC45BEA7BA9FB49324F244725F875922E0C738BC508B90

Function 007D5180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D5190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 007D51C6

Strings

D}, xrefs: 007D522E
|, xrefs: 007D51B5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |$D}
API String ID: 1413715105-2989213184
Opcode ID: c476fb888fc2ca657da6af965a05d9a0baec2fa66fabd245e86547bf47d7a5b1
Instruction ID: acfe9b986448d1d26b9183bbc1e9fd2c805547ac557a1e1e6c0317bd6c3ca690
Opcode Fuzzy Hash: c476fb888fc2ca657da6af965a05d9a0baec2fa66fabd245e86547bf47d7a5b1
Instruction Fuzzy Hash: B1310A71C00119EBCF11EFA4CC89AEE7FB9FF14750F100116F815AA266DB35AA56DBA0

Function 007EA0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 007EA15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 007EA172
SendMessageW.USER32(?,00001002,00000000,?), ref: 007EA196

Strings

SysMonthCal32, xrefs: 007EA129

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: ae6cc42544eb41ac6bfcd8a0bf37249870f0d03bcf5e9a1f811beb0c892b7d0a
Instruction ID: 2a0a7647e94c931c98be50899cc3eb7368626aa15b93500acdaf9d926e8336e8
Opcode Fuzzy Hash: ae6cc42544eb41ac6bfcd8a0bf37249870f0d03bcf5e9a1f811beb0c892b7d0a
Instruction Fuzzy Hash: 04215C32510218BBDF158E94CC86FEA3B79FF4C764F110214FA55AB190D6B9AC55CB90

Function 007EA88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 007EA941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 007EA94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 007EA956

Strings

msctls_updown32, xrefs: 007EA8BB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: ad86df2e05039b376b7c4a1f6f6a92e489a99e60766c972ed2fb001a7d72e179
Instruction ID: 88fc2cbb9282f87e8edc78fe6c10604d052762236686f2816b21440ef100277b
Opcode Fuzzy Hash: ad86df2e05039b376b7c4a1f6f6a92e489a99e60766c972ed2fb001a7d72e179
Instruction Fuzzy Hash: 05219AB5200209BFDB11DF69CC85DA737ADEB5A3A8B050059FA049B2A2CB35FC11CB61

Function 007E99A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 007E9A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 007E9A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 007E9A65

Strings

Listbox, xrefs: 007E99FD

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 89ba7db065168df4ee650682fa572ad40b27f78ff9f57121406b10fc158f6c01
Instruction ID: 03858b6abcfdc1e6ed9db7efb3ac3744068d301b7386201dce6727f755a82e7f
Opcode Fuzzy Hash: 89ba7db065168df4ee650682fa572ad40b27f78ff9f57121406b10fc158f6c01
Instruction Fuzzy Hash: 8421F232601118BFDF218F55CC85EBB3BAAFF8D750F018129FA549B1A0C675AC11C7A0

Function 007EA409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 007EA46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 007EA482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 007EA48F

Strings

msctls_trackbar32, xrefs: 007EA444

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: eaf4fa52c4bf79bf8f4210f40a9abb8fd4ef024301f3f88df786de95f250c640
Instruction ID: bf4ddbcc9938f01de5037b80e1b76c2141f411359fdff1c7770f60fd542ce328
Opcode Fuzzy Hash: eaf4fa52c4bf79bf8f4210f40a9abb8fd4ef024301f3f88df786de95f250c640
Instruction Fuzzy Hash: 2A110A71240288BEEF205F69CC49FAB376DFF8D754F014118FA55960D1D2B6E811C720

Function 007A2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,007A2350,?), ref: 007A22A1
GetProcAddress.KERNEL32(00000000), ref: 007A22A8

Strings

RoInitialize, xrefs: 007A2290
combase.dll, xrefs: 007A229C

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: d6471e823299fff332621177edcc767a9182bf36249f80d5829dc83955ff6656
Instruction ID: 220035598d3ec5d0fd4f5dde4696b35adefc842d841d11d704d748b795ce751c
Opcode Fuzzy Hash: d6471e823299fff332621177edcc767a9182bf36249f80d5829dc83955ff6656
Instruction Fuzzy Hash: 17E086746A0300EBEBA05FB4ED8DB163664F746702F004421F242D61F0CBF88041CF04

Function 007A235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,007A2276), ref: 007A2376
GetProcAddress.KERNEL32(00000000), ref: 007A237D

Strings

RoUninitialize, xrefs: 007A2365
combase.dll, xrefs: 007A2371

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 0f42d88786177f34d079f37d63a1b80f17daed5fea72221046416a61759a8afb
Instruction ID: 49b94d5778fac1e40cf64d114eb7c7505b25f68b9f6484473060140ba2beff03
Opcode Fuzzy Hash: 0f42d88786177f34d079f37d63a1b80f17daed5fea72221046416a61759a8afb
Instruction Fuzzy Hash: B1E01778685300EFDBA4AFA0ED1DB063A65F756706F100824F249EA1F1CBBD9400CF14

Function 007FAC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007FAC60
__swprintf.LIBCMT ref: 007FAC94

Strings

WIN_XPe, xrefs: 007FACD3
%.3d, xrefs: 007FAC6E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: de4f43a482cb0ce72d73ee962c4f556c6daba1e2b1662f0f7e55fc9c90ef94b3
Instruction ID: 4e4bb92cf3cb967dcdada3322de735bbff2a9206e76c0aa43825e4943d41fe6f
Opcode Fuzzy Hash: de4f43a482cb0ce72d73ee962c4f556c6daba1e2b1662f0f7e55fc9c90ef94b3
Instruction Fuzzy Hash: BEE0ECB180461CEBCA519790DD059FA737CF704741F501092BA4AA1200D63DAB84EA22

Function 007E2205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007E21FB,?,007E23EF), ref: 007E2213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 007E2225

Strings

GetProcessId, xrefs: 007E221F
kernel32.dll, xrefs: 007E220E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: 1e2a73a59cb14f874aca7a4648f701a638d82a4acc47d70ff140586d613ec137
Instruction ID: d55c0542f80433a0d95c69f5171f38d99a7c9923086509bd9ec5db62d1b0d184
Opcode Fuzzy Hash: 1e2a73a59cb14f874aca7a4648f701a638d82a4acc47d70ff140586d613ec137
Instruction Fuzzy Hash: E0D0A7358017129FC7215F71F808601B6DCFF0C301F018419E852E2251DB78D88086A0

Function 007842F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,007842EC,?,007842AA,?), ref: 00784304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00784316

Strings

kernel32.dll, xrefs: 007842FF
Wow64RevertWow64FsRedirection, xrefs: 00784310

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: a69f406351425dd8b837ed50b4e58e8f6ca5781a9d7309838b1119bc15a14d1d
Instruction ID: 38a02238fb00ea0d7cf0e5d4877728c0af3e1862f464a55482c78edd3085294f
Opcode Fuzzy Hash: a69f406351425dd8b837ed50b4e58e8f6ca5781a9d7309838b1119bc15a14d1d
Instruction Fuzzy Hash: 4ED0A7304407139FC7206F60E80C601F6E4FF04301F008419F851E2660DBF8C8808790

Function 0078434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,007841BB,00784341,?,0078422F,?,007841BB,?,?,?,?,007839FE,?,00000001), ref: 00784359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0078436B

Strings

kernel32.dll, xrefs: 00784354
Wow64DisableWow64FsRedirection, xrefs: 00784365

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c53e58fcba33ba3b8a5d769cfe91ac6f4f915676b8caa06b7ad1f1f9f9fdd3be
Instruction ID: 8a5c414e2311900020b1726e482f31e7303f9f8d1f2ecf9418d7d90ee3874cb3
Opcode Fuzzy Hash: c53e58fcba33ba3b8a5d769cfe91ac6f4f915676b8caa06b7ad1f1f9f9fdd3be
Instruction Fuzzy Hash: 46D0A7304407139FC7206FB0E808601B6D4FF15715F008429E891E2650DBF8D8808790

Function 007C0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,007C052F,?,007C06D7), ref: 007C0572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 007C0584

Strings

UnRegisterTypeLibForUser, xrefs: 007C057E
oleaut32.dll, xrefs: 007C056D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: c10eef8b674cc07ee1155061ffd556055841734595050452c8b4db8a6822f823
Instruction ID: ed01b242a84301ec9538e4f89d389a5278a05fb68053e89f6659bfd7e736b186
Opcode Fuzzy Hash: c10eef8b674cc07ee1155061ffd556055841734595050452c8b4db8a6822f823
Instruction Fuzzy Hash: 24D09E705457129BDB606F65A808F42B7E4BB44711F10851DE855D2250DE78D4808BE0

Function 007C0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,007C051D,?,007C05FE), ref: 007C0547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 007C0559

Strings

RegisterTypeLibForUser, xrefs: 007C0553
oleaut32.dll, xrefs: 007C0542

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: e3029a744ec590b9e0e75bb5c726ea2e0573e3aec8b878af9bce327dfc478adf
Instruction ID: 9cb63bc0d3ee249b56914b2a388ecb998dec5fc5c895b74a7310050d51c5a3e7
Opcode Fuzzy Hash: e3029a744ec590b9e0e75bb5c726ea2e0573e3aec8b878af9bce327dfc478adf
Instruction Fuzzy Hash: 6BD09E745457129FD7609B65B808A41B7A4BB54711F10C41DE556D2350DE78C8808AD0

Function 007DECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007DECBE,?,007DEBBB), ref: 007DECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 007DECE8

Strings

GetSystemWow64DirectoryW, xrefs: 007DECE2
kernel32.dll, xrefs: 007DECD1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 6265f2191aef514f57b9a88ce4e3c1b57a7fa31fed49c6f60e23660b9813b041
Instruction ID: d592518b91a4d15ffdefeaa3078411954931f12ff56738b4527db702c83340f9
Opcode Fuzzy Hash: 6265f2191aef514f57b9a88ce4e3c1b57a7fa31fed49c6f60e23660b9813b041
Instruction Fuzzy Hash: 6ED0A7304117239FCB216FA0E848602B6F4FF04300F00C42AF859D2351DF78D88086A0

Function 007DBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,007DBAD3,00000001,007DB6EE,?,0081DC00), ref: 007DBAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 007DBAFD

Strings

kernel32.dll, xrefs: 007DBAE6
GetModuleHandleExW, xrefs: 007DBAF7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 335486781cddd9447bebf0cf685b68183a8810a3322834e103bf6cac87b7d98f
Instruction ID: 584b536927d2be7d3d136072315fa638a59a27c3965040c7429576e9be22bf27
Opcode Fuzzy Hash: 335486781cddd9447bebf0cf685b68183a8810a3322834e103bf6cac87b7d98f
Instruction Fuzzy Hash: 53D0A770900712DFC7705F60E849F15B6E4FF05300F01841BE853E2350DB78D880CA90

Function 007E3BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,007E3BD1,?,007E3E06), ref: 007E3BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007E3BFB

Strings

RegDeleteKeyExW, xrefs: 007E3BF5
advapi32.dll, xrefs: 007E3BE4

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: ee876e395a98c8c668cdc8b9bbd291f33068cf612bfceafcdbe366eb792fa6f1
Instruction ID: 97f5bc22d7c2feae3c8a95361b99436cd8f4617fa5ca224fa2b6d16e966d869d
Opcode Fuzzy Hash: ee876e395a98c8c668cdc8b9bbd291f33068cf612bfceafcdbe366eb792fa6f1
Instruction Fuzzy Hash: CFD0C7B05017529FD7605FA5E80D643FAF4FF59719F209419E455E32A0EAB8D8808EA0

Function 007B9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ee32d050a5568748e8ac958261fe068e879890a4fc7d6238933f9a8c5cc71a
Instruction ID: 415cfc7724b2a547eaf041b8f2ced51336df965f34eae73dc112b51e8724ff23
Opcode Fuzzy Hash: b6ee32d050a5568748e8ac958261fe068e879890a4fc7d6238933f9a8c5cc71a
Instruction Fuzzy Hash: 20C12D75A00219EFDB14DFA4C884BEEBBB5FF48710F108598EA15AB251D734EE41DBA0

Function 007DAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007DAAB4
CoUninitialize.OLE32 ref: 007DAABF

Part of subcall function 007C0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007C027B

VariantInit.OLEAUT32(?), ref: 007DAACA
VariantClear.OLEAUT32(?), ref: 007DAD9D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: fd64d14b00040121b04bfe8cc89a9e4b7cd18707534edbbab8c77dd791cd4736
Instruction ID: a45b4f6f885a0590ec06badb04d099ec18a01e6f72d17283b9583d997628b4a6
Opcode Fuzzy Hash: fd64d14b00040121b04bfe8cc89a9e4b7cd18707534edbbab8c77dd791cd4736
Instruction Fuzzy Hash: B6A11875204701EFCB11EF54C885B1AB7E5BF48720F14444AFA9A9B3A2CB38ED45CB96

Function 007B91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007B91DD
SysAllocString.OLEAUT32(?), ref: 007B9286
VariantCopy.OLEAUT32 ref: 007B92B5
VariantClear.OLEAUT32(?), ref: 007B92DC

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 73f512d471bae00f31933c0846bd0f68f11743806bc992bcdb7f86984cbc6e66
Instruction ID: 0544c1f138210bcea6f86acb8581091969e9a30d01df6f65126b112511906be8
Opcode Fuzzy Hash: 73f512d471bae00f31933c0846bd0f68f11743806bc992bcdb7f86984cbc6e66
Instruction Fuzzy Hash: 0E51B630604706DBDF24AF65D895BAEB7E5EF45314F20881FE766CB2E1EB3898808715

Function 007EC4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01516F90,?), ref: 007EC544
ScreenToClient.USER32(?,00000002), ref: 007EC574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 007EC5DA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 0d8ad08d5cb9d65787cdbc883e3f5ac6936fe266a916335bd85ec22ec86cb46e
Instruction ID: 8b0dc29be5409664bd1fd22d88233dc238a456a83dc9e9d979a949a759782386
Opcode Fuzzy Hash: 0d8ad08d5cb9d65787cdbc883e3f5ac6936fe266a916335bd85ec22ec86cb46e
Instruction Fuzzy Hash: 5B51A579901244EFCF11DF69C884AAE7BB5FF59320F208259F9259B290D734ED92CB90

Function 007BC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 007BC462
__itow.LIBCMT ref: 007BC49C

Part of subcall function 007BC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 007BC753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 007BC505
__itow.LIBCMT ref: 007BC55A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: fa43090553e6ad89677f8a600722571da784568feaa4c0b0c0b8bfb68bacd355
Instruction ID: 3d2de4427daa5afa7b3db207acd8e18bc236f5a8b99b1f6e567c0ea948076434
Opcode Fuzzy Hash: fa43090553e6ad89677f8a600722571da784568feaa4c0b0c0b8bfb68bacd355
Instruction Fuzzy Hash: 5741C971A00609EFDF22EF54C85AFEE7FB9AF49700F004059F905A7281DB789A55CBA1

Function 007C390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 007C3966
SetKeyboardState.USER32(00000080,?,00000001), ref: 007C3982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 007C39EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 007C3A4D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: caf28ea37ca37302ab6a840b6b3707d6d97a1c7155a5a83b7ae13a36af88f575
Instruction ID: b47572f2e2ce8a54e934194e76537034926daec771c0348a2321a91d8279a591
Opcode Fuzzy Hash: caf28ea37ca37302ab6a840b6b3707d6d97a1c7155a5a83b7ae13a36af88f575
Instruction Fuzzy Hash: 69411870A04248AEEF308B64C809FFDBBB5AB59314F04815EF8C1A62D1C7BC9E95D765

Function 007EB544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007EB5D1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 8a00e02efcbcd37b54a9d637ff4b52d55d7ca1f69b9b91ccf39ca36d4d31965f
Instruction ID: 84f00db9385039b28f815ed9311a001ca216f8cc6b913cf56e1599ca93803190
Opcode Fuzzy Hash: 8a00e02efcbcd37b54a9d637ff4b52d55d7ca1f69b9b91ccf39ca36d4d31965f
Instruction Fuzzy Hash: 7731B074603284BBEF209F5ACC89FAA7F65FB0E350F544502F651D61E1C738E9609B51

Function 007ED7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 007ED807
GetWindowRect.USER32(?,?), ref: 007ED87D
PtInRect.USER32(?,?,007EED5A), ref: 007ED88D
MessageBeep.USER32(00000000), ref: 007ED8FE

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 0ba5eda51c195e2a6b2b9db0d5154424a5e50c5b9d700bf84745efef4f924a86
Instruction ID: 21077131998c525307ff202e64737396975898244658e2ecaf5811704fb93e13
Opcode Fuzzy Hash: 0ba5eda51c195e2a6b2b9db0d5154424a5e50c5b9d700bf84745efef4f924a86
Instruction Fuzzy Hash: 6E41BC74A01298DFCF21DF9AC888BA97BF5FF59314F1981A9E8148B261D734ED41CB41

Function 007C3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 007C3AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 007C3AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 007C3B34
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 007C3B92

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: c52d23f01c32f61e37253f4b16c505dc9b77f757740b3560c6e4a7ea30d4b394
Instruction ID: fb533027d0ce309929a71eddda0fa903fbff1ac2b6b4a86fb99affc8c9dc9542
Opcode Fuzzy Hash: c52d23f01c32f61e37253f4b16c505dc9b77f757740b3560c6e4a7ea30d4b394
Instruction Fuzzy Hash: D73122B0A00358AEEF209FA48819FFE7BB9AB55310F04815EE481A32D2C77D9F45D761

Function 007B4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007B4038
__isleadbyte_l.LIBCMT ref: 007B4066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007B4094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007B40CA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 52a367209373c98f9a540e8876842ee1781cdbac107944a9d6831abdc0e5935b
Instruction ID: 0974835b5672b670b4e849e0678a77b64018c2c09f873bae93628a2d06fa4ba5
Opcode Fuzzy Hash: 52a367209373c98f9a540e8876842ee1781cdbac107944a9d6831abdc0e5935b
Instruction Fuzzy Hash: BB31C431600216EFDB21AF74C844BFA7BB5FF41310F1545A8EA658B1A2E735D891D790

Function 007E7CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007E7CB9

Part of subcall function 007C5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 007C5F6F
Part of subcall function 007C5F55: GetCurrentThreadId.KERNEL32 ref: 007C5F76
Part of subcall function 007C5F55: AttachThreadInput.USER32(00000000,?,007C781F), ref: 007C5F7D

GetCaretPos.USER32(?), ref: 007E7CCA
ClientToScreen.USER32(00000000,?), ref: 007E7D03
GetForegroundWindow.USER32 ref: 007E7D09

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: e817648b6ce585b86bf0bd3fae03aa0fda4481476e65ca322f30165b86b3737c
Instruction ID: 80a08f9feb1ea8196d513a63797a5c75137195d46e6d43dde240e6e309378cf4
Opcode Fuzzy Hash: e817648b6ce585b86bf0bd3fae03aa0fda4481476e65ca322f30165b86b3737c
Instruction Fuzzy Hash: 24311072900108AFDB01EFA9DC459EFBBFDEF59310B10846AE815E7211D635AE45CBA0

Function 007EF1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

GetCursorPos.USER32(?), ref: 007EF211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,007FE4C0,?,?,?,?,?), ref: 007EF226
GetCursorPos.USER32(?), ref: 007EF270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,007FE4C0,?,?,?), ref: 007EF2A6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 0f9aa6dc146ef626130e7d33013de5c833352310cce3eb2bd4ed4bfa561e2b99
Instruction ID: 46b3bc7735171a3ed37390030e508887dcd24e0ee916373f85a32c482ed605a9
Opcode Fuzzy Hash: 0f9aa6dc146ef626130e7d33013de5c833352310cce3eb2bd4ed4bfa561e2b99
Instruction Fuzzy Hash: 1021A039601118EFDF158F99DC58EEE7BB9FF0A310F044069FA05876A1D3389950DB50

Function 007D431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007D4358

Part of subcall function 007D43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007D4401
Part of subcall function 007D43E2: InternetCloseHandle.WININET(00000000), ref: 007D449E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 0f3af8f5a0fd25a13d99ba2efb3b4f85fde42332e75d482b6d2e5ef5c855ef1c
Instruction ID: e78fba885e8db17bd787dadfcaa6d0f677e2300dc04c89b343660b34e0929d15
Opcode Fuzzy Hash: 0f3af8f5a0fd25a13d99ba2efb3b4f85fde42332e75d482b6d2e5ef5c855ef1c
Instruction Fuzzy Hash: 9721A131200705BBEB119FA4DC04FBBB7B9FF44710F14411BFA55A6750DB7598219BA0

Function 007D8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 007D8AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 007D8AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 007D8AFF
WSAGetLastError.WSOCK32(00000000), ref: 007D8B16

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: db0c578f8f0d3a8a9b3d6d5fa880c53b24ad8a32e3ec8573b162439de9c8a937
Instruction ID: e9e6345c942cdacad04e049d36fc60a86968c2e4775b7884cac8b8e66f8fccd2
Opcode Fuzzy Hash: db0c578f8f0d3a8a9b3d6d5fa880c53b24ad8a32e3ec8573b162439de9c8a937
Instruction Fuzzy Hash: B8216672A001249FC7619F69D885A9E7BFCEF4A350F00416AF849D7291DB74D9418FA1

Function 007E8A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 007E8AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 007E8AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 007E8ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 007E8ADC

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: d9d5f794bed451657a0d8cffa2407ea90397a8b265d71a6d92559fa699f06d52
Instruction ID: c051b0af53ad81749aec50f8a0db585c57d1d25bb0455e6369992a76426ba7d4
Opcode Fuzzy Hash: d9d5f794bed451657a0d8cffa2407ea90397a8b265d71a6d92559fa699f06d52
Instruction Fuzzy Hash: 9911E631346510AFD754AB58CC09FBA7799FF89320F14811AF82AC72E2CF78AC018795

Function 007C0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007C1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,007C0ABB,?,?,?,007C187A,00000000,000000EF,00000119,?,?), ref: 007C1E77
Part of subcall function 007C1E68: lstrcpyW.KERNEL32(00000000,?,?,007C0ABB,?,?,?,007C187A,00000000,000000EF,00000119,?,?,00000000), ref: 007C1E9D
Part of subcall function 007C1E68: lstrcmpiW.KERNEL32(00000000,?,007C0ABB,?,?,?,007C187A,00000000,000000EF,00000119,?,?), ref: 007C1ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,007C187A,00000000,000000EF,00000119,?,?,00000000), ref: 007C0AD4
lstrcpyW.KERNEL32(00000000,?,?,007C187A,00000000,000000EF,00000119,?,?,00000000), ref: 007C0AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,007C187A,00000000,000000EF,00000119,?,?,00000000), ref: 007C0B2E

Strings

cdecl, xrefs: 007C0B25

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 5bf8101ac9c3c50df4086994365520d18dc734948a61ba845e9db8fa312b0233
Instruction ID: 787b17e77a5dadf0ffc3ed30e4ee17a5c5e7c0f9a97c95ad74a464c71673101a
Opcode Fuzzy Hash: 5bf8101ac9c3c50df4086994365520d18dc734948a61ba845e9db8fa312b0233
Instruction Fuzzy Hash: 0B117C76200305EFDB25AF64DC49E7A77A9FF49354B80416EE906CB2A0EB759C50C7E0

Function 007B2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007B2FB5

Part of subcall function 007A395C: __FF_MSGBANNER.LIBCMT ref: 007A3973
Part of subcall function 007A395C: __NMSG_WRITE.LIBCMT ref: 007A397A
Part of subcall function 007A395C: RtlAllocateHeap.NTDLL(014F0000,00000000,00000001,00000001,00000000,?,?,0079F507,?,0000000E), ref: 007A399F

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 2bff96020e7f495fa44ad12ffeed7738f72731a08cd9b3fbfd908d1f77adc6e7
Instruction ID: 68551a47df7cff175dbbd991bca8227034b5e676dc0215291ad4191e7bd1da07
Opcode Fuzzy Hash: 2bff96020e7f495fa44ad12ffeed7738f72731a08cd9b3fbfd908d1f77adc6e7
Instruction Fuzzy Hash: 9011CA31509315EFDB353FB4AC097AA3F99BF45370F204A25F9499A152DB3CC981DAA0

Function 007C058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007C05AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 007C05C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007C05DD
FreeLibrary.KERNEL32(?), ref: 007C0632

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: f7fa584a51e84f8c73631318de2ca14e9e30b69d0dbdd0125aaefdef1843b8c1
Instruction ID: 8467dd1a538cac89ccafff4b5c456946176bd9aa8ced4b8a479785ff5aec65e5
Opcode Fuzzy Hash: f7fa584a51e84f8c73631318de2ca14e9e30b69d0dbdd0125aaefdef1843b8c1
Instruction Fuzzy Hash: 32215971900209EBDB20CFA1EC88FDABBB8EF40700F00846DE516A2150DB78EA559BD1

Function 007C6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 007C6733
_memset.LIBCMT ref: 007C6754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007C67A6
CloseHandle.KERNEL32(00000000), ref: 007C67AF

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: fb656e60d3635c5eb2783257e7c1c7ec71bc0fef99699186eb99ca9df78ba615
Instruction ID: 07c4c5212c5cfa751c66479bc13628ca9cdab8a3713cf8e02b1f976ef358fe70
Opcode Fuzzy Hash: fb656e60d3635c5eb2783257e7c1c7ec71bc0fef99699186eb99ca9df78ba615
Instruction Fuzzy Hash: C8110A729012287AE72057A5AC4DFABBBBCEF44724F10459AF504E71C0D2745E808BA4

Function 007BB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007BAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007BAA79
Part of subcall function 007BAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007BAA83
Part of subcall function 007BAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007BAA92
Part of subcall function 007BAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007BAA99
Part of subcall function 007BAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007BAAAF

GetLengthSid.ADVAPI32(?,00000000,007BADE4,?,?), ref: 007BB21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007BB227
HeapAlloc.KERNEL32(00000000), ref: 007BB22E
CopySid.ADVAPI32(?,00000000,?), ref: 007BB247

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: c0153190dfe2613eab9ac201eb0e1e1838cb7121d163772a080b16bd27fd8b19
Instruction ID: 97dc430e804c6810061f0582d0ce9080da942222ea5768fca1116a9d8415ba06
Opcode Fuzzy Hash: c0153190dfe2613eab9ac201eb0e1e1838cb7121d163772a080b16bd27fd8b19
Instruction Fuzzy Hash: EA118C71A00205FFDB049F98DC85BEEB7A9FF85304B14802DE94297210D779AE44CB20

Function 007BB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 007BB498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007BB4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007BB4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007BB4DB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 0c89fcf78b1503f478f10250309d7249213e3b3abb4a4410a68bc42f68fd7c71
Instruction ID: 8f77ee4fa925751981d6a37bf907ad2adb675c8398a5e9ddec6c6ce4de70b2a5
Opcode Fuzzy Hash: 0c89fcf78b1503f478f10250309d7249213e3b3abb4a4410a68bc42f68fd7c71
Instruction Fuzzy Hash: F111067A900218FFDB11DBA9C985FDDBBB4FB08710F204091EA04A7295D771AE11DB94

Function 0079B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0079B5A5
GetClientRect.USER32(?,?), ref: 007FE69A
GetCursorPos.USER32(?), ref: 007FE6A4
ScreenToClient.USER32(?,?), ref: 007FE6AF

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f989222754ce3d621b7f61c39795860db1f89f7046b3ff06a55bb0c02070589a
Instruction ID: 675c29380781ae550aaf52360af009800062eb3a2040e5263e715d9fcd697ede
Opcode Fuzzy Hash: f989222754ce3d621b7f61c39795860db1f89f7046b3ff06a55bb0c02070589a
Instruction Fuzzy Hash: CA112531900129FBCF10DFA8ED499AE77B9FB09304F410451E911E7150D738AA91CBA1

Function 007C732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007C7352
MessageBoxW.USER32(?,?,?,?), ref: 007C7385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 007C739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007C73A2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 85efe458a49ce28ea6c4e9dcce4898183e0e9c40478a4c0e5eacefcfc7be5e96
Instruction ID: 077e78988b34fddca038ff285ed7d378c6ecfd4d980032c930f41b3dc757d2cd
Opcode Fuzzy Hash: 85efe458a49ce28ea6c4e9dcce4898183e0e9c40478a4c0e5eacefcfc7be5e96
Instruction Fuzzy Hash: E711E176A04294BBC7059BA8DC09F9E7BA9AB46321F044319FC21D32A1DAB48D00DBA0

Function 0079D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0079D1BA
GetStockObject.GDI32(00000011), ref: 0079D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 0079D1D8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 74210cab1d85ea94d32d912a66161b118571cd4887f80fd42b1866eb6913ccb1
Instruction ID: 79755299904e2f9b3f1515b34803bd27c08b063a926d56a238832c279aaeab18
Opcode Fuzzy Hash: 74210cab1d85ea94d32d912a66161b118571cd4887f80fd42b1866eb6913ccb1
Instruction Fuzzy Hash: C611ADB314160DBFEF224F90AC54EEABB6AFF19364F060101FA1552160C735DC60DBA0

Function 007B4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 007B4E16

Part of subcall function 007B54F5: __fltout2.LIBCMT ref: 007B551E

__cftog_l.LIBCMT ref: 007B4E3C
__cftoe_l.LIBCMT ref: 007B4E6E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: c12b0ae4d5809a3df5ae6567f778776726a92e3a34c9bc122038881e008e5def
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: C001483200014AFBCF125E94DC05AEE3F63BB18354B588455FA2859132D33ADAB2AB81

Function 007A7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007A7A0D: __getptd_noexit.LIBCMT ref: 007A7A0E

__lock.LIBCMT ref: 007A748F
InterlockedDecrement.KERNEL32(?), ref: 007A74AC
_free.LIBCMT ref: 007A74BF
InterlockedIncrement.KERNEL32(01501E80), ref: 007A74D7

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: e1d514f1c11c5508748932eb0eee55d3c604867ced9c53bb38c977329e637c06
Instruction ID: 1b23ef13ea333e974f4a17eb8cbcc2c26c1ce453dcd3001928301210fbad9405
Opcode Fuzzy Hash: e1d514f1c11c5508748932eb0eee55d3c604867ced9c53bb38c977329e637c06
Instruction Fuzzy Hash: 5201C43290AB11EBD719AF649C0A75DBB60BFCA721F154219F454B7780D72C5901CFD2

Function 007A7A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 007A7AD8

Part of subcall function 007A7CF4: __mtinitlocknum.LIBCMT ref: 007A7D06
Part of subcall function 007A7CF4: EnterCriticalSection.KERNEL32(00000000,?,007A7ADD,0000000D), ref: 007A7D1F

InterlockedIncrement.KERNEL32(?), ref: 007A7AE5
__lock.LIBCMT ref: 007A7AF9
___addlocaleref.LIBCMT ref: 007A7B17

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: b36103aa7fb0699943a9bd339add47bcad7dfd8a50bf24c2870def94bd082450
Instruction ID: 59de1988c282d82db802a5f9f282196beda03c08c693db24e1defad3db66f040
Opcode Fuzzy Hash: b36103aa7fb0699943a9bd339add47bcad7dfd8a50bf24c2870def94bd082450
Instruction Fuzzy Hash: B4015EB2504B00DED764DF75C90A74AB7F0FF91321F208A0EA495966A0DB78A644CB51

Function 007EE32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007EE33D
_memset.LIBCMT ref: 007EE34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00843D00,00843D44), ref: 007EE37B
CloseHandle.KERNEL32 ref: 007EE38D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 6fb57c0f02864bf2c2dd040d698e6ffa1c7db52ceaf4ddd9cb990894fcc9e4af
Instruction ID: 1fcd332e51f4d10944f5e2a22a830de609cad03cdd86cc06eacf97964d43d3a4
Opcode Fuzzy Hash: 6fb57c0f02864bf2c2dd040d698e6ffa1c7db52ceaf4ddd9cb990894fcc9e4af
Instruction Fuzzy Hash: 51F082F5A40304BEF3501BA5AC49F777E6CFB06758F004421FF08E61A2E379AE0086A8

Function 007EEA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0079AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0079AFE3
Part of subcall function 0079AF83: SelectObject.GDI32(?,00000000), ref: 0079AFF2
Part of subcall function 0079AF83: BeginPath.GDI32(?), ref: 0079B009
Part of subcall function 0079AF83: SelectObject.GDI32(?,00000000), ref: 0079B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 007EEA8E
LineTo.GDI32(00000000,?,?), ref: 007EEA9B
EndPath.GDI32(00000000), ref: 007EEAAB
StrokePath.GDI32(00000000), ref: 007EEAB9

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 882331a31ff909ebb69ecc39f611e0f663ab0d698f62d7d21bb2f3acacfe6186
Instruction ID: 35fa263e6a9a60bc4950d1f0d11d9472983768b1865e430edf6a7a5a8cb955a2
Opcode Fuzzy Hash: 882331a31ff909ebb69ecc39f611e0f663ab0d698f62d7d21bb2f3acacfe6186
Instruction Fuzzy Hash: A9F05E32006759BBDF129F94AC0DFCA3F19BF1A311F048101FE15610E187789551CBD5

Function 007BC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 007BC84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 007BC85D
GetCurrentThreadId.KERNEL32 ref: 007BC864
AttachThreadInput.USER32(00000000), ref: 007BC86B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 3dbb238a08cc04888fb9438387a2ec51aeef41a90fcb55cd8b9d42cc5f950704
Instruction ID: 29af3139a23fd11f265c155fa1c8d98d76ed0cb7dc264ec60a73e87cc82b5286
Opcode Fuzzy Hash: 3dbb238a08cc04888fb9438387a2ec51aeef41a90fcb55cd8b9d42cc5f950704
Instruction Fuzzy Hash: 22E03972142328BADB211BA29C0DFDB7F1CEF167A1F008021B61985461C7B68580CBE0

Function 007BB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 007BB0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,007BAC9D), ref: 007BB0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007BAC9D), ref: 007BB0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,007BAC9D), ref: 007BB0F1

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: a0990a72b4db2ab68927f9853cdbf6b93825dda2999af62d0468b543d343e6e2
Instruction ID: 0eb10264f9447372b6f281f39ed268776d0c791f4f96de2e0da912150a4163df
Opcode Fuzzy Hash: a0990a72b4db2ab68927f9853cdbf6b93825dda2999af62d0468b543d343e6e2
Instruction Fuzzy Hash: 6BE086736013119BD7602FF25C0DB973BACFF55791F018818F645D6040EB789401C760

Function 0079B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0079B496
SetTextColor.GDI32(?,000000FF), ref: 0079B4A0
SetBkMode.GDI32(?,00000001), ref: 0079B4B5
GetStockObject.GDI32(00000005), ref: 0079B4BD
GetWindowDC.USER32(?,00000000), ref: 007FDE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 007FDE38
GetPixel.GDI32(00000000,?,00000000), ref: 007FDE51
GetPixel.GDI32(00000000,00000000,?), ref: 007FDE6A
GetPixel.GDI32(00000000,?,?), ref: 007FDE8A
ReleaseDC.USER32(?,00000000), ref: 007FDE95

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: b625ea6a479a70864869c4fe1368db5c992b75bddcf7a10dbd1bd01230c7d134
Instruction ID: f053947c17e3393826076e7cec5fbbff945969cc5389d3a80add98806ebaff14
Opcode Fuzzy Hash: b625ea6a479a70864869c4fe1368db5c992b75bddcf7a10dbd1bd01230c7d134
Instruction Fuzzy Hash: 9CE0ED31100344EEDF615BA4BC0DBE87F11AB55339F14C666FB69580E2C7754991DB11

Function 007BB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 007BB2DF
UnloadUserProfile.USERENV(?,?), ref: 007BB2EB
CloseHandle.KERNEL32(?), ref: 007BB2F4
CloseHandle.KERNEL32(?), ref: 007BB2FC

Part of subcall function 007BAB24: GetProcessHeap.KERNEL32(00000000,?,007BA848), ref: 007BAB2B
Part of subcall function 007BAB24: HeapFree.KERNEL32(00000000), ref: 007BAB32

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f86f04c673f9affd3c6c4ec35daf1dc3c95c4ec850cdeae0c20fa4ea79d776ed
Instruction ID: 50fba8ed39d62e1ba1c8d5674e9badd2d225eeeb7ed50977180854c0af22d8b3
Opcode Fuzzy Hash: f86f04c673f9affd3c6c4ec35daf1dc3c95c4ec850cdeae0c20fa4ea79d776ed
Instruction Fuzzy Hash: 80E0B63A104205BBCB412BE5EC08859FFA6FF883213109221F62581671DB32A871EB91

Function 007FB29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 007FB29A
GetDC.USER32(00000000), ref: 007FB2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007FB2C3
ReleaseDC.USER32 ref: 007FB2E2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8eac0dc482db1dd6c70f33ba07ebf04f3a406b9b439d8d21fe99d0ec97b0ae2a
Instruction ID: e461504efe845360b90e6ee7df3553639a3ade5b53d72dde86e69cc6eacc4895
Opcode Fuzzy Hash: 8eac0dc482db1dd6c70f33ba07ebf04f3a406b9b439d8d21fe99d0ec97b0ae2a
Instruction Fuzzy Hash: 29E046B1100304EFEB406FB0D84CA2E7BA9FB5C360F11C80AFD6A8B211CB7998418B90

Function 007FB2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 007FB2AE
GetDC.USER32(00000000), ref: 007FB2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007FB2C3
ReleaseDC.USER32 ref: 007FB2E2

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: b6638b370f57b0b9926cb8ed503cf73154c71e8756e3ae4bdf9ce0c3a0990b2b
Instruction ID: 86ac0b73cccf8fb185990b08906605ff74cadc3bedbb35608dfd4a322328fafa
Opcode Fuzzy Hash: b6638b370f57b0b9926cb8ed503cf73154c71e8756e3ae4bdf9ce0c3a0990b2b
Instruction Fuzzy Hash: 27E046B1500300EFDF406FB0D84C62D7BA9FB5C360F118809F96E8B211CB7AA8418B90

Function 007BDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 007BDEAA

Strings

AutoIt3GUI, xrefs: 007BDE22
Container, xrefs: 007BDE29

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 6629223845554e8a63eec5a624b6f5c650555879c751f4f4d41aa51d47d5ece5
Instruction ID: 43468780838f3523a796033b4fbc3aab732ea2c1e4d51787cb60a498ff08ca01
Opcode Fuzzy Hash: 6629223845554e8a63eec5a624b6f5c650555879c751f4f4d41aa51d47d5ece5
Instruction Fuzzy Hash: 26912870600601DFDB24CF64C888BAAB7B5FF49710F10856EF95ACB291EB74E841CB50

Function 0079BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0079BCDA
GlobalMemoryStatusEx.KERNEL32 ref: 0079BCF3

Strings

@, xrefs: 0079BCE8

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 5eb9f90e3eaae62a60874854045acf4fb517c0e08defd72f10dcaf1232b54c8b
Instruction ID: b7a6c8cf347f3599b2d6e665a4435db1d4e9540359cb1979e32b564f8a3239e0
Opcode Fuzzy Hash: 5eb9f90e3eaae62a60874854045acf4fb517c0e08defd72f10dcaf1232b54c8b
Instruction Fuzzy Hash: 03513771409744EBE720AF14E88ABAFBBE8FF95354F414C4DF1C8410A2EB7495A9C762

Function 007CC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 007844ED: __fread_nolock.LIBCMT ref: 0078450B

_wcscmp.LIBCMT ref: 007CC65D
_wcscmp.LIBCMT ref: 007CC670

Strings

FILE, xrefs: 007CC5A5

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 46f165d6458b91fe2c0cb1f13891b55d99cf3b5abb8dacd6316c902ecf0e9622
Instruction ID: 03b73194dc57e3080788f470180c210666dba14144240cc76631fb5f44df2dec
Opcode Fuzzy Hash: 46f165d6458b91fe2c0cb1f13891b55d99cf3b5abb8dacd6316c902ecf0e9622
Instruction Fuzzy Hash: 3141D672A4020AFADF11AAA4DC46FEF77B9EF49714F00006DF605F7181D6B99A048B55

Function 007EA76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 007EA85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007EA86F

Strings

', xrefs: 007EA7C3

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: a173c62ea1d93247777df43b1a3114b328b675a0b0c59bf51f01aafe168db9c3
Instruction ID: 0dc3404ddd04ba22a0a8729bd25f3c79661b4db24dee49a1af08c1361a42026c
Opcode Fuzzy Hash: a173c62ea1d93247777df43b1a3114b328b675a0b0c59bf51f01aafe168db9c3
Instruction Fuzzy Hash: 2E410774E01349AFDB54CFA9C880BDA7BB9FB09300F11006AE905EB341D774A941CFA1

Function 007E975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 007E980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 007E984A

Strings

static, xrefs: 007E97AA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 64ccdee6ef5b66dbe888bc2a6d870913ad38714bbca418def9b79b53dd1da9c2
Instruction ID: 6a4e426f0d92b173c34637853c70f211f3b0bdfe67bab8d9bb8f190a6a82111f
Opcode Fuzzy Hash: 64ccdee6ef5b66dbe888bc2a6d870913ad38714bbca418def9b79b53dd1da9c2
Instruction Fuzzy Hash: F6317E72110644AAEB109F75DC84BFB73A9FF5D760F008619F9A9C7191DA39AC81C760

Function 007C5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C51C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007C5201

Strings

0, xrefs: 007C51BF

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 366cf264d6d78c0e7d9a716aef6728228f1b44c00f3c0586d8d715140f83088a
Instruction ID: ef4b7b511a16d4fd200d54f398e656f10b010951fdd717fcd2a57c7784027055
Opcode Fuzzy Hash: 366cf264d6d78c0e7d9a716aef6728228f1b44c00f3c0586d8d715140f83088a
Instruction Fuzzy Hash: 4131B4B1600704DBEB24CF99D849FAEBBF8FF45350F14402DE985E61A0E779AA84DB50

Function 007D658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 007D6608

Strings

, $, xrefs: 007D6648
AUTOITCALLVARIABLE%d, xrefs: 007D65FA

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: e7b713e5e08e6cd5495584e03a7c844c5814b8e72ca47e158f01145b21faf4ae
Instruction ID: 38f403312f132374bd1712bd656ff59c507bd6ea5477e9d1c15bed6a01d9331d
Opcode Fuzzy Hash: e7b713e5e08e6cd5495584e03a7c844c5814b8e72ca47e158f01145b21faf4ae
Instruction Fuzzy Hash: D0216F71A40218EBCF10EFA4C88AEAE77B5BF45740F00045AF505EB281DB78EA45CBA1

Function 007E93CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 007E945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007E9467

Strings

Combobox, xrefs: 007E9429

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 4e6453384202b6a202f8b6830c0a4250944ed51a09f16427ad4717ad83a08a2b
Instruction ID: 597039852e248efc33713c61860bf680152d7c1ce3f4733a7ed153a238ebfbd6
Opcode Fuzzy Hash: 4e6453384202b6a202f8b6830c0a4250944ed51a09f16427ad4717ad83a08a2b
Instruction Fuzzy Hash: 9111B6B2301288AFEF119E55DC80EBB376EFB5D3A4F100125FA14972D0D639DC528760

Function 007EDA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0079B34E: GetWindowLongW.USER32(?,000000EB), ref: 0079B35F

GetActiveWindow.USER32 ref: 007EDA7B
EnumChildWindows.USER32(?,007ED75F,00000000), ref: 007EDAF5

Strings

T1}, xrefs: 007EDAFB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: T1}
API String ID: 3814560230-2082297165
Opcode ID: 78e8c30b55d553da2492ac4fb0083b3d6537dcf340c1147e4c6d70492813ba4a
Instruction ID: 4a4f312a458fbd932a8bb86f0e325cd15fdce9094450063b8dc36fbbce67885f
Opcode Fuzzy Hash: 78e8c30b55d553da2492ac4fb0083b3d6537dcf340c1147e4c6d70492813ba4a
Instruction Fuzzy Hash: 60213D79205245DFCB24DF69E854AA673E5FB5A320F160619E969873E0E734AC40CB50

Function 007E98FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0079D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0079D1BA
Part of subcall function 0079D17C: GetStockObject.GDI32(00000011), ref: 0079D1CE
Part of subcall function 0079D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0079D1D8

GetWindowRect.USER32(00000000,?), ref: 007E9968
GetSysColor.USER32(00000012), ref: 007E9982

Strings

static, xrefs: 007E9945

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 6ec5dd0a231b3d4fa9a688f76674a9e9bf6e08922a88bbfd942e16651c4e077e
Instruction ID: e469c17662301380a0c6bfa231f5968dffb1532d152cfd7e549a2c8bfc4a775b
Opcode Fuzzy Hash: 6ec5dd0a231b3d4fa9a688f76674a9e9bf6e08922a88bbfd942e16651c4e077e
Instruction Fuzzy Hash: BF113A72510209AFDF14DFB8CC45AEA7BA8FB4C344F014629FA55D3251E739E850DB60

Function 007E9617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007E9699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007E96A8

Strings

edit, xrefs: 007E967D

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: acfb0096ea28c69db2b300f80df2f9f9b89afe87ab411ca9ec3d4a318b543e43
Instruction ID: afef9080264aa74878f86cea76d150ae8af361502ac3f38cd5072ddc35144cda
Opcode Fuzzy Hash: acfb0096ea28c69db2b300f80df2f9f9b89afe87ab411ca9ec3d4a318b543e43
Instruction Fuzzy Hash: 49119A72102248AAEF108FA5DC44AEB3B6AFB09368F100716FA24971E0C739DC909760

Function 007C5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C52D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007C52F4

Strings

0, xrefs: 007C52CE

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 415a4ea95fbf24cb99cf4427a1a6549692c4a15346d728f19e004389c1ddb33f
Instruction ID: c797ad70d51433531315168fc96789f8baa35e2252cca963c3fdb8c1773434bf
Opcode Fuzzy Hash: 415a4ea95fbf24cb99cf4427a1a6549692c4a15346d728f19e004389c1ddb33f
Instruction Fuzzy Hash: D711D076A01654ABDB20DA98D908F9977E8BB46794F04002DE942E7290D3BABD84C790

Function 007D4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 007D4DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 007D4E1E

Strings

<local>, xrefs: 007D4DE6

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: dabe6c27353ad0850e7a78505c003cbdeb1dd192d944fe3f54d74fb833f797e7
Instruction ID: d78dd9161f8a8863954133f23529d1b5bcfe1c29f1e2168e52bf213bebb33a2e
Opcode Fuzzy Hash: dabe6c27353ad0850e7a78505c003cbdeb1dd192d944fe3f54d74fb833f797e7
Instruction Fuzzy Hash: A6117C70601221BBDB258FA1C889EFBFBB9FF16755F10822BF655A6240D3785980C6E0

Function 007DA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 007DA84E
htons.WSOCK32(00000000,?,00000000), ref: 007DA88B

Strings

255.255.255.255, xrefs: 007DA866

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 023429f0a2bde9030b184f9f94105e2c80cde876c68199a10c126a6e0e7f260d
Instruction ID: 3a8c398b362020040db4cd113efd507b940c5ff1233a01fae59288e9cda0c37a
Opcode Fuzzy Hash: 023429f0a2bde9030b184f9f94105e2c80cde876c68199a10c126a6e0e7f260d
Instruction Fuzzy Hash: 4F01D275200304BBCB12AFA8C89AFA9B374FF45314F10842BF9169B3D1D779E8059752

Function 007BB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 007BB7EF

Strings

ListBox, xrefs: 007BB7B9
ComboBox, xrefs: 007BB78B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 4b72ee0b7ed677f9d529022a18f085400eb74b43fcdf8fc3d5b47e59289f6286
Instruction ID: 6db9b92131b9b2ba4f316088bb7106be9cb32c10472bdf6e503690589836d0df
Opcode Fuzzy Hash: 4b72ee0b7ed677f9d529022a18f085400eb74b43fcdf8fc3d5b47e59289f6286
Instruction Fuzzy Hash: D301D4B5640114EBCB15FBA4CC56AFE33A9BF45350B04061DF872A72D2EFB8591887A0

Function 007BB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 007BB6EB

Strings

ListBox, xrefs: 007BB6B5
ComboBox, xrefs: 007BB687

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: fef8cf8572f640efaad7827d3ea9bb9662e32f57d9b2069b65499ee282c0c883
Instruction ID: 3f324696c36f95c18572ed80c4ed89e69551f5a114f2380dd109d90539da09c4
Opcode Fuzzy Hash: fef8cf8572f640efaad7827d3ea9bb9662e32f57d9b2069b65499ee282c0c883
Instruction Fuzzy Hash: DE01A2B5681104ABCB15FBA4C957BFE73A8AF05348F100029B902B3281EBAC5E1887F5

Function 007BB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 007BB76C

Strings

ListBox, xrefs: 007BB738
ComboBox, xrefs: 007BB70A

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 8c9c4988c3b551bf03770aad125e13d588a3e93a8f56e6617dc6a65d5c02e39b
Instruction ID: 79cc427381929a7442daa7a63e55f61089ef515b096e8d77b96596eab6781f59
Opcode Fuzzy Hash: 8c9c4988c3b551bf03770aad125e13d588a3e93a8f56e6617dc6a65d5c02e39b
Instruction Fuzzy Hash: F001D1B5680104EBCB11FBA4C906FFE73ACAF05344F10001AB802B3292EFAC5E1987B5

Function 00784024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadImageW.USER32(00780000,00000063,00000001,00000010,00000010,00000000), ref: 00784048
EnumResourceNamesW.KERNEL32(00000000,0000000E,007C67E9,00000063,00000000,76950280,?,?,00783EE1,?,?,000000FF), ref: 007F41B3

Strings

>x, xrefs: 00784028

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: EnumImageLoadNamesResource
String ID: >x
API String ID: 1578290342-4213864175
Opcode ID: 1970ae22492b7166c9ead6f294e684ae23613b1cd36651936813fc38cec22e8f
Instruction ID: 8d480c9d1c98c85ad852dbe09c59762f4eedbf9524ad67894a53d11213156ddc
Opcode Fuzzy Hash: 1970ae22492b7166c9ead6f294e684ae23613b1cd36651936813fc38cec22e8f
Instruction Fuzzy Hash: 55F06D79790315B7EA205B1ABC4EF933EA9B706BB9F10051AF614AA1D0D2F490C0CB90

Function 007C7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007C7762
_wcscmp.LIBCMT ref: 007C7774

Strings

#32770, xrefs: 007C776E

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: a4ef8d438b9b7d1043d244f9a061ecbda97aeb68359cd7529ebff9e91a3c4d26
Instruction ID: a8aa1b2915a4cb8cd65732058e90b8fd510453e619b956eda9c4cb891d054a52
Opcode Fuzzy Hash: a4ef8d438b9b7d1043d244f9a061ecbda97aeb68359cd7529ebff9e91a3c4d26
Instruction Fuzzy Hash: DEE09277A043286BD710AAE5EC0AE87FBACFBA1764F00011AB915E3181EA64A601C7D4

Function 007BA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 007BA63F

Part of subcall function 007A13F1: _doexit.LIBCMT ref: 007A13FB

Strings

AutoIt, xrefs: 007BA633
Error allocating memory., xrefs: 007BA638

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 2cfdd7bd730472a9b097fbd9d4ea636cc84e08c4c4e7db41cf2b240ea8f3ce00
Instruction ID: 93652eccb52545cf2e314fe2b183971c25d1755a67301f2e6e694589511632b4
Opcode Fuzzy Hash: 2cfdd7bd730472a9b097fbd9d4ea636cc84e08c4c4e7db41cf2b240ea8f3ce00
Instruction Fuzzy Hash: C8D05B323C432873DA1436A87C1FFC5764CDF55B65F044015FB18D55C249DE959042D9

Function 007FAE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 007FACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 007FAEBD

Strings

WIN_XPe, xrefs: 007FACD3

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 8f142872ae15b2bca6650c965335b199f77e40616d4ba089d2d2001503376fad
Instruction ID: 982ac650a1642a6a2f095fb3eb7bc3c274a37b41aa409866741ca63e37527a36
Opcode Fuzzy Hash: 8f142872ae15b2bca6650c965335b199f77e40616d4ba089d2d2001503376fad
Instruction Fuzzy Hash: 6EE0C9B0C04649EFCB52DBA5D9449ECF7B8AB48301F549086E256B2260DB746A84DF36

Function 007E86CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007E86E2
PostMessageW.USER32(00000000), ref: 007E86E9

Part of subcall function 007C7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007C7AD0

Strings

Shell_TrayWnd, xrefs: 007E86DB

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 82e8a26a2fa4d21281c18462ba0a3c6cf2be2673f16cdc90049e620aac0e1608
Instruction ID: e8b807b1540b4c150304ffe48a357cbe60f8a88e180cc279712d913a27b8cff8
Opcode Fuzzy Hash: 82e8a26a2fa4d21281c18462ba0a3c6cf2be2673f16cdc90049e620aac0e1608
Instruction Fuzzy Hash: C4D01271385714BBF3A867B09C0FFCA7B18BB54B11F500819B755EA1D0C9E5E940CB94

Function 007E8698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007E86A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 007E86B5

Part of subcall function 007C7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 007C7AD0

Strings

Shell_TrayWnd, xrefs: 007E869B

Memory Dump Source

Source File: 00000000.00000002.2181698901.0000000000781000.00000020.00000001.01000000.00000003.sdmp, Offset: 00780000, based on PE: true

Associated: 00000000.00000002.2181671237.0000000000780000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000080D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182148354.000000000082E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182211026.000000000083A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182235452.0000000000844000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_780000_DHL_Doc.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: aa077f6ced309d175b7e61cb9701ead184f7c7cefbfb20c9de0648903652091f
Instruction ID: 844a3b7cc343c2ab57b13eddd49fc22e376e36530e50d6eb15213573a60c3991
Opcode Fuzzy Hash: aa077f6ced309d175b7e61cb9701ead184f7c7cefbfb20c9de0648903652091f
Instruction Fuzzy Hash: 8DD01271384714BBE3A867B09C0FFCA7B18BB54B11F100819B759EA1D0C9E5E940CB94

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL_Doc.9787653446578978656879764534576879764545766456.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut3EFA.tmp

C:\Users\user\AppData\Local\Temp\outbluffed

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
DHL_Doc.9787653446578978656879764534576879764545766456.exe

Function 007AB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00783D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Function 0079DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 0078406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 007CFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 007CBFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316
fileCOMMON

Function 00783F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00783742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00783E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 0174BE88 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 007849FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 007836B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 0174BC48 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
fileCOMMON

Function 007851AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre