Edit tour

Windows Analysis Report
uLFOeGZaJS.exe

Overview

General Information

Sample name:	uLFOeGZaJS.exe renamed because original name is a hash value
Original sample name:	455c4725e43d0a0336232373e7ff05968a4ce178ec845263237880781c4456ea.exe
Analysis ID:	1567463
MD5:	ec02b1d48f34dfa40ef212f737738d5e
SHA1:	644d63dcc57b3a82727122a152e9db6a1a97101f
SHA256:	455c4725e43d0a0336232373e7ff05968a4ce178ec845263237880781c4456ea
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

uLFOeGZaJS.exe (PID: 1264 cmdline: "C:\Users\user\Desktop\uLFOeGZaJS.exe" MD5: EC02B1D48F34DFA40EF212F737738D5E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "admin@ercolina-usa.com", "Password": ",%EVY$JU0=lu"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
uLFOeGZaJS.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
uLFOeGZaJS.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
uLFOeGZaJS.exe	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
uLFOeGZaJS.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36061:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3617d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36259:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3637f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
uLFOeGZaJS.exe	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x33095:$s2: GetPrivateProfileString 0x326cb:$s3: get_OSFullName 0x33e9d:$s5: remove_Key 0x34033:$s5: remove_Key 0x34f6a:$s6: FtpWebRequest 0x35fd1:$s7: logins 0x36543:$s7: logins 0x39220:$s7: logins 0x39300:$s7: logins 0x3adcd:$s7: logins 0x39e9a:$s9: 1.85 (Hash, version 2, native byte-order)

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: uLFOeGZaJS.exe PID: 1264	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: uLFOeGZaJS.exe PID: 1264	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.uLFOeGZaJS.exe.c90000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.uLFOeGZaJS.exe.c90000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.uLFOeGZaJS.exe.c90000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.0.uLFOeGZaJS.exe.c90000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x35fef:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x36061:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x360eb:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x3617d:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x361e7:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x36259:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x362ef:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3637f:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.0.uLFOeGZaJS.exe.c90000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x33095:$s2: GetPrivateProfileString 0x326cb:$s3: get_OSFullName 0x33e9d:$s5: remove_Key 0x34033:$s5: remove_Key 0x34f6a:$s6: FtpWebRequest 0x35fd1:$s7: logins 0x36543:$s7: logins 0x39220:$s7: logins 0x39300:$s7: logins 0x3adcd:$s7: logins 0x39e9a:$s9: 1.85 (Hash, version 2, native byte-order)

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uLFOeGZaJS.exe

Avira: detected

Found malware configuration

Source: uLFOeGZaJS.exe

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.ercolina-usa.com", "Username": "admin@ercolina-usa.com", "Password": ",%EVY$JU0=lu"}

Multi AV Scanner detection for submitted file

Source: uLFOeGZaJS.exe

ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: uLFOeGZaJS.exe

Joe Sandbox ML: detected

Source: uLFOeGZaJS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49704 version: TLS 1.2

Source: uLFOeGZaJS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: uLFOeGZaJS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 192.254.225.136 192.254.225.136
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ftp.ercolina-usa.com

Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ercolina-usa.com
Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.ercolina-usa.com
Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: uLFOeGZaJS.exe	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: uLFOeGZaJS.exe	String found in binary or memory: https://account.dyn.com/
Source: uLFOeGZaJS.exe	String found in binary or memory: https://api.ipify.org
Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: uLFOeGZaJS.exe, BZbr69Oq62w.cs

.Net Code: vJoJ

Installs a global keyboard hook

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\uLFOeGZaJS.exe

Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: uLFOeGZaJS.exe, type: SAMPLE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: uLFOeGZaJS.exe, type: SAMPLE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_013541B0	0_2_013541B0
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_0135B3D0	0_2_0135B3D0
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_01354A80	0_2_01354A80
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_0135AC08	0_2_0135AC08
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_0135EE18	0_2_0135EE18
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_01353E68	0_2_01353E68
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DC6F10	0_2_06DC6F10
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DC1C80	0_2_06DC1C80
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DC5A2C	0_2_06DC5A2C
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DC6248	0_2_06DC6248
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DC623B	0_2_06DC623B
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DC6F30	0_2_06DC6F30
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DDAED0	0_2_06DDAED0
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD2430	0_2_06DD2430
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD6288	0_2_06DD6288
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD5270	0_2_06DD5270
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD7A10	0_2_06DD7A10
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DDC230	0_2_06DDC230
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DDE458	0_2_06DDE458
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD7330	0_2_06DD7330
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD0040	0_2_06DD0040
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD0007	0_2_06DD0007
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Code function: 0_2_06DD5990	0_2_06DD5990

Source: uLFOeGZaJS.exe, 00000000.00000000.2077736795.0000000000CD0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename8d205da5-a06f-41c4-923e-b97a14abb967.exe4 vs uLFOeGZaJS.exe
Source: uLFOeGZaJS.exe, 00000000.00000002.4530485791.000000000136E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs uLFOeGZaJS.exe
Source: uLFOeGZaJS.exe, 00000000.00000002.4530112044.00000000010F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs uLFOeGZaJS.exe
Source: uLFOeGZaJS.exe	Binary or memory string: OriginalFilename8d205da5-a06f-41c4-923e-b97a14abb967.exe4 vs uLFOeGZaJS.exe

Source: uLFOeGZaJS.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uLFOeGZaJS.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: uLFOeGZaJS.exe, type: SAMPLE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: uLFOeGZaJS.exe, hcbDrTLwTC.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: uLFOeGZaJS.exe, CMQvPoq8cy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: uLFOeGZaJS.exe, e5d0T5Np.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: uLFOeGZaJS.exe, 71JxQ8.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: uLFOeGZaJS.exe, CnG3o.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: uLFOeGZaJS.exe, 2FAFIfKp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: uLFOeGZaJS.exe, gdOsx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: uLFOeGZaJS.exe, gdOsx.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: uLFOeGZaJS.exe, tG6Nh.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: uLFOeGZaJS.exe, tG6Nh.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: uLFOeGZaJS.exe

Binary string: ID: 0x{0:X}qSize of the SerializedPropertyStore is less than 8 ({0})/StoreSize: {0} (0x{0X})3\Device\LanmanRedirector\[Failed to retrieve system handle information.

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@3/3

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Mutant created: NULL

Source: uLFOeGZaJS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: uLFOeGZaJS.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: uLFOeGZaJS.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: uLFOeGZaJS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: uLFOeGZaJS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Code function: 0_2_01350C55 push edi; retf

0_2_01350C7A

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: uLFOeGZaJS.exe

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Memory allocated: 1330000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Memory allocated: 3080000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Memory allocated: 16C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599711	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599389	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599032	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598782	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597216	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597107	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596978	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596762	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299891	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299781	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299672	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299562	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299453	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299344	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299219	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299109	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299000	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298891	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298781	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298672	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298563	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298438	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298313	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298202	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298082	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 297968	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 297858	Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Window / User API: threadDelayed 2062			Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Window / User API: threadDelayed 7775			Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6276	Thread sleep count: 2062 > 30	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6276	Thread sleep count: 7775 > 30	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599711s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599389s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599157s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -599032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598907s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -598063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597844s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597216s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -597107s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -596978s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -596875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -596762s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -596656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -596547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -596438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299219s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -299000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298202s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -298082s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -297968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe TID: 6088	Thread sleep time: -297858s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599711	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599609	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599500	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599389	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599282	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599157	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 599032	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598907	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598782	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598672	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598563	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598438	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598313	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598188	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597953	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597844	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597610	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597485	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597216	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 597107	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596978	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596875	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596762	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596656	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596547	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 596438	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299891	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299781	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299672	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299562	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299453	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299344	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299219	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299109	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 299000	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298891	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298781	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298672	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298563	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298438	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298313	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298202	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 298082	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 297968	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Thread delayed: delay time: 297858	Jump to behavior

Source: uLFOeGZaJS.exe, 00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: uLFOeGZaJS.exe	Binary or memory string: vmware
Source: uLFOeGZaJS.exe	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem
Source: uLFOeGZaJS.exe, 00000000.00000002.4530485791.0000000001436000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Code function: 0_2_01357F59 CheckRemoteDebuggerPresent,

0_2_01357F59

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Queries volume information: C:\Users\user\Desktop\uLFOeGZaJS.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: uLFOeGZaJS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uLFOeGZaJS.exe PID: 1264, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\uLFOeGZaJS.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: uLFOeGZaJS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uLFOeGZaJS.exe PID: 1264, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: uLFOeGZaJS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.uLFOeGZaJS.exe.c90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uLFOeGZaJS.exe PID: 1264, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	231 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	261 Virtualization/Sandbox Evasion	21 Input Capture	531 Security Software Discovery	Remote Desktop Protocol	21 Input Capture	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Process Discovery	SMB/Windows Admin Shares	11 Archive Collected Data	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	261 Virtualization/Sandbox Evasion	Distributed Component Object Model	2 Data from Local System	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
uLFOeGZaJS.exe	79%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
uLFOeGZaJS.exe	100%	Avira	HEUR/AGEN.1305739
uLFOeGZaJS.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
ercolina-usa.com	192.254.225.136	true	true	unknown
api.ipify.org	172.67.74.152	true	false	high
ip-api.com	208.95.112.1	true	false	high
ftp.ercolina-usa.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.ipify.org	uLFOeGZaJS.exe	false	high
https://account.dyn.com/	uLFOeGZaJS.exe	false	high
https://api.ipify.org/t	uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ftp.ercolina-usa.com	uLFOeGZaJS.exe, 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003286000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ercolina-usa.com	uLFOeGZaJS.exe, 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, uLFOeGZaJS.exe, 00000000.00000002.4531022648.0000000003286000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	uLFOeGZaJS.exe, 00000000.00000002.4531022648.00000000030D1000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.254.225.136	ercolina-usa.com	United States	46606	UNIFIEDLAYER-AS-1US	true
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
172.67.74.152	api.ipify.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567463
Start date and time:	2024-12-03 15:59:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uLFOeGZaJS.exe renamed because original name is a hash value
Original Sample Name:	455c4725e43d0a0336232373e7ff05968a4ce178ec845263237880781c4456ea.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 88 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: uLFOeGZaJS.exe

Simulations

Behavior and APIs

Time	Type	Description
10:00:08	API Interceptor	9767068x Sleep call for process: uLFOeGZaJS.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.254.225.136	RICHIESTA D'OFFERTA.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse
	QUOTATION#09678.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE SPCIFICIATIONS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	LISTA DE COTIZACIONES.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#5400.exe	Get hash	malicious	AgentTesla	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	QUOTATION#2800-QUANTUM MACTOOLS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	2JHGWjmJ46.exe	Get hash	malicious	AgentTesla	Browse
	COTIZACI#U00d3N#08673.exe	Get hash	malicious	AgentTesla, DarkTortilla	Browse
	vD6qU34v9S.exe	Get hash	malicious	AgentTesla	Browse
208.95.112.1	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Pago devuelto #.Documentos#97875657896786756457678568.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PURCHASE_ORDER_120224.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json/?fields=status,country,regionName,city,query
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	#U00d6deme.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	ip-api.com/line/?fields=hosting
	tDLozbx48F.exe	Get hash	malicious	Gurcu Stealer	Browse	ip-api.com/line?fields=query,country
	x9XhRITucw.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	6ox7RfKeE3.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	1pYgOj4wz8.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pago devuelto #.Documentos#97875657896786756457678568.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE_ORDER_120224.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	#U00d6deme.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	208.95.112.1
	tDLozbx48F.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	x9XhRITucw.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	6ox7RfKeE3.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	1pYgOj4wz8.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
api.ipify.org	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	main.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	Content Collaboration Terms.dll.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.74.152
	https://apnasofa.com/episode/index#YmVuQG1pY3Jvc29mdC5jb20==	Get hash	malicious	Unknown	Browse	104.26.13.205
	Employee_Important_Message.pdf	Get hash	malicious	Unknown	Browse	104.26.12.205
	l6F8Xgr0Ov.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNIFIEDLAYER-AS-1US	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	50.87.219.149
	SW_5724.exe	Get hash	malicious	FormBook	Browse	108.179.253.197
	PAGAMENTO CREDIT_AGRICOLE.doc	Get hash	malicious	XWorm	Browse	192.254.232.209
	fred.html	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	173.254.24.56
	Po-AD841.exe	Get hash	malicious	AgentTesla	Browse	108.179.234.136
	V-Mail.msg	Get hash	malicious	Unknown	Browse	69.49.245.172
	https://protect.checkpoint.com/v2/r01/___https:/vlp6cm34.r.us-east-1.awstrack.me/Q5dmyyux:e7Ke7Kjrfnq.ynintwjuqD.htr7Kh7KjOBJBJLTmXFRFSIYBSOlvWZ1QLgoUfHylhY/JnF_riAUpCWczNA0yO_jaB~oG6AYM23pBoyDNMJ-PJR-NmPFsN~VgZA/PF0HUyICotYzOGFnKvZNBMhC~KfYclayEc_La~ccZq7wY-S_IKBLwx/KWAAv8MVfzRwNM6LCN8Jigf~80C6gkuabRjmLM--7qPAcOAlUFFI__5pCS9Bd6d565556c8b~/hi595-9hb~3gh-a~bg-9bgb-ci5/-b9jf76k5b9g~-555555do29l0Y3hHjFJM3POpxyJsMjDY~5=957___.YzJ1OndhaXRha2VyZXByaW1hcnk6YzpvOmNkMzFiOWRiNjRlNzYwZWExOWZkZjZlZWU4YmI5NjkyOjc6NjQxYjozOTM5M2Y5MjlmZWNkMGUzMGYzMjUxMGFiZDQ0YjU2Mzg5ODdlNDNlNTAyN2VlYjBmMjQxZjc3Mjg5OGNiMWQxOmg6VDpU%3E	Get hash	malicious	Unknown	Browse	69.49.245.172
	[EXTERNAL] Fw_ LVW 1201831..eml	Get hash	malicious	Unknown	Browse	69.49.230.198
	ATT4802.html	Get hash	malicious	Unknown	Browse	69.49.245.172
TUT-ASUS	SANTANDER%20AUDITORIA.scr.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Pago devuelto #.Documentos#97875657896786756457678568.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PURCHASE_ORDER_120224.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	#U00d6deme.exe	Get hash	malicious	AgentTesla, PureLog Stealer, zgRAT	Browse	208.95.112.1
	tDLozbx48F.exe	Get hash	malicious	Gurcu Stealer	Browse	208.95.112.1
	x9XhRITucw.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	6ox7RfKeE3.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	1pYgOj4wz8.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
CLOUDFLARENETUS	MOaSkQR8WU.xlsx	Get hash	malicious	Unknown	Browse	188.114.97.6
	Voicemail_+Transcription006332.docx	Get hash	malicious	Unknown	Browse	104.21.34.75
	Ksl3V3pqZq.xls	Get hash	malicious	Unknown	Browse	188.114.97.6
	Voicemail_+Transcription006332.docx	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://four-shared-field.glitch.me/#admin@average-adjusters.com	Get hash	malicious	Unknown	Browse	172.67.167.75
	Request for Quote and Collaboration Docs.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	YQ3PhY2Aeq.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.56.70
	Request for Quote and Collaboration Docs.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.177.134
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Voicemail_+Transcription006332.docx	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://four-shared-field.glitch.me/#admin@average-adjusters.com	Get hash	malicious	Unknown	Browse	172.67.74.152
	Request for Quote and Collaboration Docs.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	172.67.74.152
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	REQUEST FOR QUOATION AND PRICES.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	Ref#116670.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.74.152
	Ref#60031796.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	IBAN payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	172.67.74.152
	Ref#1550238.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	BuMdSP88Ze.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.210139224741649
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	uLFOeGZaJS.exe
File size:	267'264 bytes
MD5:	ec02b1d48f34dfa40ef212f737738d5e
SHA1:	644d63dcc57b3a82727122a152e9db6a1a97101f
SHA256:	455c4725e43d0a0336232373e7ff05968a4ce178ec845263237880781c4456ea
SHA512:	fdb77caad22ad3a5f623e89adc04b52d166312861800bc00cdbcf8c2057c1d0287f939f1f220485e025bf62a39bbb0da79563cf3f7ce5e2d35e852a16349c823
SSDEEP:	3072:q3eZdlFdd0O7XOMY4I9UrwxYabktx4i25vcF8PUwJD5vje:DdlFdd0O7XOMYb+lNtx4ifF21vvj
TLSH:	474420037E48EB11E1A87D3792EF6C2413B2B0C71733D60BAF49ABA514516926C7E72D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.....................D........... ........@.. ....................................@................................

File Icon


Icon Hash:	6286b244d63270fa

Static PE Info

General

Entrypoint:	0x43ed8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660FAB85 [Fri Apr 5 07:43:01 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ed3c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x40000	0x4120	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x46000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3cd94	0x3ce00	b70c08a4efcee775b76e874bac796f42	False	0.35690451745379875	data	5.022203459705477	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x40000	0x4120	0x4200	295b1e14b913df111b969cc7d89d188e	False	0.6515151515151515	data	5.870293684168006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x46000	0xc	0x200	2334158d2db0d80b65821d7f5f002a9f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x40190	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	0.7287234042553191
RT_ICON	0x405f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.700984990619137
RT_ICON	0x416a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	0.674688796680498
RT_GROUP_ICON	0x43c48	0x30	data	0.8125
RT_VERSION	0x43c78	0x2bc	data	0.44142857142857145
RT_MANIFEST	0x43f34	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 16:00:07.493429899 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:07.493474960 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:07.493544102 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:07.503782034 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:07.503797054 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:08.789182901 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:08.789385080 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:08.794919968 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:08.794940948 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:08.795214891 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:08.849224091 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:08.881093979 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:08.927340031 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:09.275743961 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:09.275821924 CET	443	49704	172.67.74.152	192.168.2.5
Dec 3, 2024 16:00:09.275953054 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:09.295954943 CET	49704	443	192.168.2.5	172.67.74.152
Dec 3, 2024 16:00:09.469701052 CET	49705	80	192.168.2.5	208.95.112.1
Dec 3, 2024 16:00:09.590003014 CET	80	49705	208.95.112.1	192.168.2.5
Dec 3, 2024 16:00:09.590121984 CET	49705	80	192.168.2.5	208.95.112.1
Dec 3, 2024 16:00:09.590430021 CET	49705	80	192.168.2.5	208.95.112.1
Dec 3, 2024 16:00:09.710522890 CET	80	49705	208.95.112.1	192.168.2.5
Dec 3, 2024 16:00:10.858158112 CET	80	49705	208.95.112.1	192.168.2.5
Dec 3, 2024 16:00:10.905597925 CET	49705	80	192.168.2.5	208.95.112.1
Dec 3, 2024 16:00:11.426704884 CET	49705	80	192.168.2.5	208.95.112.1
Dec 3, 2024 16:00:11.547081947 CET	80	49705	208.95.112.1	192.168.2.5
Dec 3, 2024 16:00:11.547138929 CET	49705	80	192.168.2.5	208.95.112.1
Dec 3, 2024 16:00:12.324433088 CET	49706	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.447952986 CET	21	49706	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.448121071 CET	49706	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.489531994 CET	49706	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.567338943 CET	49707	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.609745979 CET	21	49706	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.609828949 CET	49706	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.687392950 CET	21	49707	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.687484026 CET	49707	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.687800884 CET	49707	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.689344883 CET	49708	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.807729006 CET	21	49707	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.807956934 CET	21	49707	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.808016062 CET	49707	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.809451103 CET	21	49708	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.809525013 CET	49708	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.809741020 CET	49708	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.811260939 CET	49709	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.930046082 CET	21	49708	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.930102110 CET	49708	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.931329012 CET	21	49709	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:12.931406975 CET	49709	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:12.931633949 CET	49709	21	192.168.2.5	192.254.225.136
Dec 3, 2024 16:00:13.052087069 CET	21	49709	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:13.052138090 CET	21	49709	192.254.225.136	192.168.2.5
Dec 3, 2024 16:00:13.052220106 CET	49709	21	192.168.2.5	192.254.225.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 16:00:07.330559015 CET	55215	53	192.168.2.5	1.1.1.1
Dec 3, 2024 16:00:07.468245029 CET	53	55215	1.1.1.1	192.168.2.5
Dec 3, 2024 16:00:09.328212023 CET	61212	53	192.168.2.5	1.1.1.1
Dec 3, 2024 16:00:09.466171980 CET	53	61212	1.1.1.1	192.168.2.5
Dec 3, 2024 16:00:11.427794933 CET	60358	53	192.168.2.5	1.1.1.1
Dec 3, 2024 16:00:12.283745050 CET	53	60358	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 16:00:07.330559015 CET	192.168.2.5	1.1.1.1	0x22bf	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 3, 2024 16:00:09.328212023 CET	192.168.2.5	1.1.1.1	0xfcc1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 16:00:11.427794933 CET	192.168.2.5	1.1.1.1	0xba98	Standard query (0)	ftp.ercolina-usa.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 16:00:07.468245029 CET	1.1.1.1	192.168.2.5	0x22bf	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 3, 2024 16:00:07.468245029 CET	1.1.1.1	192.168.2.5	0x22bf	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 3, 2024 16:00:07.468245029 CET	1.1.1.1	192.168.2.5	0x22bf	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 3, 2024 16:00:09.466171980 CET	1.1.1.1	192.168.2.5	0xfcc1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 3, 2024 16:00:12.283745050 CET	1.1.1.1	192.168.2.5	0xba98	No error (0)	ftp.ercolina-usa.com	ercolina-usa.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 16:00:12.283745050 CET	1.1.1.1	192.168.2.5	0xba98	No error (0)	ercolina-usa.com		192.254.225.136	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	208.95.112.1	80	1264	C:\Users\user\Desktop\uLFOeGZaJS.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 16:00:09.590430021 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 3, 2024 16:00:10.858158112 CET	175	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 15:00:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.74.152	443	1264	C:\Users\user\Desktop\uLFOeGZaJS.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 15:00:08 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-03 15:00:09 UTC	423	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 15:00:09 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ec46cb4bac032d0-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1804&rtt_var=902&sent=6&recv=8&lost=0&retrans=1&sent_bytes=4178&recv_bytes=769&delivery_rate=384818&cwnd=168&unsent_bytes=0&cid=fcc8c340680c596c&ts=488&x=0"
2024-12-03 15:00:09 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

Target ID:	0
Start time:	10:00:06
Start date:	03/12/2024
Path:	C:\Users\user\Desktop\uLFOeGZaJS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uLFOeGZaJS.exe"
Imagebase:	0xc90000
File size:	267'264 bytes
MD5 hash:	EC02B1D48F34DFA40EF212F737738D5E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.4531022648.000000000310D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000000.2077701139.0000000000C92000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.4531022648.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7.1%
Total number of Nodes:	198
Total number of Limit Nodes:	22

Executed Functions

Function 06DD2430 Relevance: 9.0, Strings: 6, Instructions: 1489COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DD3837
$]q, xrefs: 06DD386C
$]q, xrefs: 06DD3884
$]q, xrefs: 06DD3890
$]q, xrefs: 06DD3843
$]q, xrefs: 06DD3860

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: 8491de223795fa20d1514a37cf1ff4ba74569ed2e25ae6f9f085a8b24eefe139
Instruction ID: afaf36da060a9f6d4212d20ead03d34298a7cd22d5ac0d9593964b067f324e9a
Opcode Fuzzy Hash: 8491de223795fa20d1514a37cf1ff4ba74569ed2e25ae6f9f085a8b24eefe139
Instruction Fuzzy Hash: 7BD26A30E002098FCB64EF68C484A9DB7F2FF89314F55C5A9D449AB255EB35ED85CB81

Function 0135B3D0 Relevance: 3.1, Instructions: 3090COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f73d16e905552d7a3a6f01fceee2222928f6ba57c0a2d5bb8220c607d080215
Instruction ID: 0763ba7fd99a13909df48a9408d72621a46971f4cedace513190a77cdcfddd36
Opcode Fuzzy Hash: 6f73d16e905552d7a3a6f01fceee2222928f6ba57c0a2d5bb8220c607d080215
Instruction Fuzzy Hash: F4630931D10B1A8ACB51EF68C8849ADF7B1FF99300F15C79AE45877121EB70AAD5CB81

Function 06DD7A10 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DD7D7F
$]q, xrefs: 06DD7D73

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: e6a8057c1717b39a0aeb6b0a98d80b643c70b7e6b8ebfe22e63e8d694c23c287
Instruction ID: 66cff5fe016ee585bc536f2d9757e281434f363d1cccda051ef9b7dd2babf506
Opcode Fuzzy Hash: e6a8057c1717b39a0aeb6b0a98d80b643c70b7e6b8ebfe22e63e8d694c23c287
Instruction Fuzzy Hash: 0C029E30B002068FDB54EF69D990AAEB7E6FF84314F148569D409EB394DB38ED46CB91

Function 0135EE18 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0135EF06
Xaq, xrefs: 0135EF1F

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: Xaq$$]q
API String ID: 0-1280934391
Opcode ID: ee2d39a1946382d7fbad0f9687e4acf83202d54eec12a5eed8079ef90f2ab67f
Instruction ID: a3cb9b95ad5664b34192256eeb9bf8dd761fafbe3c6973bfa52a0c5ee487ea6e
Opcode Fuzzy Hash: ee2d39a1946382d7fbad0f9687e4acf83202d54eec12a5eed8079ef90f2ab67f
Instruction Fuzzy Hash: 7FB1B470B142198BDB5DAF78985467E7BBBBFC9B10B04852DE846E7388DE34CC028795

Function 01357F59 Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 01357EFF

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: e7703c1802480cbca5dbbbf4c2808ed2d3de0e833f742948dfe3b1d5c565708e
Instruction ID: 5a1d47a0be2928c0ce692f96d48c5a50a83fd5eb796d6710d6ee343f81352f10
Opcode Fuzzy Hash: e7703c1802480cbca5dbbbf4c2808ed2d3de0e833f742948dfe3b1d5c565708e
Instruction Fuzzy Hash: 80213472A002559FCB52EB7DC8017EDBBE19B45618F548469ED0CE7342E738C94ACB92

Function 06DC1C80 Relevance: 1.6, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

nKuq, xrefs: 06DC1CC4

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: nKuq
API String ID: 0-4080595220
Opcode ID: 3dcf150d2581264d7aa62506528e3fc99380ba6e98b0bb7d2d218bb7eccf6067
Instruction ID: 39b79394388b74de079413d35677849e327099d1d85ef1145c1fc6cc511cc497
Opcode Fuzzy Hash: 3dcf150d2581264d7aa62506528e3fc99380ba6e98b0bb7d2d218bb7eccf6067
Instruction Fuzzy Hash: FAB18171E1022A9FDB64DFA9C8407AEBBBAFF88720F10452EE505E7291C7359905CBD1

Function 06DD6288 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621e5bb203c355c9a510a8724aca20d5aae7430848e5fd76923c619a62530d77
Instruction ID: 393c1cb5378eb0642f293f3c647f4454570bbe19ca5e93bb697819f214b538d7
Opcode Fuzzy Hash: 621e5bb203c355c9a510a8724aca20d5aae7430848e5fd76923c619a62530d77
Instruction Fuzzy Hash: C3629E34B002459FDB54EFA8D584AADBBF2EF88314F148469E405EB395DB39EC46CB90

Function 06DDC230 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4db169698e31bdb28ec823cd5c23f6b505f64f6385e44010add57a761d16ec5
Instruction ID: 8b3bd759930e8c65faf2f155f70b4d31321e65325c617ff353a6df21b9c2dcdb
Opcode Fuzzy Hash: b4db169698e31bdb28ec823cd5c23f6b505f64f6385e44010add57a761d16ec5
Instruction Fuzzy Hash: 49327230B102099FDF54EFA8D990AADBBBAFB88314F108529D405EB355DB39DC46CB91

Function 0135AC08 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f5a1d282f2ef8243ebf570b2f583874afab149297805be53af0854a89ab942
Instruction ID: 8c42263cbd61e55a6ff3f9c247e0580265dfb83c27bdbc78651c6fdafc0feaaf
Opcode Fuzzy Hash: 77f5a1d282f2ef8243ebf570b2f583874afab149297805be53af0854a89ab942
Instruction Fuzzy Hash: 1A32DF30B002098FDB55DF68D884AADBBB2FF88714F148529E909EB395DB35DC46CB91

Function 06DDAED0 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83701cf89e821dc57342bd64d47b0f86c90e2bdb04e24db93739d70aaea0bf71
Instruction ID: b4c6eae72fc3f788dd873174d1b2b123ce5a4c8b05868a6f70523e99bf0e6f6e
Opcode Fuzzy Hash: 83701cf89e821dc57342bd64d47b0f86c90e2bdb04e24db93739d70aaea0bf71
Instruction Fuzzy Hash: A72294B0E102098FDF64EF69D5807ADB7B6FB45318F15882AE415EB391DA38DC81CB51

Function 06DD5270 Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ae9148071fdd936b03edcae59a1464008a5c0eca2d4550a0b851d6e8d721f9
Instruction ID: bf295f5029504d2046c60c1167a40957679c5a58608e278ba95f4f91bf495e6f
Opcode Fuzzy Hash: 47ae9148071fdd936b03edcae59a1464008a5c0eca2d4550a0b851d6e8d721f9
Instruction Fuzzy Hash: A112E471F002058BDF64EF64E89076EBBB2EB84314F248429D85AAB385DB35DC46CB91

Function 013541B0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bee159d2d85290cafa13ba81c4a1c76def55b6bd1be8515ee0399f5ebf0bbc7
Instruction ID: d2ec0c5ac9a82e5fef9f8793f3e484cb82d380dd03ca0826ed419ff64dedbfd6
Opcode Fuzzy Hash: 1bee159d2d85290cafa13ba81c4a1c76def55b6bd1be8515ee0399f5ebf0bbc7
Instruction Fuzzy Hash: 0FB18070E00219CFDF58CFA9D885BDDBBF2BF88B08F148529D815A7254EB749881CB81

Function 01354A80 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08a929e21c528d202c3d475d60d3a16528ff57a339c56677f99e3e811a16a6c
Instruction ID: aa886fcd7441a09c30c4f8a484b1304433a53170d93059da9cdaa0b708a677a1
Opcode Fuzzy Hash: a08a929e21c528d202c3d475d60d3a16528ff57a339c56677f99e3e811a16a6c
Instruction Fuzzy Hash: 94B16E70E00209DFDF58CFA9D981B9DBBF2AF88B18F148129D855E7254EB749885CB81

Function 06DC5A2C Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c9c4bb3c1a26daef0c023e6039255180360869b19d93e6a20daf61c529c6056
Instruction ID: 335277f2c3172877ca44df6c8fe5ffbb39c543918538695ac79e0e990f596c31
Opcode Fuzzy Hash: 4c9c4bb3c1a26daef0c023e6039255180360869b19d93e6a20daf61c529c6056
Instruction Fuzzy Hash: 70A16E35E0021A9FCB44DFA4D8549EDFBBAFF89310F158219E416AB3A4DB30E846CB51

Function 01353E68 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32a7892c08458b4b66fd293cacaec7e744eb186ca44cad411ef0b48c7130004
Instruction ID: db99f345dae79767af334114827ce730e2adbff0a9599e8fe22de99373a4de21
Opcode Fuzzy Hash: c32a7892c08458b4b66fd293cacaec7e744eb186ca44cad411ef0b48c7130004
Instruction Fuzzy Hash: 8C917170E00209DFDF54CFA9D985BDDBBF2BF88718F248129E815A7254EB349985CB81

Function 06DC6F10 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa0c89e9f38bef76f2e4bade17aa696a68b988a9b8bd96c2b8b9351a841e8fc
Instruction ID: 82db04d8db70aac3ce04b3bdee668da350eecc956e62055ec6425819d59d341c
Opcode Fuzzy Hash: afa0c89e9f38bef76f2e4bade17aa696a68b988a9b8bd96c2b8b9351a841e8fc
Instruction Fuzzy Hash: 27918E35E0030A9FCB45DFA0D8548DDFBBAEF89310F158619E516AB2A5DB30E842CB61

Function 06DC6F30 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1382f49afbff5e6b5736f4783290a45e77238769f3159c46beb2f23e5b567b6
Instruction ID: 73f319e1833193dfab814adc09cd170528c5346ecf8af08a6cf695fbd272447c
Opcode Fuzzy Hash: b1382f49afbff5e6b5736f4783290a45e77238769f3159c46beb2f23e5b567b6
Instruction Fuzzy Hash: F9916E35E0030A9FCB04DFA4D8549DDFBBAFF89320F158219E516AB264DB30E942CB51

Function 06DDA968 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DDAADC
$]q, xrefs: 06DDAA89
$]q, xrefs: 06DDAB0B
$]q, xrefs: 06DDAA95
$]q, xrefs: 06DDAAE8
$]q, xrefs: 06DDAB40
$]q, xrefs: 06DDAB17
$]q, xrefs: 06DDAB34

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 72005407f84a1cde76606dfb04ec4c6e79b4c1ec412ceea42c6d309d65e048df
Instruction ID: a2f26f29de522e3067c63afae1eabda0fe66493a2a3d84d48fab14c1aced0754
Opcode Fuzzy Hash: 72005407f84a1cde76606dfb04ec4c6e79b4c1ec412ceea42c6d309d65e048df
Instruction Fuzzy Hash: 19E16030F102098FDB69EF68D990A6EB7B6EF84304F148529D805EB394DB79DC46CB91

Function 06DCA629 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06DCA6B6
GetCurrentThread.KERNEL32 ref: 06DCA6F3
GetCurrentProcess.KERNEL32 ref: 06DCA730
GetCurrentThreadId.KERNEL32 ref: 06DCA789

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: be8ae081977077b40ea31084d31da9b35c88bf17b35f578c86cf51c3955af799
Instruction ID: 73496e7ac414d272377ed8a797efa6c1f002600a7eed6d00562db67d8de97751
Opcode Fuzzy Hash: be8ae081977077b40ea31084d31da9b35c88bf17b35f578c86cf51c3955af799
Instruction Fuzzy Hash: CB5133B090160ACFDB54DFA9D948BEEBBF1FF48310F248459D10AA73A0D7389944CBA5

Function 06DCA638 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 06DCA6B6
GetCurrentThread.KERNEL32 ref: 06DCA6F3
GetCurrentProcess.KERNEL32 ref: 06DCA730
GetCurrentThreadId.KERNEL32 ref: 06DCA789

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 29342bb7156e759c14f6610ad0e24f3a084e0abf76a37328a2870f9003d8365c
Instruction ID: 4773160bcb954c5064fc11ffbb51dd23fec29834f6335ab5de93551dda330174
Opcode Fuzzy Hash: 29342bb7156e759c14f6610ad0e24f3a084e0abf76a37328a2870f9003d8365c
Instruction Fuzzy Hash: A95144B090160ACFDB54DFA9D948BEEBBF1FF48310F248419D109A73A0D7389944CBA5

Function 06DD8DE8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DD8E64
$]q, xrefs: 06DD8E58
$]q, xrefs: 06DD8E9F
$]q, xrefs: 06DD8E93

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 6da84b21bfac455883bca7f27aa15f9d05b79fbd27a45fe61ce53e9e83280050
Instruction ID: 98737daab47a6369de997f7dc4e188a7b95db2f30b59d67731e540faa5ec138d
Opcode Fuzzy Hash: 6da84b21bfac455883bca7f27aa15f9d05b79fbd27a45fe61ce53e9e83280050
Instruction Fuzzy Hash: 9B914030B0020A9FDB55DF69D9607AEB3F6FFC4600F108569C809EB394EA35DD468B92

Function 06DDCFF8 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DDD403
$]q, xrefs: 06DDD3EF
$]q, xrefs: 06DDD3F7

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q
API String ID: 0-182748909
Opcode ID: c2533fcfc3e7b05aa0e2cb22e7c3ef11d3eb954d57281f2bd26b2932f72add84
Instruction ID: 829302dcc97117e26c1f827eed0714c817287aa9cd20ad557eade37321679cd4
Opcode Fuzzy Hash: c2533fcfc3e7b05aa0e2cb22e7c3ef11d3eb954d57281f2bd26b2932f72add84
Instruction Fuzzy Hash: F1620D3060060A8FCB55EF68D690A5DB7F6FF84304B208A79D0499F359DB79ED4ACB81

Function 06DD4840 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06DD486B
XPbq, xrefs: 06DD4991
\Obq, xrefs: 06DD4A1B

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: fbq$XPbq$\Obq
API String ID: 0-4057264190
Opcode ID: 5f808ce20591caf49fc25f43c5b61221a5446695e99f3e4018bb022fde8eba33
Instruction ID: 02a7513077fda3e909a3b4b780ec9334531774a9d727533baff786efd53b2b45
Opcode Fuzzy Hash: 5f808ce20591caf49fc25f43c5b61221a5446695e99f3e4018bb022fde8eba33
Instruction Fuzzy Hash: 94618430F102199FEF54EFA5C854BAEBAF6FF88710F208429D105AB395DB758C468B51

Function 06DD8DD9 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06DD8E58
$]q, xrefs: 06DD8E93

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: a77a056df61207bbe116e74d77041c5ed6648ae15e30cdfff0f37825aca57e97
Instruction ID: d3ddcbebdca8e5fed8474e8c5606eed10af9631aa53e5157ee90dbde6f74af50
Opcode Fuzzy Hash: a77a056df61207bbe116e74d77041c5ed6648ae15e30cdfff0f37825aca57e97
Instruction Fuzzy Hash: 8C513F30B002069FDB95DF79D990B6E73F6FBC8644F108569D409EB394DA35DC068B92

Function 06DD4831 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fbq, xrefs: 06DD486B
XPbq, xrefs: 06DD4991

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: fbq$XPbq
API String ID: 0-2292610095
Opcode ID: e64a20982fea697fc0d4013a0a576d60d0bec62d744ed32ece7e5fe01bc9470e
Instruction ID: cdbc5f6a474a02b8f462743f5acba2379cde86d661817cd6645764ef31aecf65
Opcode Fuzzy Hash: e64a20982fea697fc0d4013a0a576d60d0bec62d744ed32ece7e5fe01bc9470e
Instruction Fuzzy Hash: 32519370F102199FDB54EFE5C854BAEBBF6FF88700F208529D106AB395DA758C068B91

Function 06DC6C2F Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06DC6D4A

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 87a4bc9ebf4c2f83f19801c9e0bc66ecdcbb1be6658df0851a327126ea70bbea
Instruction ID: 288bdf538b2cca1d5586fe3ee8408923167398e908d48e6208cd9586216eb28f
Opcode Fuzzy Hash: 87a4bc9ebf4c2f83f19801c9e0bc66ecdcbb1be6658df0851a327126ea70bbea
Instruction Fuzzy Hash: 7C51CFB5D003499FDB14CF99C984ADEBFB5FF88310F24812AE919AB210D7759886CF90

Function 06DC6C38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06DC6D4A

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b2447f7470e8911b0534c33b445afaba5aeabc654b1daf72de5b4ad9a5617c88
Instruction ID: e78fe644298c446488b3fc9599d347124ffc9e024ee81a1ee5289a0f272481a8
Opcode Fuzzy Hash: b2447f7470e8911b0534c33b445afaba5aeabc654b1daf72de5b4ad9a5617c88
Instruction Fuzzy Hash: 4041A0B1D003499FDB14CF99C984ADEBBB5FF88310F24812AE519AB210D775A885CF90

Function 06DCA434 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06DCB7D1

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 5c9a17e0defff4ff31e80f7211feed11e0ae994c715bc75f1d9feefe3e70279a
Instruction ID: b302afb8ac630ff862dc63c2f01c22771e5d70066ba81480f17c129f1ae2df8a
Opcode Fuzzy Hash: 5c9a17e0defff4ff31e80f7211feed11e0ae994c715bc75f1d9feefe3e70279a
Instruction Fuzzy Hash: 65412AB4D003098FDB54CF99C489AAABBF5FF88324F24C459E519AB361D735E841CBA0

Function 06DCC44C Relevance: 1.6, APIs: 1, Instructions: 77comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06DCC4E0

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 84e5489550b970d8d131cd58eeab1b6999fdda6ef3405a9e858492ca26f478d5
Instruction ID: 7ae5abba608510d55883eede2960394c0064d099f7ed80ff06a7f1195b46c5d9
Opcode Fuzzy Hash: 84e5489550b970d8d131cd58eeab1b6999fdda6ef3405a9e858492ca26f478d5
Instruction Fuzzy Hash: 003130B0D1120DDFDB50CFA8C984BDEBBF5AF48314F248029E108AB390D774A845CBA5

Function 06DCC458 Relevance: 1.6, APIs: 1, Instructions: 71comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?), ref: 06DCC4E0

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: e64dcc116cae5c0eeb2bd22b071636c774b45d37897c3894c24008a60a84cae5
Instruction ID: 95faca6829cf5bf371c2bdc53837e7202cb80ce0eedf3c620309d7d5e71da395
Opcode Fuzzy Hash: e64dcc116cae5c0eeb2bd22b071636c774b45d37897c3894c24008a60a84cae5
Instruction Fuzzy Hash: 6F3131B0D1120DDFDB50CF99C984B9DBBF5AF48314F248019E508AB390D774A944CBA4

Function 01357E81 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 01357EFF

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 2448a06d0ebaedcf8ce576b512d3c2ddcf6a736a0707eb7c87f06b647dbc5cc3
Instruction ID: 50519315d67f398a82775408467098e36abf8dbd5d2d422a715b9fafe527928b
Opcode Fuzzy Hash: 2448a06d0ebaedcf8ce576b512d3c2ddcf6a736a0707eb7c87f06b647dbc5cc3
Instruction Fuzzy Hash: 1F2166B18002598FCB10CFAAC484BEEFFF4AF49314F14845AE958A3351D738A944CFA0

Function 06DCA878 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06DCA907

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 51ca2a2cfc596f1e39dec72fd94eb38ac77f6bf2395584b3e03d4fe45ae5d925
Instruction ID: a680e48ab1f3e7a468e3feb6387f76ec07bf40fa3114dd0a30323d515eae091e
Opcode Fuzzy Hash: 51ca2a2cfc596f1e39dec72fd94eb38ac77f6bf2395584b3e03d4fe45ae5d925
Instruction Fuzzy Hash: 3121E5B59002499FDB10CF9AD584ADEBFF9FF48310F14841AE954A3310D379A940CFA5

Function 01357E88 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 01357EFF

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: aa41dedb8d36ed040465de155a7a46f733bd56a277a9005c7238f7a32f6d3b11
Instruction ID: 6f015bd9c73b232fe94f4007c6b4600487acaf697a09f4b435f63aaab23b08ac
Opcode Fuzzy Hash: aa41dedb8d36ed040465de155a7a46f733bd56a277a9005c7238f7a32f6d3b11
Instruction Fuzzy Hash: D12137B18002598FCB10CF9AD484BEEFBF4EF49314F14845AE959A3350D778A944CFA5

Function 06DCA880 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 06DCA907

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 834e73ff7679a177f429b7dc570344fe7a0c8d4fd9f99a39b4e31fd62a49c194
Instruction ID: a8c48da8c3da82c21249ee48e94c367ce50c343cec63ca4e0071e2726445576f
Opcode Fuzzy Hash: 834e73ff7679a177f429b7dc570344fe7a0c8d4fd9f99a39b4e31fd62a49c194
Instruction Fuzzy Hash: F821C4B590024D9FDB10CF9AD984ADEBBF9FB48320F14841AE958A3350D379A944CFA5

Function 06DCDE41 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06DCDEC3

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 78cf27d7dd55e32294c11c6ba7aae26e1dbd9835f9279760e103de6e52fbab8b
Instruction ID: 821b9be479c9a7df20e9e84501c640769de498124484e4040d046edf82f892a5
Opcode Fuzzy Hash: 78cf27d7dd55e32294c11c6ba7aae26e1dbd9835f9279760e103de6e52fbab8b
Instruction Fuzzy Hash: C221F5B59002098FCB54DF99C844ADEFBF5EF88320F148429D569A7290CB749945CFA1

Function 06DCDE48 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExA.USER32(?,00000000,?,?), ref: 06DCDEC3

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 3d0093638e24064e2d02fbe9664cceabcc336a773eff8026c402cd4fed99075a
Instruction ID: e52faf5da4b353a853ad573a1dfd664f95202dcb7bd775c573a324a282792b58
Opcode Fuzzy Hash: 3d0093638e24064e2d02fbe9664cceabcc336a773eff8026c402cd4fed99075a
Instruction Fuzzy Hash: EE2102B59002098FCB54DF9AC844BEEFBF9AF88320F14842AE559A7250C774A941CFA1

Function 06DC5788 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06DC57F6

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e3e14853a10361f42d80f23ff00a4e1b713a4c89e4a2caf2979ffb1d8613fb4c
Instruction ID: 8bb867c4d551d8dd834d22d2ea28c9cd6d9db8ca747b5057b1480c6811fcad12
Opcode Fuzzy Hash: e3e14853a10361f42d80f23ff00a4e1b713a4c89e4a2caf2979ffb1d8613fb4c
Instruction Fuzzy Hash: BF111FB5C002498ECB10DF9AD448ADEFBF8EF89320F10852AD919A3650C379A585CFA4

Function 0135F388 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0135F3EF

Memory Dump Source

Source File: 00000000.00000002.4530467685.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_uLFOeGZaJS.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 1233783db5e2ac1e07063d2e8a6f30fdbe416f27f4597842136845c0347b3e53
Instruction ID: 9eb99ca1e70f6a2d1e9c2db89c14e1cb37ba31c401248216574a1d6cc2a165b5
Opcode Fuzzy Hash: 1233783db5e2ac1e07063d2e8a6f30fdbe416f27f4597842136845c0347b3e53
Instruction Fuzzy Hash: AA111FB1C0065A9BCB10DF9AC544A9EFBF8EF48320F14812AE918A7240D378A944CFA5

Function 06DC414C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 06DC57F6

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b7097e97e497cfecf1ff769a4c3fea34fcfc12a012c0651bc8b90d6fc870b0e8
Instruction ID: 0921be3ed563ccf0eb57b9d36fc740b39efd15a2b23c03ac42f1f1b00a8f842a
Opcode Fuzzy Hash: b7097e97e497cfecf1ff769a4c3fea34fcfc12a012c0651bc8b90d6fc870b0e8
Instruction Fuzzy Hash: 1B1120B5C00349CFCB10DF9AD448A9EFBF8EF89220F10802AD928B7200C379A545CFA4

Function 06DCC309 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06DCC365

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 18354a3b779a96cb5bc4229e2a07764a16b05110d4e07fcebcde406c1d0ba85b
Instruction ID: 6ed04f82865c21b116d60cfa34cd070b6552821635b5fe4549aef8bafea77476
Opcode Fuzzy Hash: 18354a3b779a96cb5bc4229e2a07764a16b05110d4e07fcebcde406c1d0ba85b
Instruction Fuzzy Hash: 281103B19003498FCB20DF9AD548BDEFBF8EB49324F248419E658A3610D379A544CFA5

Function 06DCA48C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,06DCBA1D), ref: 06DCBAA7

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9ba97f135e6c8cd1743019f6cbd69508cf711f34c079c694a09f09f627ca1fb8
Instruction ID: e5f31c0838fc2436159cdabeb658223120c477aff57fe3aeaaec4d33c5257668
Opcode Fuzzy Hash: 9ba97f135e6c8cd1743019f6cbd69508cf711f34c079c694a09f09f627ca1fb8
Instruction Fuzzy Hash: AF1103B1800249CFCB60DF9AD445BDEBBF4EB89320F20845AD559A7350C379A944CFA5

Function 06DCBD2C Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 06DCC365

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6dfb5bb4b47caaab3408e0f5bdeaaa63d95978d581a02e4d82ee53c3ca08983e
Instruction ID: 9a94201a3c3112a36dfae2cb3504fda912addf2d3561303fbfdaa68257420d57
Opcode Fuzzy Hash: 6dfb5bb4b47caaab3408e0f5bdeaaa63d95978d581a02e4d82ee53c3ca08983e
Instruction Fuzzy Hash: 441112B19043498FCB60DF9AD548B9EFBF8EB49324F248459E618A7310C379A944CFA5

Function 06DCBA40 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?,?,06DCBA1D), ref: 06DCBAA7

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0b0b614f3edbe2a1b736d948dcd31ec28135a6e0fe8410354e5aaa3810b27cfa
Instruction ID: 299855fbef5eff5d2ad3c9b4b0f3f85b8da6ce0bcee8e0aa08410ebc94712ece
Opcode Fuzzy Hash: 0b0b614f3edbe2a1b736d948dcd31ec28135a6e0fe8410354e5aaa3810b27cfa
Instruction Fuzzy Hash: 3A1103B18002498FCB20DF9AD445B9EFBF4EF89324F20845AD558A7350C379A544CFA5

Function 06DDDB6D Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DDDCC9

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: fc6bd0be58171a3fb52cf8a7000569cdbc8f46048ca0194da462ddafcab6d4e7
Instruction ID: f8bd5532b3632854f54e0e50eab3056708d1d35500ab56be22a76e3aacecfd50
Opcode Fuzzy Hash: fc6bd0be58171a3fb52cf8a7000569cdbc8f46048ca0194da462ddafcab6d4e7
Instruction Fuzzy Hash: E541B470E103059BDF65EF68D98469EBBB3FF89300F104929E405E7244EB74D846CB91

Function 06DDDB80 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DDDCC9

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: a33e74c6ce92674eae07a267c6e03b88d8c263499cbb14e11a913f15467839de
Instruction ID: eb95edddd9412f8375c9bd878d80829fa71b84c166369f3dc4388fa2cb109a2d
Opcode Fuzzy Hash: a33e74c6ce92674eae07a267c6e03b88d8c263499cbb14e11a913f15467839de
Instruction Fuzzy Hash: 7E418270E103099BDF65EF69D99465EBBB3FF89300F204929D405D7244EB74D846CB81

Function 06DD2299 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DD23E3

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 06e5e99fe69e024f78a6ff57fd91b4150836ef566c25552cc3b2b96dd624b8db
Instruction ID: c9983c872a1823a908659fc809a67c49ef399b8e0f12debe236227c68c8880f6
Opcode Fuzzy Hash: 06e5e99fe69e024f78a6ff57fd91b4150836ef566c25552cc3b2b96dd624b8db
Instruction Fuzzy Hash: 9631FE30B102028FDB59AF74E99462E3BA2AB89700F14487CD502EB385DF39DD06DBA1

Function 06DD22A8 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DD23E3

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: d8f0d3492b2785d9545057f713a2884be55725d6009db63cc26d591bd5477049
Instruction ID: 3a92eb56924cbfb3d558ae5e3cbcd037b0ed29f0bc85beee511c1bd8cd7b390f
Opcode Fuzzy Hash: d8f0d3492b2785d9545057f713a2884be55725d6009db63cc26d591bd5477049
Instruction Fuzzy Hash: 5F31CD30B002058FDB59AB74E99466F3BA6EB89740F20483CD506DB384DE39CD06DBA5

Function 06DDFEC0 Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

|, xrefs: 06DDFF20

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: c20173ee64af34e02f0635a76928d8cc413e59199fe0ea0366fbbfbdb0782aec
Instruction ID: bcbcd8ee0df3225ca856f47152cd31643d8bbb84ddff1103c20126e507e7c40d
Opcode Fuzzy Hash: c20173ee64af34e02f0635a76928d8cc413e59199fe0ea0366fbbfbdb0782aec
Instruction Fuzzy Hash: 12118170B102159FDB54EB78C805BAE7BF1AF88714F1084AEE54AE7360EB359D01CB91

Function 06DDFED0 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

|, xrefs: 06DDFF20

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 84ec990055945a62c0e59b6b9998760cc29be9f99a3a518fd231fc1330dd79d5
Instruction ID: 46d764a53f781486088cb46e285ba1680a60bf8dc73de629f147e81a6881a2e9
Opcode Fuzzy Hash: 84ec990055945a62c0e59b6b9998760cc29be9f99a3a518fd231fc1330dd79d5
Instruction Fuzzy Hash: E1115B70B102149FDB94EB78C805B6E7BF5AF48700F108469E54AE73A0EA359D01CB90

Function 06DDAEC0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82e1303dbecc83639f4d61fcb3160a734cc69d3e9010bd92beb5777bda463002
Instruction ID: 5c421c0e6775f1f07265d49d91ddfbb7a3dc40028d9b560029ddcc4bfa1b0f1b
Opcode Fuzzy Hash: 82e1303dbecc83639f4d61fcb3160a734cc69d3e9010bd92beb5777bda463002
Instruction Fuzzy Hash: DEA1B4B0F001098FEF64EBADD9807BEB6B6EB89714F218826E405E7395CA39DC418751

Function 06DDC220 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73977fa34f77ad8cf8440a86f78bb2a77ff93691207ab557920c9ac6aba775f5
Instruction ID: 9c9b7ff97e5097701d2934952feb3727e5e6252846b06cf14d9d12fbbb118ccf
Opcode Fuzzy Hash: 73977fa34f77ad8cf8440a86f78bb2a77ff93691207ab557920c9ac6aba775f5
Instruction Fuzzy Hash: 6DB16270E201098FDF64EFA8D990BADBBBAFB48314F104425E445EB395DA38DC46CB91

Function 06DDB2E1 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe12d3533f9fda425672baa10d98f4819721489ffdc8379185cf8e198d4bb82
Instruction ID: 8220a40924fc5c8714f7d41ed164cab931cef99dcbdf1c4d3ac93af4217914b3
Opcode Fuzzy Hash: 0fe12d3533f9fda425672baa10d98f4819721489ffdc8379185cf8e198d4bb82
Instruction Fuzzy Hash: 10A15CB0E102098FDF64EF58D580BADB7B1EB49318F16896AE415EF391DA34DC81CB91

Function 06DD5E88 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e051d457573d630defb0b77a455cb1ddb3f474c0e3cd9c85336b8290c384cb
Instruction ID: 6eb4ff8251b9371a73b1532338b8133841335c7fce63883b202538b203437f5f
Opcode Fuzzy Hash: 37e051d457573d630defb0b77a455cb1ddb3f474c0e3cd9c85336b8290c384cb
Instruction Fuzzy Hash: 19619071F000114FDB54AB7AD880A6FBADBAF94220F154479E80EDB364DE79DD0287D2

Function 06DD3F71 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091f25021bd2eb8b3dfe8074a1bcab79705e391eeb48e870c54c50bb8716ba00
Instruction ID: 7640495c561d8053aaa9c1a4fae4212651d5cec16db1d56d94ffe7ecfe534606
Opcode Fuzzy Hash: 091f25021bd2eb8b3dfe8074a1bcab79705e391eeb48e870c54c50bb8716ba00
Instruction Fuzzy Hash: 7B812B30B1020A8BDF54EFA5D8547AEBBF2EF89314F118529D40AEB394DB35DC468B52

Function 06DD3F80 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae67a701fbf9dab450dee81f24cdffe8776dc2e876187d92fabc700954b0bd2c
Instruction ID: e05c8f46c80134961a5c2742edfe18908fb52f166c81f32cd159f72381a44d22
Opcode Fuzzy Hash: ae67a701fbf9dab450dee81f24cdffe8776dc2e876187d92fabc700954b0bd2c
Instruction Fuzzy Hash: 77811B30B1020A8BDF54EFA9D85476EBBF2EB89314F118529D40AEB394DB35DC468B52

Function 06DD4294 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a77c9714c82ad42650effbdef83604ed25f277be60b09a2f0235def8b924f1
Instruction ID: ea3fb31bc8b74f427f7fad1c19c095f80fe595f643156c8e0a023ac9c3791441
Opcode Fuzzy Hash: 31a77c9714c82ad42650effbdef83604ed25f277be60b09a2f0235def8b924f1
Instruction Fuzzy Hash: 7B914D30E102198FDF60DF68C890B9DB7B1FF89314F208599D449AB295DB70AA86CF91

Function 06DD42A8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ece1e166949dd8e0ca36f1b112f48c02fed3ca22803a48c673d9ee78b5581502
Instruction ID: 1494c8a947ec236471059262497dd88974687f19b54012b0b092cc847660a294
Opcode Fuzzy Hash: ece1e166949dd8e0ca36f1b112f48c02fed3ca22803a48c673d9ee78b5581502
Instruction Fuzzy Hash: 68913D30E1021A8BDF60DF68C890B9DB7B1FF89314F208599D50DBB295DB70AA85CF91

Function 06DDEBC8 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6166ede5f2e1ee7b5c7d5a93ed3405d217f00dec45ebec792608825be51dea12
Instruction ID: 4f23a7094af296eba3dee0dc63e14224af9552fcf03673946733fc454161070e
Opcode Fuzzy Hash: 6166ede5f2e1ee7b5c7d5a93ed3405d217f00dec45ebec792608825be51dea12
Instruction Fuzzy Hash: FC713D30A002099FDB54EFA9D990AADBBF6FF84304F148529D409EB355DB34ED46CB50

Function 06DDEBD8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96ff1e8b2be33d4af08f80036b4c194d74522b9df6ff4b06059e2d839f84538
Instruction ID: 5332ed31abb62993e584e85dfe1a3357292aca327aa4fc11ab3112367000ba32
Opcode Fuzzy Hash: f96ff1e8b2be33d4af08f80036b4c194d74522b9df6ff4b06059e2d839f84538
Instruction Fuzzy Hash: 4B711A30A002499FDB54EFA9D990AAEBBF6FF84304F248429D409EB355DB34ED46CB50

Function 06DDFC70 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2887bc601f537b515aa3f94c230351bd7f033ea39cf8ceea74d02e535a577f07
Instruction ID: c0fc87eb484e9c80f4373ee1307d9a70cc3eadf358089c5eb01cea07991faed3
Opcode Fuzzy Hash: 2887bc601f537b515aa3f94c230351bd7f033ea39cf8ceea74d02e535a577f07
Instruction Fuzzy Hash: DA51C131E00109DFDB24BBB8E4886ADBBB2FF88315F108879E50AD7351DB359956CB80

Function 06DDF608 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b001cf4a3792bfd1cdc572a092887e4427356a7a1340e8a2d01f4fbc128222d1
Instruction ID: 54f66faf81c8cb2cdc2c7e19f8bca46993a37e1d83eb60244993376902a045ad
Opcode Fuzzy Hash: b001cf4a3792bfd1cdc572a092887e4427356a7a1340e8a2d01f4fbc128222d1
Instruction Fuzzy Hash: DD51C4B4F10214ABEF607B6DE94476F2A5EEB89710F204839E40BD77A5C96DCC4583D2

Function 06DDF618 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5853d8049131091364b86b4803adad2652c10d0675fa880fb14bfdf3605fcd22
Instruction ID: 52022b3bd445891bd99617afeb7b4be66a91c1fc00a1af9d14283fe75e591f58
Opcode Fuzzy Hash: 5853d8049131091364b86b4803adad2652c10d0675fa880fb14bfdf3605fcd22
Instruction Fuzzy Hash: 6051B0B0F10214ABEFA07B6DE98477F265EEB88710F204839E40BD37A5C96CCC458392

Function 06DD50F8 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a201a5cad3339156f2fd4e4ea3f9eb1b96d545c4d99250e5f74925443f93bc57
Instruction ID: b0a2f9dee6856a80f54d2b670fcf609a398468a7d7966b06f4c0cc5c35467327
Opcode Fuzzy Hash: a201a5cad3339156f2fd4e4ea3f9eb1b96d545c4d99250e5f74925443f93bc57
Instruction Fuzzy Hash: 8C418A71E006098BDB70DFA9E8C0AAFFBF5FB94314F10492AE216D7610D731E9498B90

Function 06DDDA20 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34b0dfa178787cd5800808a75f2fa71bd549c5748e839fc0d01b97c1a41f121
Instruction ID: 6f761bff9b03e3fb3024e5af907e5f9187681353cd2bfde4b3e7844faa1eb5f9
Opcode Fuzzy Hash: f34b0dfa178787cd5800808a75f2fa71bd549c5748e839fc0d01b97c1a41f121
Instruction Fuzzy Hash: 2231A630E1430A9BDF25EFA4D980A9EB7B6FF85304F108529E405EB344EB74E946CB91

Function 06DD2159 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec0896ca584302ebc3e4fa3e3059913849bc8cf433147d51ebac4f4766fe0de
Instruction ID: a07d68341f6bd0f5b9ff077518f5342c4ca735070169c2c4202bb2221d37b58d
Opcode Fuzzy Hash: 6ec0896ca584302ebc3e4fa3e3059913849bc8cf433147d51ebac4f4766fe0de
Instruction Fuzzy Hash: FE318334F102099BCF59DFA4C9546AEBBB2BF89300F11C52AE915E7750DB31AD46CB41

Function 06DD50E9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a817ae5d4f2b873ce1599c65b4076d2da4507b426d41a363c68aa2140de84005
Instruction ID: 4d61d11473da736124525deb901d270d8986eec4258dc0d8752d237a5907bdc8
Opcode Fuzzy Hash: a817ae5d4f2b873ce1599c65b4076d2da4507b426d41a363c68aa2140de84005
Instruction Fuzzy Hash: FC31AE31E006058FCB70DFA9DCC0AAFBBF6FB95310F104A2AD156D7650D730A9498B91

Function 06DD2168 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c025bf51c11f36e687537a0b76c23bfdd0d23ef886c212f89624a635d5f24d68
Instruction ID: 1c59f8f38c8d834778d4040ddc50c42d3b6aefa50a2b8d8636bf0c0862d76356
Opcode Fuzzy Hash: c025bf51c11f36e687537a0b76c23bfdd0d23ef886c212f89624a635d5f24d68
Instruction Fuzzy Hash: 3A315030E1020A9BCF55DFA4D85469EBBB2FF89314F10C529E915E7350DB71AD46CB41

Function 06DD3B78 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5ec1770202a1134dbf15053545219b88c4763cf94f777a954288098d31d130
Instruction ID: 435bc9bea9d72a80d722d9bb32f3f0736e09146923d76f1ddc957ea242ee0bcc
Opcode Fuzzy Hash: fa5ec1770202a1134dbf15053545219b88c4763cf94f777a954288098d31d130
Instruction Fuzzy Hash: 3621BF75E012159FDF50DFB9E881AADBBF5EB48610F048025E809FB380E739DD018B91

Function 06DD3B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740a0d2bb52ae3c1435e4cad240a3dcba571075a21f72c1e4e34f59f02b83b53
Instruction ID: aa54bf06b8c54cb4bbe07eec6c9f813544b86837c1c9a5fc334dbb0967da4e68
Opcode Fuzzy Hash: 740a0d2bb52ae3c1435e4cad240a3dcba571075a21f72c1e4e34f59f02b83b53
Instruction Fuzzy Hash: 1E217C75E016159FDB50DFA9D880AAEBBF5EB48710F118029E909EB380E739DD018B92

Function 06DD6998 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5813c54aa51032210ee94b427259ac5e111ee7f84babe53c176ef6e4dc3f7c52
Instruction ID: 7a2f274561edd5374c602b70bc8a7ef4aa45785fba30dc444c7d66cada189776
Opcode Fuzzy Hash: 5813c54aa51032210ee94b427259ac5e111ee7f84babe53c176ef6e4dc3f7c52
Instruction Fuzzy Hash: 5A21F331B100559BDF94EFA8E954AADB7F6EB84310F108139E445EB341EB34DD468BC1

Function 012AD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530279777.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 529bb98f882967fbd1dff2664b8d9d28a238cea238fb3e3c7d506e5bc5c27c11
Instruction ID: 5838adf6f06723b7a721a9c500cc4c47b6930b4ac70464ab1f08fb08f478e1ea
Opcode Fuzzy Hash: 529bb98f882967fbd1dff2664b8d9d28a238cea238fb3e3c7d506e5bc5c27c11
Instruction Fuzzy Hash: DC2142701A4208DFCB11DFA8C980B26BFA5FB88314F60C56DDA090B652C37AD806CA62

Function 06DDFC61 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906e1a870c131a669a87e6368e6edc21a28ba5548dc48d88e5f5ff6727ab7ca1
Instruction ID: 0b1a10fe2485f2fde098396ae7b851b85092e4306e3664fc80122a7ae72fa523
Opcode Fuzzy Hash: 906e1a870c131a669a87e6368e6edc21a28ba5548dc48d88e5f5ff6727ab7ca1
Instruction Fuzzy Hash: F9215E30B011159FDB64EB78D59966E76B2EF88700F204839E807EB394DA349C42CB80

Function 06DD69A8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b2143863513c1249a4433a66b4e13961d471d5e53a9532c2acbcea9fcc55fbe
Instruction ID: b6ff5335cdb40fd0f65616a005d0dab70bf78fc873ac96c2c673ae4db1489de9
Opcode Fuzzy Hash: 4b2143863513c1249a4433a66b4e13961d471d5e53a9532c2acbcea9fcc55fbe
Instruction Fuzzy Hash: 9C21A231B101549BDF54EBA8E950A9DB7F6EB84314F108039D405EB341DB34DC458BC1

Function 06DD3138 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31ef86b9bea0446d3353bc8241eb0765752981b48176d354d35c1883d23a2409
Instruction ID: d7ed6c19b3f1ec59bcf354b8d05b29a9e5defbc637fc0db374cab33be377d749
Opcode Fuzzy Hash: 31ef86b9bea0446d3353bc8241eb0765752981b48176d354d35c1883d23a2409
Instruction Fuzzy Hash: 71118E71F002199BCF58EB69DC806DEF7B5EB8A310F11897AD40AE7244DA35DA41CB92

Function 06DD3C98 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76e522ec07b7655a2b8dbed378514af573d310df128eec537f2bd5bf9ad0221
Instruction ID: 1cf4483bbfe5ec0da567f3758659b3dd8b088d03cf2148c3b6be40715696545d
Opcode Fuzzy Hash: e76e522ec07b7655a2b8dbed378514af573d310df128eec537f2bd5bf9ad0221
Instruction Fuzzy Hash: 2C11A132B101285FDF54AB69DC146AE73FAEBC9610F018539D40AEB344DE25DC068BD2

Function 06DDEE49 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d810cdda862fdb27c0feacff0d5e00f110326cb37c94f084f856c9111064054a
Instruction ID: 95b813e859960897826d0cdaef496affc28d1c22a6d22c9c17cfa234a0ec6e98
Opcode Fuzzy Hash: d810cdda862fdb27c0feacff0d5e00f110326cb37c94f084f856c9111064054a
Instruction Fuzzy Hash: 6501D435B105104BCB66A678AD9476E67DADBCAB21F10883AE40ECB341E925CD078792

Function 06DD9F98 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b1340e0995a54ca1cf128b8a46e67a2d5cb5e17e9389d32643d148b552a035
Instruction ID: e9cffa1961e96fe052cb7b63ec98e5f13d67c94c46648bef4419220c567beaa1
Opcode Fuzzy Hash: b0b1340e0995a54ca1cf128b8a46e67a2d5cb5e17e9389d32643d148b552a035
Instruction Fuzzy Hash: 55112531B142854FCB52EB79D86076A7BF1EB86210F0484BAE04ADF249EA29DC4AC341

Function 06DD3ED0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43325d3a499289cadbc54a9f897b7739172103bbd49bcf24d6ec687ed9adf61c
Instruction ID: 335525c225083128a612c1937bf92d2eadd6045a85688dd4747377225e27ce52
Opcode Fuzzy Hash: 43325d3a499289cadbc54a9f897b7739172103bbd49bcf24d6ec687ed9adf61c
Instruction Fuzzy Hash: 7701B171B141150BDB55A67CDC54B1BABE6DBC6710F11843AF40ECB790EE75CD068782

Function 06DD3950 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3619b674f0c621a1e5c5ebcf4cdaa78932b225eed813770aa8106649c5e8b2ac
Instruction ID: 56df72275b22f6a62cdd4e356e296811941cef90d111c9ffcf11855142ed2534
Opcode Fuzzy Hash: 3619b674f0c621a1e5c5ebcf4cdaa78932b225eed813770aa8106649c5e8b2ac
Instruction Fuzzy Hash: FC21C2B5D012199FCB00DF9AD985ADEFBB8FF49310F10812AE918B7300C3756954CBA5

Function 06DD3C87 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 427788c3b0f8940138e07d7cc715b5b3d2a6b1210deb9539a030cb92a957ab37
Instruction ID: 361714d2f8941527e84079dbba207ee230d706a222bc112be5c760148f218643
Opcode Fuzzy Hash: 427788c3b0f8940138e07d7cc715b5b3d2a6b1210deb9539a030cb92a957ab37
Instruction Fuzzy Hash: 2A01D436F100145BDF949A69CC143EF72AAABC8650F064135D50AE7344EE25CC174BD2

Function 012AD02B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4530279777.00000000012AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12ad000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: b846566907454f6ae5d1c3721ae38126dbc89e5c0634893e4ae726db049b1560
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 9A11EB75544284CFCB12CF58C5C0B15BFB1FB88314F28C6AAD9494BA52C33AD40ACB62

Function 06DD3958 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64ac7fb5d4c084d3a695da69a6574f275943c499fa41683f1e94170cb4de4d2
Instruction ID: a0fc5b1ba0f8860bd0312cb9e8c6786ec84395fb2839b14d6125dc205d2dc61a
Opcode Fuzzy Hash: c64ac7fb5d4c084d3a695da69a6574f275943c499fa41683f1e94170cb4de4d2
Instruction Fuzzy Hash: C811D3B1D012599FCB00DF9AD884ADEFBB4FF49310F10812AE518A7300C3756944CFA5

Function 06DD3EE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2524d03b52cdcdf62fd5e4fff8c8db1f82dd62640dd6d76028bfeba17a0ab45a
Instruction ID: 2144f4d1aa7b341d9a2ff8d44d9280acd0c734293fc82576863ac54c7b21b444
Opcode Fuzzy Hash: 2524d03b52cdcdf62fd5e4fff8c8db1f82dd62640dd6d76028bfeba17a0ab45a
Instruction Fuzzy Hash: 40016D31B100150BDB64AA7DD854B2BA6EADBCA620F218439F50EC7384EE75DC038792

Function 06DDEE58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54391a1ecdf395f3f9479269b8ff0da8de73bbd369d093c0e8c6a3c6fd86a52a
Instruction ID: 77d0f37b6d466af42495f24ca7f41f0fac402879eb2572d33872c476a29bb1aa
Opcode Fuzzy Hash: 54391a1ecdf395f3f9479269b8ff0da8de73bbd369d093c0e8c6a3c6fd86a52a
Instruction Fuzzy Hash: A501AF31B104144BDB65AA7EE894B3F77DADBC9A24F108839E50ECB340EE25DC038792

Function 06DD9FA8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690d5bfd71405408076f99947ad6ccdc76ea15e8338a97319ddffa0f401aec8b
Instruction ID: 118496395adfb106c1fb7b02e9ef8e51354f6337e082665a2f08fa3a87ca1ba0
Opcode Fuzzy Hash: 690d5bfd71405408076f99947ad6ccdc76ea15e8338a97319ddffa0f401aec8b
Instruction Fuzzy Hash: A2018135B101144BDB64EA7DE854B2A77D6EBC9624F108438F50ECB358EE2ADC4B8781

Function 06DDC890 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2e6e9b7f5b3f12cb676a610b945c4b525a7b984acba4bf4cb93c01f9c6be37
Instruction ID: 82577ca269f210fe3ef3346aebcd08c14ed3d2184b3638c234facaf29be737ff
Opcode Fuzzy Hash: 5e2e6e9b7f5b3f12cb676a610b945c4b525a7b984acba4bf4cb93c01f9c6be37
Instruction Fuzzy Hash: D601A931F211289BDB54AEA5ED40A9D7779FB84314F10453DE905EB340DB769C05CB84

Function 06DD6108 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1daf5b483b88143deaf889dc2b288791ab57e8ad6d8fa63c6efcd8daeb60e3fe
Instruction ID: 3c0b92bd4a658dec6b952531dd91d26bfa88294125df1588a20798f8a74a545d
Opcode Fuzzy Hash: 1daf5b483b88143deaf889dc2b288791ab57e8ad6d8fa63c6efcd8daeb60e3fe
Instruction Fuzzy Hash: A6E09274E065885FDB50DB70CF46BAE7BB8DB42248F2085E6D809CB102D536CA8583A1

Function 06DD6118 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a677e92a9621ce443835487d53bca198cee480dfa36386bfc4b0cf8d9c507595
Instruction ID: e9d48dcf30b0dd7a344a546da9b3a901bf4e124f315346436cb4dad04c4b16c5
Opcode Fuzzy Hash: a677e92a9621ce443835487d53bca198cee480dfa36386bfc4b0cf8d9c507595
Instruction Fuzzy Hash: 93E0C270E10148ABDF50EFB4CD05B5EB7ACDB02208F2084A4D809CB202E172CA0287C0

Non-executed Functions

Function 06DD7330 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DD789E
$]q, xrefs: 06DD77E9
$]q, xrefs: 06DD77DD
$]q, xrefs: 06DD7892
$]q, xrefs: 06DD787C
$]q, xrefs: 06DD742C
$]q, xrefs: 06DD7451
$]q, xrefs: 06DD745D
$]q, xrefs: 06DD7888
$]q, xrefs: 06DD7420

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 2d608a9d6085d7df4bdcf6f1ed2d08c3da8a59c77384bcd45d50fbc27d9e372a
Instruction ID: a388f305cabf54768d5010bda6705f40da4f55dd5f1189dd9555b3251d0ff4d9
Opcode Fuzzy Hash: 2d608a9d6085d7df4bdcf6f1ed2d08c3da8a59c77384bcd45d50fbc27d9e372a
Instruction Fuzzy Hash: 6E124D30E00219CFDB68EF69D994A9DB7B2FF88704F2089A9D449AB354DB349D45CF81

Function 06DDE458 Relevance: 4.3, Strings: 3, Instructions: 580COMMON

Download Yara Rule

Strings

PH]q, xrefs: 06DDE6B8
Dqdp, xrefs: 06DDE4FC
0odp, xrefs: 06DDE4F0

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: 0odp$Dqdp$PH]q
API String ID: 0-4272097961
Opcode ID: e0e1425ecd81bd155ff958b4275f20a381310673fac6808f6e5ee440b3e305c4
Instruction ID: 26c8678d169639f2f0d2b2d174401994de077405c8fa03c080fc60236a970608
Opcode Fuzzy Hash: e0e1425ecd81bd155ff958b4275f20a381310673fac6808f6e5ee440b3e305c4
Instruction Fuzzy Hash: A9229D30B101058FDB94EB68D994A6EB7F6EF89310F108969D40ADF3A1DB35EC46CB91

Function 06DD5990 Relevance: 2.9, Strings: 2, Instructions: 410COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06DD5AD1
XPbq, xrefs: 06DD5AA1

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: XPbq$\Obq
API String ID: 0-409418754
Opcode ID: 3ec7e2e55a56f7718fa6f11d4bca5e3ab3fda5fe6d7e6feb71d2db2d261b6e14
Instruction ID: 2a007fca5f49e37fb41fb1a9b88f18625272a0a6f00f76d1e88120a1e45f542f
Opcode Fuzzy Hash: 3ec7e2e55a56f7718fa6f11d4bca5e3ab3fda5fe6d7e6feb71d2db2d261b6e14
Instruction Fuzzy Hash: CCD1B431B100158FDF64EB6CE494AAEB7F6FB89720F25846AD40ADB395CA31EC45C790

Function 06DD0040 Relevance: 2.0, Instructions: 1989COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ace44dba206a0b878f2069d5bd985afeac9f695622ade530a7b7aa647d4fea3
Instruction ID: 0069dbd89a6acccb4bd2b37b73fcd44dd741bdeb3761f2d6560a87342eeffa5c
Opcode Fuzzy Hash: 7ace44dba206a0b878f2069d5bd985afeac9f695622ade530a7b7aa647d4fea3
Instruction Fuzzy Hash: BB23ED31D106198ECB11EF68C8946ADF7B1FF99300F15C79AE458A7221EB70AAD5CF81

Function 06DD0007 Relevance: 2.0, Instructions: 1989COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90f51234e12d65891855f2c0b44b33a6a249ce036745d112c734a4b525ff204
Instruction ID: 82cacfa3e1ad10f0b72d0df6aeb1c74016239cdd9b1198508d19f4f52169e3a6
Opcode Fuzzy Hash: e90f51234e12d65891855f2c0b44b33a6a249ce036745d112c734a4b525ff204
Instruction Fuzzy Hash: C423EC31D106198ECB11EF68C8946ADF7B1FF99300F15C79AE458A7221EB70AAD5CF81

Function 06DC6248 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151602571f36b1a3d479a4c2e54833cdad039da4696874318d3be82776cdce2a
Instruction ID: 00915c7bb638f34cf5224ac0d684652eb6309c746118ea0f4f90236b25692e34
Opcode Fuzzy Hash: 151602571f36b1a3d479a4c2e54833cdad039da4696874318d3be82776cdce2a
Instruction Fuzzy Hash: C71262B08017468AE730CF65E98C2897BB1BB85338F50C719D2656E2E9DBB8158BCF44

Function 06DC623B Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4533430534.0000000006DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dc0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7048c658053c499eee2044db633db1380ff1fbe977d5e9b9d6749dca4f7e100
Instruction ID: 1c0d51319d512a44cfe8b081155e7d88ed90ef41187065607dd12e4c4b0dce6c
Opcode Fuzzy Hash: c7048c658053c499eee2044db633db1380ff1fbe977d5e9b9d6749dca4f7e100
Instruction Fuzzy Hash: 41C1D5B18017468BE720CF64E98C2897BB1FB85338F518719D1616F2E9DBB8158BCF44

Function 06DDA5D0 Relevance: 10.2, Strings: 8, Instructions: 229COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DDA72D
$]q, xrefs: 06DDA758
$]q, xrefs: 06DDA6D2
$]q, xrefs: 06DDA74C
$]q, xrefs: 06DDA78E
$]q, xrefs: 06DDA721
$]q, xrefs: 06DDA6C6
$]q, xrefs: 06DDA782

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 6f8741890f39a536fc0177bc79ca0c41d54260b72c3771e1d4f52ce0d01107b6
Instruction ID: 72146b99b59b91306058a5c1cc3976081346efc80b20fad82de30b0f56a8715e
Opcode Fuzzy Hash: 6f8741890f39a536fc0177bc79ca0c41d54260b72c3771e1d4f52ce0d01107b6
Instruction Fuzzy Hash: C1915030E00209EFDB68EF69D994B6E77B6EF44700F18C429D841A7294DB39DD46CB90

Function 06DD6D30 Relevance: 9.2, Strings: 7, Instructions: 405COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DD7012
$]q, xrefs: 06DD7244
$]q, xrefs: 06DD7238
$]q, xrefs: 06DD706C
.5uq, xrefs: 06DD6D8B
$]q, xrefs: 06DD71CC
$]q, xrefs: 06DD7078

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: .5uq$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-981061697
Opcode ID: 2005527857afb6769a661099c85f2ee6c7717b2af842665061df962197f65880
Instruction ID: e369242062da9011bf64ffc345ffc5ae555608cd91f440abcf2358514fbf6a60
Opcode Fuzzy Hash: 2005527857afb6769a661099c85f2ee6c7717b2af842665061df962197f65880
Instruction Fuzzy Hash: E3F16430B00209CFDB59EFA9D550A6EBBB6FF84744F248568D815AB394CB39DC46CB81

Function 06DDBAB0 Relevance: 7.7, Strings: 6, Instructions: 197COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DDBCBD
$]q, xrefs: 06DDBC55
$]q, xrefs: 06DDBCB1
$]q, xrefs: 06DDBC49
$]q, xrefs: 06DDBC89
$]q, xrefs: 06DDBC7D

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: c46d379c94cadc24f590f30d655db7cb2103d286e79bc475cba2e5d4269e7c01
Instruction ID: 526b499d002a6beaa288b87e6d796636acbd7322212715b9d09303ebe57d9c18
Opcode Fuzzy Hash: c46d379c94cadc24f590f30d655db7cb2103d286e79bc475cba2e5d4269e7c01
Instruction Fuzzy Hash: E771AC70E002098FDB68EF68D980A6EB7F6FF84708F11846AD406EB255DB75DD46CB81

Function 06DD8068 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DD82C2
$]q, xrefs: 06DD8333
$]q, xrefs: 06DD82CE
$]q, xrefs: 06DD8327

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 312379be7bf761e883f262293bf5a0e98ef11836f602804f95122ade2b334a45
Instruction ID: 179e8c4f853999ccbf66f33fb850febc5ddbd3d3b8e2c222f9cff83c7d0ffffd
Opcode Fuzzy Hash: 312379be7bf761e883f262293bf5a0e98ef11836f602804f95122ade2b334a45
Instruction Fuzzy Hash: 78B17030A01209CFDB69EFA9D590A6EB7B6FF84704F248429D405EB394DB35DC86CB81

Function 06DDA95A Relevance: 5.2, Strings: 4, Instructions: 173COMMON

Download Yara Rule

Strings

$]q, xrefs: 06DDAADC
$]q, xrefs: 06DDAA89
$]q, xrefs: 06DDAB0B
$]q, xrefs: 06DDAB34

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 7a014e3885bdb69f348274c253af4771b82c97e1824bfa56cb0f2b44b6694bd6
Instruction ID: 3bbf07c875146ffa1f8fe8859832cd97ad6c5a6ce32242ab0faf100774e818d5
Opcode Fuzzy Hash: 7a014e3885bdb69f348274c253af4771b82c97e1824bfa56cb0f2b44b6694bd6
Instruction Fuzzy Hash: E2518530E102098FDF65EF68D9809ADB3B6EB84714F19C56AD815EB350DB35DC42CB91

Function 06DD8480 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06DD85C2
$]q, xrefs: 06DD850B
LR]q, xrefs: 06DD8573
$]q, xrefs: 06DD84FF

Memory Dump Source

Source File: 00000000.00000002.4533459397.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6dd0000_uLFOeGZaJS.jbxd

Similarity

API ID:
String ID: LR]q$LR]q$$]q$$]q
API String ID: 0-3527005858
Opcode ID: e8ede42f630227cf95e2098588d4ec6c36ae9c2ff463448c7c2cc529710438f3
Instruction ID: 7fa8f5e09d6e6f68e3264a9fdb3f9572a3dba503da54b0fdc87b4dd2becc2382
Opcode Fuzzy Hash: e8ede42f630227cf95e2098588d4ec6c36ae9c2ff463448c7c2cc529710438f3
Instruction Fuzzy Hash: BA51BF30B002019FDB59EF68D990A6EB7F6FF88714F148569E5069B394DA38EC01CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uLFOeGZaJS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
uLFOeGZaJS.exe

Function 06DD7A10 Relevance: 3.0, Strings: 2, Instructions: 475
COMMON

Function 0135EE18 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Function 06DDA968 Relevance: 10.4, Strings: 8, Instructions: 390
COMMON

Function 06DCA629 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Function 06DCA638 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 06DD8DE8 Relevance: 5.2, Strings: 4, Instructions: 231
COMMON

Function 06DDCFF8 Relevance: 4.6, Strings: 3, Instructions: 800
COMMON

Function 06DD4840 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Function 06DD8DD9 Relevance: 2.7, Strings: 2, Instructions: 168
COMMON

Function 06DD4831 Relevance: 2.6, Strings: 2, Instructions: 140
COMMON

Function 06DC6C2F Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Function 06DC6C38 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 06DCA434 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre