Edit tour

Windows Analysis Report
Shipping Documents 72908672134.exe

Overview

General Information

Sample name:	Shipping Documents 72908672134.exe
Analysis ID:	1570232
MD5:	79a654fb9778bbaa52c59b3d560d67e3
SHA1:	b6223cb3017cc0c0d87e572b2e5c072697dfa28c
SHA256:	8a6beff354864244295bc068310c5eacd014e472048cce2c16b9f17bd9f51e7a
Tags:	AgentTeslaexeuser-lowmal3
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Shipping Documents 72908672134.exe (PID: 6680 cmdline: "C:\Users\user\Desktop\Shipping Documents 72908672134.exe" MD5: 79A654FB9778BBAA52C59B3D560D67E3)

RegSvcs.exe (PID: 6804 cmdline: "C:\Users\user\Desktop\Shipping Documents 72908672134.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alltoursegypt.com", "Username": "admin@alltoursegypt.com", "Password": "OPldome23#12klein"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34edb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f4d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34fd7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35069:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x350d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35145:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x351db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3526b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Shipping Documents 72908672134.exe PID: 6680	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Shipping Documents 72908672134.exe PID: 6680	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6804	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34edb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f4d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34fd7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35069:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x350d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35145:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x351db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3526b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Shipping Documents 72908672134.exe.4150000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipping Documents 72908672134.exe.4150000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Shipping Documents 72908672134.exe.4150000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x330db:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3314d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x331d7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33269:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x332d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33345:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x333db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3346b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.700000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.700000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.700000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34edb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34f4d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34fd7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x35069:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x350d3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x35145:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x351db:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3526b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 192.254.186.165, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6804, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 2.2.RegSvcs.exe.700000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.alltoursegypt.com", "Username": "admin@alltoursegypt.com", "Password": "OPldome23#12klein"}

Multi AV Scanner detection for submitted file

Source: Shipping Documents 72908672134.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Shipping Documents 72908672134.exe

Joe Sandbox ML: detected

Source: Shipping Documents 72908672134.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: Shipping Documents 72908672134.exe, 00000000.00000003.2113567180.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, Shipping Documents 72908672134.exe, 00000000.00000003.2114767841.0000000004380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Shipping Documents 72908672134.exe, 00000000.00000003.2113567180.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, Shipping Documents 72908672134.exe, 00000000.00000003.2114767841.0000000004380000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004C445A
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CC6D1 FindFirstFileW,FindClose,	0_2_004CC6D1
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004CC75C
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004CEF95
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004CF0F2
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_004CF3F3
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004C37EF
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004C3B12
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_004CBCBC

Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004D22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_004D22EE

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: mail.alltoursegypt.com

Source: RegSvcs.exe, 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://alltoursegypt.com
Source: RegSvcs.exe, 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.alltoursegypt.com
Source: RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.i.lencr.org/01
Source: RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r10.o.lencr.org0#
Source: RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Shipping Documents 72908672134.exe, 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Shipping Documents 72908672134.exe, 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.5:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, NmHr1WHWKO.cs

.Net Code: lhg

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004D4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004D4164

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004D4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004D4164

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004D3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_004D3F66

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004C001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_004C001C

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004ECABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_004ECABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00463B3A
Source: Shipping Documents 72908672134.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Shipping Documents 72908672134.exe, 00000000.00000000.2077924643.0000000000514000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cc6319a2-b
Source: Shipping Documents 72908672134.exe, 00000000.00000000.2077924643.0000000000514000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_5f92eede-1
Source: Shipping Documents 72908672134.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_7f4df144-6
Source: Shipping Documents 72908672134.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_756659af-5

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Shipping Documents 72908672134.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004CA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_004CA1EF

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004B8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_004B8310

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004C51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_004C51BD

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0046E6A0	0_2_0046E6A0
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0048D975	0_2_0048D975
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0046FCE0	0_2_0046FCE0
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004821C5	0_2_004821C5
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004962D2	0_2_004962D2
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004E03DA	0_2_004E03DA
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0049242E	0_2_0049242E
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004825FA	0_2_004825FA
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004BE616	0_2_004BE616
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004766E1	0_2_004766E1
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0049878F	0_2_0049878F
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00496844	0_2_00496844
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004E0857	0_2_004E0857
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00478808	0_2_00478808
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C8889	0_2_004C8889
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0048CB21	0_2_0048CB21
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00496DB6	0_2_00496DB6
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00476F9E	0_2_00476F9E
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00473030	0_2_00473030
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0048F1D9	0_2_0048F1D9
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00483187	0_2_00483187
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00461287	0_2_00461287
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00481484	0_2_00481484
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00475520	0_2_00475520
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00487696	0_2_00487696
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00475760	0_2_00475760
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00481978	0_2_00481978
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00499AB5	0_2_00499AB5
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004E7DDB	0_2_004E7DDB
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00481D90	0_2_00481D90
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0048BDA6	0_2_0048BDA6
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0046DF00	0_2_0046DF00
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00473FE0	0_2_00473FE0
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_019B6100	0_2_019B6100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00BDA978	2_2_00BDA978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00BD4A98	2_2_00BD4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00BD3E80	2_2_00BD3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00BD41C8	2_2_00BD41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00BDF9C8	2_2_00BDF9C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C5E68	2_2_051C5E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C9320	2_2_051C9320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051CE208	2_2_051CE208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051CA260	2_2_051CA260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C3DE0	2_2_051C3DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051CC4A0	2_2_051CC4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C5788	2_2_051C5788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C3690	2_2_051C3690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C46D8	2_2_051C46D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051C0338	2_2_051C0338

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: String function: 00488900 appears 42 times
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: String function: 00467DE1 appears 36 times
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: String function: 00480AE3 appears 70 times

Source: Shipping Documents 72908672134.exe, 00000000.00000003.2113204649.00000000042B3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Shipping Documents 72908672134.exe
Source: Shipping Documents 72908672134.exe, 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename106790a0-b81d-4bde-9832-48ebd9bb7fec.exe4 vs Shipping Documents 72908672134.exe
Source: Shipping Documents 72908672134.exe, 00000000.00000003.2113315957.000000000445D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Shipping Documents 72908672134.exe

Source: Shipping Documents 72908672134.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004CA06A GetLastError,FormatMessageW,

0_2_004CA06A

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004B81CB AdjustTokenPrivileges,CloseHandle,		0_2_004B81CB
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004B87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_004B87E1

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004CB333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_004CB333

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004DEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_004DEE0D

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004CC397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_004CC397

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00464E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00464E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

File created: C:\Users\user\AppData\Local\Temp\autCE59.tmp

Jump to behavior

Source: Shipping Documents 72908672134.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Shipping Documents 72908672134.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\Shipping Documents 72908672134.exe "C:\Users\user\Desktop\Shipping Documents 72908672134.exe"
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Shipping Documents 72908672134.exe"
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Shipping Documents 72908672134.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Shipping Documents 72908672134.exe

Static file information: File size 1080320 > 1048576

Source: Shipping Documents 72908672134.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Shipping Documents 72908672134.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Shipping Documents 72908672134.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Shipping Documents 72908672134.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Shipping Documents 72908672134.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Shipping Documents 72908672134.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Shipping Documents 72908672134.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Shipping Documents 72908672134.exe, 00000000.00000003.2113567180.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, Shipping Documents 72908672134.exe, 00000000.00000003.2114767841.0000000004380000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Shipping Documents 72908672134.exe, 00000000.00000003.2113567180.00000000041E0000.00000004.00001000.00020000.00000000.sdmp, Shipping Documents 72908672134.exe, 00000000.00000003.2114767841.0000000004380000.00000004.00001000.00020000.00000000.sdmp

Source: Shipping Documents 72908672134.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Shipping Documents 72908672134.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Shipping Documents 72908672134.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Shipping Documents 72908672134.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Shipping Documents 72908672134.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00464B37 LoadLibraryA,GetProcAddress,

0_2_00464B37

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0046C4C6 push A30046BAh; retn 0046h	0_2_0046C50D
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_00488945 push ecx; ret	0_2_00488958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00BD0C55 push edi; retf	2_2_00BD0C7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_051CABF9 push ecx; iretd	2_2_051CAC00

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004648D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_004648D7
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004E5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_004E5376

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00483187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00483187

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

API/Special instruction interceptor: Address: 19B5D24

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1325			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8534			Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-103589

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_004C445A
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CC6D1 FindFirstFileW,FindClose,	0_2_004CC6D1
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_004CC75C
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004CEF95
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_004CF0F2
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_004CF3F3
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004C37EF
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004C3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_004C3B12
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004CBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_004CBCBC

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004649A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004649A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95593	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 95046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94718	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 94609	Jump to behavior

Source: Shipping Documents 72908672134.exe, 00000000.00000003.2078599683.0000000001784000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe\'
Source: RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	API call chain: ExitProcess graph end node			graph_0-100989
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	API call chain: ExitProcess graph end node			graph_0-100915

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004D3F09 BlockInput,

0_2_004D3F09

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00463B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00463B3A

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00495A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00495A7C

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00464B37 LoadLibraryA,GetProcAddress,

0_2_00464B37

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_019B4990 mov eax, dword ptr fs:[00000030h]	0_2_019B4990
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_019B5F90 mov eax, dword ptr fs:[00000030h]	0_2_019B5F90
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_019B5FF0 mov eax, dword ptr fs:[00000030h]	0_2_019B5FF0

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004B80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_004B80A9

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0048A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0048A155
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_0048A124 SetUnhandledExceptionFilter,		0_2_0048A124

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 512008

Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004B87B1 LogonUserW,

0_2_004B87B1

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00463B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00463B3A

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004648D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_004648D7

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004C4C53 mouse_event,

0_2_004C4C53

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Shipping Documents 72908672134.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004B7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_004B7CAF

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004B874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_004B874B

Source: Shipping Documents 72908672134.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Shipping Documents 72908672134.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_0048862B cpuid

0_2_0048862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00494E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00494E87

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004A1E06 GetUserNameW,

0_2_004A1E06

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_00493F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00493F3A

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe

Code function: 0_2_004649A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_004649A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Documents 72908672134.exe.4150000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Documents 72908672134.exe PID: 6680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6804, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Shipping Documents 72908672134.exe	Binary or memory string: WIN_81
Source: Shipping Documents 72908672134.exe	Binary or memory string: WIN_XP
Source: Shipping Documents 72908672134.exe	Binary or memory string: WIN_XPe
Source: Shipping Documents 72908672134.exe	Binary or memory string: WIN_VISTA
Source: Shipping Documents 72908672134.exe	Binary or memory string: WIN_7
Source: Shipping Documents 72908672134.exe	Binary or memory string: WIN_8
Source: Shipping Documents 72908672134.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Documents 72908672134.exe.4150000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Documents 72908672134.exe PID: 6680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6804, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Shipping Documents 72908672134.exe.4150000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipping Documents 72908672134.exe.4150000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.700000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipping Documents 72908672134.exe PID: 6680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6804, type: MEMORYSTR

Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004D6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_004D6283
Source: C:\Users\user\Desktop\Shipping Documents 72908672134.exe	Code function: 0_2_004D6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_004D6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	221 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipping Documents 72908672134.exe	37%	ReversingLabs	Win32.Trojan.AutoitInject
Shipping Documents 72908672134.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://alltoursegypt.com	0%	Avira URL Cloud	safe
http://mail.alltoursegypt.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
api.ipify.org	104.26.13.205	true	false	high
alltoursegypt.com	192.254.186.165	true	true	unknown
mail.alltoursegypt.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mail.alltoursegypt.com	RegSvcs.exe, 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.org	Shipping Documents 72908672134.exe, 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp	false		high
http://r10.o.lencr.org0#	RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://r10.i.lencr.org/01	RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Shipping Documents 72908672134.exe, 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.4555849592.00000000026B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	RegSvcs.exe, 00000002.00000002.4555514246.0000000000B27000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.0000000005980000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555383999.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4558058646.00000000059FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://alltoursegypt.com	RegSvcs.exe, 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4555849592.00000000028C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
192.254.186.165	alltoursegypt.com	United States		46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570232
Start date and time:	2024-12-06 17:19:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipping Documents 72908672134.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 270
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Shipping Documents 72908672134.exe

Simulations

Behavior and APIs

Time	Type	Description
11:20:07	API Interceptor	11271141x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.205	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
192.254.186.165	PUK ITALIA PO 120610549.EXE.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	104.26.12.205
	Simple1.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Simple1.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	104.22.59.181
	IO7R6LIL3OH.exe	Get hash	malicious	Unknown	Browse	104.21.6.203
	https://shorturl.at/yWYYs?US=1583v79i	Get hash	malicious	Unknown	Browse	104.26.9.129
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.21.13.139
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://www.schneiderpostaccident.com	Get hash	malicious	Unknown	Browse	104.18.142.119
	https://getvideoz.click/	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.toomanyfailurescannot.com/9IjIRd3	Get hash	malicious	HTMLPhisher	Browse	172.67.206.61
	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	172.65.251.78
UNIFIEDLAYER-AS-1US	#U25b6#Ufe0fPlayVoiceMessage9266.eml	Get hash	malicious	Unknown	Browse	192.185.77.66
	main_spc.elf	Get hash	malicious	Mirai	Browse	173.254.73.204
	https://track-004.blogspot.com	Get hash	malicious	Unknown	Browse	50.87.184.136
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	192.254.190.193
	aU1TV97585.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	0wxckB4Iba.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	8JuGuaUaZP.exe	Get hash	malicious	AgentTesla	Browse	50.87.218.140
	#U25b6#Ufe0fPlayVoiceMessage9312.eml	Get hash	malicious	Unknown	Browse	192.185.77.66
	tmp667.HtML.html	Get hash	malicious	Unknown	Browse	50.116.87.59
	RFQ.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.139.143

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://app.droplet.io/form/K47rYN	Get hash	malicious	Unknown	Browse	104.26.13.205
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	QUOTE_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	vUlh7stUHJ.exe	Get hash	malicious	XWorm	Browse	104.26.13.205
	lg1wwLsmCX.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.13.205
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.13.205
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.13.205
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	104.26.13.205
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\Shipping Documents 72908672134.exe
File Type:	data
Category:	dropped
Size (bytes):	148884
Entropy (8bit):	7.927669821531287
Encrypted:	false
SSDEEP:	3072:mLXrSHi9yO0CB1Cf+fu4naybPzMqJHGZZ+S/Q8yW6G+fU2KDc:mLXrSHiyO0CCIu4naqPg60T/Qw6GJRY
MD5:	DE30AECBA8CD20D09D2FA7A232724873
SHA1:	AFFAA3741BCA77666A2700804F0171C819C6C8AB
SHA-256:	EF1ED091ECFDD014364BBE0B0DD571400C2567CA963D2D580755DE16BE0B8DAE
SHA-512:	8DB1F58264E90E61FF671BBC2EF8CAC84A0A2D6B05E0EA9204257802EE745A52CA516AF35C43CA71F186361FD16DA09C3FB121B94A0109F1B8510B6E04354F5F
Malicious:	false
Reputation:	low
Preview:	EA06.....X.sZ...R....>..G.R.p....Tk....p... ......+5..r.../>./.j....[..m9.J.s.=nU[..&W),..#........Y.....U..,`.y..j...n.G.y;s ..n..Y..i\...J%Z...^2.F.Y....d.<..j.p..V...%.C....8...)qT..;.j<..5....J.F..[.8..j...^(...U..L.......H...g.R.....)sX..ob....f..`=. .@..........G.M..L.H..Dh@....Q.W.......... ....Q9.V+U...Q@...d.[..V..P.O.....h.H..yT..iv....F.Qj...Z.8...<?.....~.v....C.Y....hd}z...E.b&]..".G.O.]..F!J..yx...OA...8J....O:[lw.e..U$5..C........&Y..].}......ow9..;.M?../.9)..g...>....,1..oM...1.o.Y....h..o6.H.PY..w$.`i<...+..d._...]"..#.. ..C.C?.~...E..?=}^n^..H.0.(.i&..#..E\.H.......H..C@8H0..a...`..`..........D.v~.............+..:P......C.^.LrIj.o._.G....5..~"K..Du...SgS....YmR...U.5..uL..)w..3u...k....2..)V.L?Q..^....>...u$~O..."..].Q....k.G...z7J....C.m..5.Q...=..?..'R(...w...2.D.ix.@.v.].K(...b.T.O)....cZ.^iu..6%.C@...F.Q.V%1...c).....F.q......V.,.Q.,.G.Rc.J=..E.j.z.Z.K.Mj....D.^..l.....*3....p.[..t...Q!4}5n....o.....M......#....\|b.Q.^

C:\Users\user\AppData\Local\Temp\scroll

Download File

Process:	C:\Users\user\Desktop\Shipping Documents 72908672134.exe
File Type:	data
Category:	dropped
Size (bytes):	247296
Entropy (8bit):	6.513850386752959
Encrypted:	false
SSDEEP:	6144:qxcwBJz+Gl2QvYv0SyD8vX688eM3vxfaQbY1:qmukGlOYD8gfxfaQb+
MD5:	C31BF2DE647BCCC000EE00E296EC4210
SHA1:	A4952F6A9899D07300BE04981EB4112ED4511BD9
SHA-256:	871C2B734C6113A65CF69A533432DFC9F7118B7CF5B3CF424873BC65F8EA7714
SHA-512:	9731020609B5D170F24A67D71706542C530B6234193A9C0640AF38B4E7DF354D6605D40E38CAE92CCEC79E8430D61F59BCB13EA486A641EDC9633C88983FBB9C
Malicious:	false
Reputation:	low
Preview:	.b.5TGFRCDVQ..VG.K5WGFRG.VQXZVG8K5WGFRGDVQXZVG8K5WGFRGDVQXZV.8K5YX.\G._.y.W..ja?.5r7696;;g[[9(2r%!v#-4v.Vkq..f?( 3.UW\c8K5WGFR..VQ.[UGL..2GFRGDVQX.VE9@4\GF.DDVYXZVG8K..DFRgDVQ.YVG8.5WgFRGFVQ\ZVG8K5WCFRGDVQXZvC8K7WGFRGDTQ..VG(K5GGFRGTVQHZVG8K5GGFRGDVQXZVGP.6W.FRGD.RX.SG8K5WGFRGDVQXZVG8K5WCF^GDVQXZVG8K5WGFRGDVQXZVG8K5WGFRGDVQXZVG8K5WGFRGDVQXZVg8K=WGFRGDVQXZVO.K5.GFRGDVQXZVG.?P/3FRG..RXZvG8K.TGFPGDVQXZVG8K5WGFrGD6.)$$8K5.BFRG.UQX\VG8.6WGFRGDVQXZVG8.5W.h "(92XZZG8K5WCFREDVQ.YVG8K5WGFRGDVQ.ZV.8K5WGFRGDVQXZVG8..TGFRGD.QXZTG=Ka.EFF\|EVRXZVF8K3WGFRGDVQXZVG8K5WGFRGDVQXZVG8K5WGFRGDVQXZVG8K5WGFO....h.Eu?5@.t.#.R..E.2..H.G.?B...J....a'A..Q.Uf.<...2.^T![....o'M#I,.&wU7.%...{s3...^4.=...)u.<A`.x...a....I&....,..$W&.676>"j.0>;$..I.VGFRG........"M..kQHZbC .....E?..../XZV#8K5%GFR&DVQ.ZVGWK5W)FRG:VQX$VG8.5WG.RGDaQXZsG8KXWGFvGDV/XZV.ED:...;4.QXZVG...g.+.....o...:.).$j...5....=..X/.%.....T.S..@.-Td..VY\RB:L1TK{\....yXRC=I2SDJoI....{.a.....#....".G8K5WG.RG.VQX..G.K5W.F.G..QXZ.8.5.G...D

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.035317197793608
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Shipping Documents 72908672134.exe
File size:	1'080'320 bytes
MD5:	79a654fb9778bbaa52c59b3d560d67e3
SHA1:	b6223cb3017cc0c0d87e572b2e5c072697dfa28c
SHA256:	8a6beff354864244295bc068310c5eacd014e472048cce2c16b9f17bd9f51e7a
SHA512:	3399a6d13fe47928f66fd1da640572c2bec68903bff19afadf64f50a9a58bef3f10c672f336bc14c8eb768bb3cd2eb4c63a5d25bc809a1f0e2eadc4e789355e6
SSDEEP:	24576:pu6J33O0c+JY5UZ+XC0kGso6Fa/E8fVDM5joWY:Lu0c++OCvkGs9Fa/Em4Y
TLSH:	5D35BE2273DDC360CB669173BF69B7016EBF3C610630B95B2F980D7DA950162262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6752E1BC [Fri Dec 6 11:36:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FEC2D047E8Ah
jmp 00007FEC2D03AC54h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FEC2D03ADDAh
cmp edi, eax
jc 00007FEC2D03B13Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FEC2D03ADD9h
rep movsb
jmp 00007FEC2D03B0ECh
cmp ecx, 00000080h
jc 00007FEC2D03AFA4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FEC2D03ADE0h
bt dword ptr [004BE324h], 01h
jc 00007FEC2D03B2B0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FEC2D03AF7Dh
test edi, 00000003h
jne 00007FEC2D03AF8Eh
test esi, 00000003h
jne 00007FEC2D03AF6Dh
bt edi, 02h
jnc 00007FEC2D03ADDFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FEC2D03ADE3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FEC2D03AE35h
bt esi, 03h
jnc 00007FEC2D03AE88h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x3f27c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x107000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x3f27c	0x3f400	040080db15f234d7bc84dd46d7969a75	False	0.8954576333992095	data	7.818973543870664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x107000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x36541	data			1.0003415285198782
RT_GROUP_ICON	0x105cfc	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x105d74	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x105d88	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x105d9c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x105db0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x105e8c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:20:05.248023033 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:05.248061895 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:05.248137951 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:05.273802996 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:05.273825884 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.522650003 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.522725105 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:06.527019024 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:06.527034044 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.527246952 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.575042009 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:06.581104994 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:06.627326012 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.977905035 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.977957010 CET	443	49704	104.26.13.205	192.168.2.5
Dec 6, 2024 17:20:06.978070021 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:06.984328985 CET	49704	443	192.168.2.5	104.26.13.205
Dec 6, 2024 17:20:08.277846098 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:08.399898052 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:08.400017023 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:09.681001902 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:09.681277990 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:09.801119089 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.049757957 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.049995899 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:10.169934988 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.417787075 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.418436050 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:10.538357973 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.796627998 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.796652079 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.796663046 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.796710014 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:10.796720982 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:10.796755075 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:10.859030962 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:10.979890108 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:11.226195097 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:11.229114056 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:11.350186110 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:11.596481085 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:11.600264072 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:11.720016956 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:11.975732088 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:11.980278969 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:12.100661039 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:12.414205074 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:12.414447069 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:12.534286022 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:12.780517101 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:12.780863047 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:12.900788069 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.154776096 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.155021906 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:13.276443005 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.522502899 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.523180008 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:13.523180008 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:13.523180008 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:13.523300886 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:13.643831968 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.643848896 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.643882990 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.643901110 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.953989983 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:13.996929884 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:14.021306992 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:14.141063929 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:14.387469053 CET	587	49705	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:14.387878895 CET	49705	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:14.388858080 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:14.510327101 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:14.510495901 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:15.739259005 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:15.739454985 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:15.859379053 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.106560946 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.106733084 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:16.227596998 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.474771023 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.475292921 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:16.595093012 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.857453108 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.857476950 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.857489109 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:16.857601881 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:16.858946085 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:16.978755951 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:17.225219965 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:17.226603031 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:17.346448898 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:17.593550920 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:17.598851919 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:17.719129086 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:17.975138903 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:17.975543976 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:18.101854086 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:18.398026943 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:18.398230076 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:18.519072056 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:18.765566111 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:18.765934944 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:18.885926008 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.157036066 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.157205105 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.277067900 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.540914059 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.542215109 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542323112 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542323112 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542376041 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542376041 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542412043 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542448997 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542470932 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542500019 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.542527914 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:19.662291050 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662349939 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662362099 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662601948 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662612915 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662661076 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662674904 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662686110 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662753105 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:19.662764072 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:20.114012957 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:20.168802977 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:20:20.252124071 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:20:20.252211094 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:21:47.485299110 CET	49706	587	192.168.2.5	192.254.186.165
Dec 6, 2024 17:21:47.605232000 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:21:47.851759911 CET	587	49706	192.254.186.165	192.168.2.5
Dec 6, 2024 17:21:47.855433941 CET	49706	587	192.168.2.5	192.254.186.165

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 17:20:05.077287912 CET	65152	53	192.168.2.5	1.1.1.1
Dec 6, 2024 17:20:05.216454983 CET	53	65152	1.1.1.1	192.168.2.5
Dec 6, 2024 17:20:07.461705923 CET	55363	53	192.168.2.5	1.1.1.1
Dec 6, 2024 17:20:08.276578903 CET	53	55363	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 6, 2024 17:20:05.077287912 CET	192.168.2.5	1.1.1.1	0xee58	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:20:07.461705923 CET	192.168.2.5	1.1.1.1	0x1664	Standard query (0)	mail.alltoursegypt.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 6, 2024 17:20:05.216454983 CET	1.1.1.1	192.168.2.5	0xee58	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:20:05.216454983 CET	1.1.1.1	192.168.2.5	0xee58	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:20:05.216454983 CET	1.1.1.1	192.168.2.5	0xee58	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Dec 6, 2024 17:20:08.276578903 CET	1.1.1.1	192.168.2.5	0x1664	No error (0)	mail.alltoursegypt.com	alltoursegypt.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 6, 2024 17:20:08.276578903 CET	1.1.1.1	192.168.2.5	0x1664	No error (0)	alltoursegypt.com		192.254.186.165	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.26.13.205	443	6804	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-06 16:20:06 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-12-06 16:20:06 UTC	425	IN	HTTP/1.1 200 OK Date: Fri, 06 Dec 2024 16:20:06 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8edd99f67bc3c413-EWR server-timing: cfL4;desc="?proto=TCP&rtt=4775&min_rtt=1854&rtt_var=2619&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=1574973&cwnd=173&unsent_bytes=0&cid=4c69e7823d747a7a&ts=459&x=0"
2024-12-06 16:20:06 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 32 32 38 Data Ascii: 8.46.123.228

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Dec 6, 2024 17:20:09.681001902 CET	587	49705	192.254.186.165	192.168.2.5	220-gator3170.hostgator.com ESMTP Exim 4.96.2 #2 Fri, 06 Dec 2024 10:20:09 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 6, 2024 17:20:09.681277990 CET	49705	587	192.168.2.5	192.254.186.165	EHLO 609290
Dec 6, 2024 17:20:10.049757957 CET	587	49705	192.254.186.165	192.168.2.5	250-gator3170.hostgator.com Hello 609290 [8.46.123.228] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 6, 2024 17:20:10.049995899 CET	49705	587	192.168.2.5	192.254.186.165	STARTTLS
Dec 6, 2024 17:20:10.417787075 CET	587	49705	192.254.186.165	192.168.2.5	220 TLS go ahead
Dec 6, 2024 17:20:15.739259005 CET	587	49706	192.254.186.165	192.168.2.5	220-gator3170.hostgator.com ESMTP Exim 4.96.2 #2 Fri, 06 Dec 2024 10:20:15 -0600 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Dec 6, 2024 17:20:15.739454985 CET	49706	587	192.168.2.5	192.254.186.165	EHLO 609290
Dec 6, 2024 17:20:16.106560946 CET	587	49706	192.254.186.165	192.168.2.5	250-gator3170.hostgator.com Hello 609290 [8.46.123.228] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Dec 6, 2024 17:20:16.106733084 CET	49706	587	192.168.2.5	192.254.186.165	STARTTLS
Dec 6, 2024 17:20:16.474771023 CET	587	49706	192.254.186.165	192.168.2.5	220 TLS go ahead

Target ID:	0
Start time:	11:20:00
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\Shipping Documents 72908672134.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shipping Documents 72908672134.exe"
Imagebase:	0x460000
File size:	1'080'320 bytes
MD5 hash:	79A654FB9778BBAA52C59B3D560D67E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.2115913039.0000000004150000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:20:04
Start date:	06/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shipping Documents 72908672134.exe"
Imagebase:	0x330000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4555849592.0000000002734000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4555849592.000000000272C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4555849592.0000000002701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.4555133721.0000000000702000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 00463B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00463B68
IsDebuggerPresent.KERNEL32 ref: 00463B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,005252F8,005252E0,?,?), ref: 00463BEB

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

Part of subcall function 0047092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00463C14,005252F8,?,?,?), ref: 0047096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00463C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00517770,00000010), ref: 0049D281
SetCurrentDirectoryW.KERNEL32(?,005252F8,?,?,?), ref: 0049D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00514260,005252F8,?,?,?), ref: 0049D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0049D346

Part of subcall function 00463A46: GetSysColorBrush.USER32(0000000F), ref: 00463A50
Part of subcall function 00463A46: LoadCursorW.USER32(00000000,00007F00), ref: 00463A5F
Part of subcall function 00463A46: LoadIconW.USER32(00000063), ref: 00463A76
Part of subcall function 00463A46: LoadIconW.USER32(000000A4), ref: 00463A88
Part of subcall function 00463A46: LoadIconW.USER32(000000A2), ref: 00463A9A
Part of subcall function 00463A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00463AC0
Part of subcall function 00463A46: RegisterClassExW.USER32(?), ref: 00463B16

Part of subcall function 004639D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00463A03
Part of subcall function 004639D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00463A24
Part of subcall function 004639D5: ShowWindow.USER32(00000000,?,?), ref: 00463A38
Part of subcall function 004639D5: ShowWindow.USER32(00000000,?,?), ref: 00463A41

Part of subcall function 0046434A: _memset.LIBCMT ref: 00464370
Part of subcall function 0046434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00464415

Strings

runas, xrefs: 0049D33A
This is a third-party compiled AutoIt script., xrefs: 0049D279
%O, xrefs: 00463C44

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%O
API String ID: 529118366-1310891252
Opcode ID: e849a997363e071daee573cd0bf77afef9271352b2d88638d673003ac38273dc
Instruction ID: 8669f71622ee2b5155ccdb14068a53b393d1408cf214dd55929281572deabf29
Opcode Fuzzy Hash: e849a997363e071daee573cd0bf77afef9271352b2d88638d673003ac38273dc
Instruction Fuzzy Hash: CB512475904188EADF10EFB5DC459FD7B74AF16308F0040BBF411A22E2FA78564ADB2A

Function 004649A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 004649CD

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

GetCurrentProcess.KERNEL32(?,004EFAEC,00000000,00000000,?), ref: 00464A9A
IsWow64Process.KERNEL32(00000000), ref: 00464AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00464AE7
FreeLibrary.KERNEL32(00000000), ref: 00464AF2
GetSystemInfo.KERNEL32(00000000), ref: 00464B23
GetSystemInfo.KERNEL32(00000000), ref: 00464B2F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 89736521e8c0fdd275aeb7f345a2123d0d97d512a2b8749aaf8df8a650792b67
Instruction ID: db02d546cfd17ea8dbe04c02c5d5e635e9527d3499992b33b00e0687ef6b6795
Opcode Fuzzy Hash: 89736521e8c0fdd275aeb7f345a2123d0d97d512a2b8749aaf8df8a650792b67
Instruction Fuzzy Hash: 6991A5319897C0DACB31DBA885501ABFFF5AF69300B4449AFD0CA57B42E228A548D75F

Function 00464E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00464D8E,?,?,00000000,00000000), ref: 00464E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00464D8E,?,?,00000000,00000000), ref: 00464EB0
LoadResource.KERNEL32(?,00000000,?,?,00464D8E,?,?,00000000,00000000,?,?,?,?,?,?,00464E2F), ref: 0049D937
SizeofResource.KERNEL32(?,00000000,?,?,00464D8E,?,?,00000000,00000000,?,?,?,?,?,?,00464E2F), ref: 0049D94C
LockResource.KERNEL32(00464D8E,?,?,00464D8E,?,?,00000000,00000000,?,?,?,?,?,?,00464E2F,00000000), ref: 0049D95F

Strings

SCRIPT, xrefs: 00464EA6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: ff6a74ada1a00a5df64a2186db2cb4661d30ae8c3d8395c765deff32bf5f56fc
Instruction ID: 76d5fe3649034d8f5fd31b11f59937688e36c0b3d2ba7c9ee03f6d4ea9cad3d8
Opcode Fuzzy Hash: ff6a74ada1a00a5df64a2186db2cb4661d30ae8c3d8395c765deff32bf5f56fc
Instruction Fuzzy Hash: 701191B1200341BFDB208B65EC48F277BB9FBC5711F104179F5158A250DB62EC048665

Function 0046FCE0 Relevance: 9.8, APIs: 3, Strings: 2, Instructions: 1040COMMON

Download Yara Rule

Strings

pbR, xrefs: 004A49B9
%O, xrefs: 0046FCF3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharUpper
String ID: pbR$%O
API String ID: 3964851224-2156929124
Opcode ID: 8f8a88db02825926ab89a13238ce250d535950c5f3aece9c317e3f236ab47f4f
Instruction ID: 7a41dc2f5f8384c525746fa8b379da98ba05e23b5bfe9712df795e3786588289
Opcode Fuzzy Hash: 8f8a88db02825926ab89a13238ce250d535950c5f3aece9c317e3f236ab47f4f
Instruction Fuzzy Hash: 4C925874608341CFD720DF24C480B6BB7E5BB95304F14892EE88A9B362D779EC45CB9A

Function 0046E6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

DdR, xrefs: 0046EABA
DdR, xrefs: 004A3AF5
DdR, xrefs: 004A3B2E
Variable must be of type 'Object'., xrefs: 004A3E62
DdR, xrefs: 0046EAC1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID: DdR$DdR$DdR$DdR$Variable must be of type 'Object'.
API String ID: 0-1166808912
Opcode ID: 60c282f301aaee310a3ab4dcfa5369113a691747e3c53ff66c0536de3457afb1
Instruction ID: c1b97059586c82f262a1a04e6f22e24eb8ac8d40ba6bf4cbef97281f771ec7f7
Opcode Fuzzy Hash: 60c282f301aaee310a3ab4dcfa5369113a691747e3c53ff66c0536de3457afb1
Instruction Fuzzy Hash: 24A28E78A00205CFCB24CF5AC480AAEB7F1FF59314F24805AE9459B351E779ED46CB9A

Function 004C445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0049E398), ref: 004C446A
FindFirstFileW.KERNELBASE(?,?), ref: 004C447B
FindClose.KERNEL32(00000000), ref: 004C448B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 888e338a90fdee0fbd6ba4ee5f60da6f5aace67b03ee65db4bf60563dbf668ba
Instruction ID: dfec13f6d3f33b25f1140b4169f47a9f54caab0493ab9a755204d37a8230bdc3
Opcode Fuzzy Hash: 888e338a90fdee0fbd6ba4ee5f60da6f5aace67b03ee65db4bf60563dbf668ba
Instruction Fuzzy Hash: 32E0D836810540674214AB78EC4D9EA775C9F45335F20476AFD35C51D0E7785D04959E

Function 004709D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00470A5B
timeGetTime.WINMM ref: 00470D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00470E53
Sleep.KERNEL32(0000000A), ref: 00470E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00470EFA
DestroyWindow.USER32 ref: 00470F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00470F20
Sleep.KERNEL32(0000000A,?,?), ref: 004A4E83
TranslateMessage.USER32(?), ref: 004A5C60
DispatchMessageW.USER32(?), ref: 004A5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004A5C82

Strings

pbR, xrefs: 004A57B4
pbR, xrefs: 004A4FAE
@TRAY_ID, xrefs: 004A578F
@GUI_CTRLHANDLE, xrefs: 004A4FE4
@GUI_WINHANDLE, xrefs: 004A4F8F
@COM_EVENTOBJ, xrefs: 004A54F0
@GUI_CTRLID, xrefs: 004A4F3A
pbR, xrefs: 004A4F59
pbR, xrefs: 004A5003

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pbR$pbR$pbR$pbR
API String ID: 4212290369-1337434133
Opcode ID: c00a78e18f7d8c4562e7cb176d7031c05035dbb36530438885271a0bd4136538
Instruction ID: 233770c29bef06a7db7da4bdd03e8a2420c4c2a63d7577857cd0e33b4eb0a0a0
Opcode Fuzzy Hash: c00a78e18f7d8c4562e7cb176d7031c05035dbb36530438885271a0bd4136538
Instruction Fuzzy Hash: DEB2CF70609741DFD724DF24C984BABB7E4BF95308F14891EE489873A1D778E849CB8A

Function 004C9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004C8F5F: __time64.LIBCMT ref: 004C8F69

Part of subcall function 00464EE5: _fseek.LIBCMT ref: 00464EFD

__wsplitpath.LIBCMT ref: 004C9234

Part of subcall function 004840FB: __wsplitpath_helper.LIBCMT ref: 0048413B

_wcscpy.LIBCMT ref: 004C9247
_wcscat.LIBCMT ref: 004C925A
__wsplitpath.LIBCMT ref: 004C927F
_wcscat.LIBCMT ref: 004C9295
_wcscat.LIBCMT ref: 004C92A8

Part of subcall function 004C8FA5: _memmove.LIBCMT ref: 004C8FDE
Part of subcall function 004C8FA5: _memmove.LIBCMT ref: 004C8FED

_wcscmp.LIBCMT ref: 004C91EF

Part of subcall function 004C9734: _wcscmp.LIBCMT ref: 004C9824
Part of subcall function 004C9734: _wcscmp.LIBCMT ref: 004C9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 004C9452
_wcsncpy.LIBCMT ref: 004C94C5
DeleteFileW.KERNEL32(?,?), ref: 004C94FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 004C9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004C9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 004C9534

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: f02c0a625bf001c5a6b09183ee702595523e704033b3843801400ba98444c0c8
Instruction ID: 2f0607c4c557b1748e5393dc1dd81400b277d51b070928510b6951e987591e04
Opcode Fuzzy Hash: f02c0a625bf001c5a6b09183ee702595523e704033b3843801400ba98444c0c8
Instruction Fuzzy Hash: D5C16BB5D00219AADF21DF95CC85EDEBBB8EF85304F0044ABF608E6151EB349E448F69

Function 00463015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00463074
RegisterClassExW.USER32(00000030), ref: 0046309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004630AF
InitCommonControlsEx.COMCTL32(?), ref: 004630CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004630DC
LoadIconW.USER32(000000A9), ref: 004630F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00463101

Strings

AutoIt v3 GUI, xrefs: 00463090
TaskbarCreated, xrefs: 004630A4
+, xrefs: 0046305D
0, xrefs: 00463056

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: aab9df65ced2e8f9c47d2fb1a8066b7faec9655b4c180aebc8cc10c6c2816ca7
Instruction ID: 7143bb897d7890b9563a73866fe203866092ed42f6c58427c6e18fabf80cd4c3
Opcode Fuzzy Hash: aab9df65ced2e8f9c47d2fb1a8066b7faec9655b4c180aebc8cc10c6c2816ca7
Instruction Fuzzy Hash: C4315AB1841384EFDB20CFA4D884A99BFF0FF09310F24416EE580EA2A1E3B90549CF55

Function 00463041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00463074
RegisterClassExW.USER32(00000030), ref: 0046309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004630AF
InitCommonControlsEx.COMCTL32(?), ref: 004630CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004630DC
LoadIconW.USER32(000000A9), ref: 004630F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00463101

Strings

AutoIt v3 GUI, xrefs: 00463090
TaskbarCreated, xrefs: 004630A4
+, xrefs: 0046305D
0, xrefs: 00463056

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 42a10b79d3f9fda6ddc0d73095d4407b23bd40248bb13a0798dbdedb6478cac0
Instruction ID: 86650de337cabd52e9a10aba828d5deadddead2a78688053c2a35af53b4d256e
Opcode Fuzzy Hash: 42a10b79d3f9fda6ddc0d73095d4407b23bd40248bb13a0798dbdedb6478cac0
Instruction Fuzzy Hash: EB21F7B1901248EFDB10DFA4EC88B9DBBF4FB09710F10812AF510AA2A1E7B545499F95

Function 0046708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00464706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,005252F8,?,004637AE,?), ref: 00464724

Part of subcall function 0048050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00467165), ref: 0048052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 004671A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0049E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0049E909
RegCloseKey.ADVAPI32(?), ref: 0049E947
_wcscat.LIBCMT ref: 0049E9A0

Strings

Software\AutoIt v3\AutoIt, xrefs: 0046719E
Include, xrefs: 0049E8BF, 0049E900
\Include\, xrefs: 00467165
\, xrefs: 0049E9C3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: db6d89f287c5519ac02869c0c31889e7d6bcb9f57d85d1ee11e246ec464f31b9
Instruction ID: fa33f83cd08c3a7d1bc4984abac99544833dcf4c6e802617ebe244505d7ef5e2
Opcode Fuzzy Hash: db6d89f287c5519ac02869c0c31889e7d6bcb9f57d85d1ee11e246ec464f31b9
Instruction Fuzzy Hash: 4E719F75108301DEC710EF26E8819ABBBE8FFA5314F40092FF445872A1EB79994DDB5A

Function 00463633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 004636D2
KillTimer.USER32(?,00000001), ref: 004636FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0046371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0046372A
CreatePopupMenu.USER32 ref: 0046373E
PostQuitMessage.USER32(00000000), ref: 0046374D

Strings

TaskbarCreated, xrefs: 00463725
%O, xrefs: 0049D081, 0049D0CF

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%O
API String ID: 129472671-2925486391
Opcode ID: eb2b8d4417a58334c81d7a4c070948f518e17c76e699704cbe0fdee6a20460f8
Instruction ID: f6770ddd22a3c56f7788f314465b57595e5f290032ac82690c793a90c1b07061
Opcode Fuzzy Hash: eb2b8d4417a58334c81d7a4c070948f518e17c76e699704cbe0fdee6a20460f8
Instruction Fuzzy Hash: CA41F9B1100585ABDF345F64EC49B7A3A94EF11302F14413BF502963E2FABC9D46966F

Function 00463A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00463A50
LoadCursorW.USER32(00000000,00007F00), ref: 00463A5F
LoadIconW.USER32(00000063), ref: 00463A76
LoadIconW.USER32(000000A4), ref: 00463A88
LoadIconW.USER32(000000A2), ref: 00463A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00463AC0
RegisterClassExW.USER32(?), ref: 00463B16

Part of subcall function 00463041: GetSysColorBrush.USER32(0000000F), ref: 00463074
Part of subcall function 00463041: RegisterClassExW.USER32(00000030), ref: 0046309E
Part of subcall function 00463041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 004630AF
Part of subcall function 00463041: InitCommonControlsEx.COMCTL32(?), ref: 004630CC
Part of subcall function 00463041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 004630DC
Part of subcall function 00463041: LoadIconW.USER32(000000A9), ref: 004630F2
Part of subcall function 00463041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00463101

Strings

AutoIt v3, xrefs: 00463B05
0, xrefs: 00463AF4
#, xrefs: 00463AFB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 227f446ce1e7de6faf422489c3ee816c21d65cf1df444808662df8431aea7b1c
Instruction ID: bb99bd6782cfb8406587dd8ed55de120c141c33179a6a0292b19ae7715680b09
Opcode Fuzzy Hash: 227f446ce1e7de6faf422489c3ee816c21d65cf1df444808662df8431aea7b1c
Instruction Fuzzy Hash: 1F214F75D00304EFEB20DFA4EC45BAD7BB0FB19712F00412AF500AA2E1E3B55559AF84

Function 00463766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00463892
CMDLINE, xrefs: 00463822
RR, xrefs: 0049D213
/AutoIt3ExecuteScript, xrefs: 004638BC
/AutoIt3ExecuteLine, xrefs: 004638A7
/ErrorStdOut, xrefs: 0046387D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 004637AE
CMDLINERAW, xrefs: 004637FB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$RR
API String ID: 1825951767-280563540
Opcode ID: 1a3ca2b23e0e6c561c0a9db26fd97173be5645fed9ec26339adf96c5d1fbea7e
Instruction ID: c08000b6eaa2a3765c22d92752d1444213bba06bfe6b976426a1057aa1b2b280
Opcode Fuzzy Hash: 1a3ca2b23e0e6c561c0a9db26fd97173be5645fed9ec26339adf96c5d1fbea7e
Instruction Fuzzy Hash: 1CA16DB19002599ACF04EFA1DC95AEEB778BF15318F00052FF415A7191FF786A09CB6A

Function 0046F76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00480162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00480193
Part of subcall function 00480162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0048019B
Part of subcall function 00480162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 004801A6
Part of subcall function 00480162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 004801B1
Part of subcall function 00480162: MapVirtualKeyW.USER32(00000011,00000000), ref: 004801B9
Part of subcall function 00480162: MapVirtualKeyW.USER32(00000012,00000000), ref: 004801C1

Part of subcall function 004760F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0046F930), ref: 00476154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0046F9CD
OleInitialize.OLE32(00000000), ref: 0046FA4A
CloseHandle.KERNEL32(00000000), ref: 004A45C8

Strings

SR, xrefs: 0046F7EB
\TR, xrefs: 0046F7F7
<WR, xrefs: 0046F930
%O, xrefs: 0046F796, 0046F7A8, 0046F96E, 0046FA51

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <WR$\TR$%O$SR
API String ID: 1986988660-2065387776
Opcode ID: e73ddc7ae4d8fd90c8c9d36f80bab0f374f6f96d223562e132493f8b44274779
Instruction ID: 8e7178a76050b892ddd94f1c13d4ee118233a9248d652813e76f3808cdb5c4f9
Opcode Fuzzy Hash: e73ddc7ae4d8fd90c8c9d36f80bab0f374f6f96d223562e132493f8b44274779
Instruction Fuzzy Hash: 4981D3B0901A40CFCBA4EF39A844628BBE5FF7A316794852ED008C7271F774158EAF95

Function 019B50E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 019B51B1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 019B53D7

Memory Dump Source

Source File: 00000000.00000002.2115632679.00000000019B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 019B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19b2000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
Instruction ID: 2e08ff45d9008d3f668e73e258cd95c4f09bbcc867514b6cffc7a471f8b80bc7
Opcode Fuzzy Hash: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
Instruction Fuzzy Hash: DBA10A70E01209EBEB14CFA4C994BEEBBB5BF48305F208559E605BB380D7759A41CF94

Function 004639D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00463A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00463A24
ShowWindow.USER32(00000000,?,?), ref: 00463A38
ShowWindow.USER32(00000000,?,?), ref: 00463A41

Strings

AutoIt v3, xrefs: 004639FB, 00463A00, 00463A01
edit, xrefs: 00463A1E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: fcf05c48611b08c8987d8368c41453e51ca3afe14e7b31b40fe10c45500642c2
Instruction ID: a446d35210c2bccb19523bf359a835d47b0f7e1ec8cc4b87e7dd62b023c2dfdd
Opcode Fuzzy Hash: fcf05c48611b08c8987d8368c41453e51ca3afe14e7b31b40fe10c45500642c2
Instruction Fuzzy Hash: 7FF05E74500290BEEA3057236C4CF3B3E7DDBD7F60F00412EB900A61B0D275084AEAB4

Function 019B4ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 019B4DC0: Sleep.KERNELBASE(000001F4), ref: 019B4DD1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 019B4FD2

Strings

G8K5WGFRGDVQXZV, xrefs: 019B5035, 019B5038

Memory Dump Source

Source File: 00000000.00000002.2115632679.00000000019B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 019B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19b2000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateFileSleep
String ID: G8K5WGFRGDVQXZV
API String ID: 2694422964-779384672
Opcode ID: 1e997db92d74760d467f5b1bf0fc1ef9103a16bb445ceb85fba5fcca5dd8ec73
Instruction ID: e0418cfc964716d0db6674e586d31ea2b628b9b1846eb22f5a1d0e990fcc1e00
Opcode Fuzzy Hash: 1e997db92d74760d467f5b1bf0fc1ef9103a16bb445ceb85fba5fcca5dd8ec73
Instruction Fuzzy Hash: F4517F30D04249DAEF11DBA4D948BEFBB78AF55300F0045A8E60DBB2C1D7791B44CBA5

Function 0046407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0049D3D7

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

_memset.LIBCMT ref: 004640FC
_wcscpy.LIBCMT ref: 00464150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00464160

Strings

Line: , xrefs: 0049D400

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 3bf2b333b118e9ef968a8721d7fc5c9f2951123530914413beea5c22f25f4401
Instruction ID: 3e42380e7f444e3df4c3a8781a1fcebe04856eb1c96fe573a66664627b850803
Opcode Fuzzy Hash: 3bf2b333b118e9ef968a8721d7fc5c9f2951123530914413beea5c22f25f4401
Instruction Fuzzy Hash: 4A31AE71008304AAD730EB61DC49BEB7BD8AF95318F10491FF585921E1FB78A649C79B

Function 0048541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0048547B
_memcpy_s.LIBCMT ref: 004854ED
__read_nolock.LIBCMT ref: 0048554B
__filbuf.LIBCMT ref: 0048556E
_memset.LIBCMT ref: 004855B2

Part of subcall function 00488B28: __getptd_noexit.LIBCMT ref: 00488B28

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 07abe14209dd225937689f368dba197b98e9807757d4d2309428ff000e556404
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 3251C630A00B05EBCB24AF69D84066F77B2AF40725F248F2FF825963D4D7789D918B49

Function 0046686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00464DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,005252F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00464E0F

_free.LIBCMT ref: 0049E263
_free.LIBCMT ref: 0049E2AA

Part of subcall function 00466A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00466BAD

Strings

Bad directive syntax error, xrefs: 0049E292
>>>AUTOIT SCRIPT<<<, xrefs: 0049E039

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 1d7db9bfb999d4497f5f42b1aaf1d2dd663547ae7b5521a5fe26968bc63ffc03
Instruction ID: 3969e73328f7d347db163a7620f7cb66a0792d053f1ff0289870b2e44ac018c9
Opcode Fuzzy Hash: 1d7db9bfb999d4497f5f42b1aaf1d2dd663547ae7b5521a5fe26968bc63ffc03
Instruction Fuzzy Hash: 04916071910219AFCF04EFA6CC419EEBBB4FF14318B10446FF815AB2A1EB799905CB59

Function 004635B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,004635A1,SwapMouseButtons,00000004,?), ref: 004635D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,004635A1,SwapMouseButtons,00000004,?,?,?,?,00462754), ref: 004635F5
RegCloseKey.KERNELBASE(00000000,?,?,004635A1,SwapMouseButtons,00000004,?,?,?,?,00462754), ref: 00463617

Strings

Control Panel\Mouse, xrefs: 004635D2

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: ecea770bfdaa7d2c7e814dd0f94a1b571b02000fbd1129c9d05368ef14f633d9
Instruction ID: 80c436725155f16245ee778f61b4ef95944c823f368955214ab9e54224ec0470
Opcode Fuzzy Hash: ecea770bfdaa7d2c7e814dd0f94a1b571b02000fbd1129c9d05368ef14f633d9
Instruction Fuzzy Hash: B7115A71510258BFDB20CF64DC80DAFB7B8EF05741F00456AF805DB210E2719F449769

Function 019B3DC0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 019B45ED
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 019B4611
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 019B4633

Memory Dump Source

Source File: 00000000.00000002.2115632679.00000000019B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 019B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19b2000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: fc310a6135c3389c0587bc6629e9838c2c50d5be0bfc8bfa2df8a04cac11b1e3
Instruction ID: d9e0bd3553a67171cd4cc0722de31e77b92d70b728584cdda7cfc051852d086f
Opcode Fuzzy Hash: fc310a6135c3389c0587bc6629e9838c2c50d5be0bfc8bfa2df8a04cac11b1e3
Instruction Fuzzy Hash: 87623C30A14258DBEB24CFA4C980BDEB376EF58701F1091A9D20DEB391E7759E81CB59

Function 004C955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00464EE5: _fseek.LIBCMT ref: 00464EFD

Part of subcall function 004C9734: _wcscmp.LIBCMT ref: 004C9824
Part of subcall function 004C9734: _wcscmp.LIBCMT ref: 004C9837

_free.LIBCMT ref: 004C96A2
_free.LIBCMT ref: 004C96A9
_free.LIBCMT ref: 004C9714

Part of subcall function 00482D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00489A24), ref: 00482D69
Part of subcall function 00482D55: GetLastError.KERNEL32(00000000,?,00489A24), ref: 00482D7B

_free.LIBCMT ref: 004C971C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 4a2872fe10592e1d84cc1262fcb1ccf713934ef89923d88bffb920594bd4d040
Instruction ID: 6d3c323f88ae81bbaefd37dc7295f557d0643dec1a47aef15ccbca5bf493b6e9
Opcode Fuzzy Hash: 4a2872fe10592e1d84cc1262fcb1ccf713934ef89923d88bffb920594bd4d040
Instruction Fuzzy Hash: 7B515CB5904219ABDF249F65CC85AAEBBB9EF48304F10449EF209A3241DB755E80CF5D

Function 0048470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004847A0
__flush.LIBCMT ref: 004847C0
__write.LIBCMT ref: 004847F3
__flsbuf.LIBCMT ref: 00484821

Part of subcall function 00488B28: __getptd_noexit.LIBCMT ref: 00488B28

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 788127206439222ee556ab6bdc5f5465c89aeabd9982a998e1b67470edf092fd
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 6E41B575A007479BDB18BF69C8809AF77A5AFC2364B24893FE81587740E778DD418B48

Function 004644A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004644CF

Part of subcall function 0046407C: _memset.LIBCMT ref: 004640FC
Part of subcall function 0046407C: _wcscpy.LIBCMT ref: 00464150
Part of subcall function 0046407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00464160

KillTimer.USER32(?,00000001,?,?), ref: 00464524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00464533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0049D4B9

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: a57d265b39548056b6cb00db5505af7da33310d3abaa45999a55e77e7d8b1147
Instruction ID: 8da2758ca24752fb60f610900dbcf6ed9c968522e0d6afc2deb96740b97865c4
Opcode Fuzzy Hash: a57d265b39548056b6cb00db5505af7da33310d3abaa45999a55e77e7d8b1147
Instruction Fuzzy Hash: 0021F874904794AFEB328B248845BE7BFEC9F51314F0400AFE78A56282D3782989C75A

Function 00464C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00464CBA

Strings

AU3!P/O, xrefs: 00464CB4
EA06, xrefs: 0049D8CC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/O$EA06
API String ID: 4104443479-2756084753
Opcode ID: 469c51b228473515e434aa68d118cffa8342fdf9da53176f92f74652b34d7775
Instruction ID: b11869240947657065005fd25fb0b4c6303ba80b22e48bf8196392864df2a4d3
Opcode Fuzzy Hash: 469c51b228473515e434aa68d118cffa8342fdf9da53176f92f74652b34d7775
Instruction Fuzzy Hash: 2B416C61E041585BDF219B54C8617BF7FA2DBC6304F28447BE9829B382F62C4D4583AB

Function 00467285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0049EA39
GetOpenFileNameW.COMDLG32(?), ref: 0049EA83

Part of subcall function 00464750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00464743,?,?,004637AE,?), ref: 00464770

Part of subcall function 00480791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004807B0

Strings

X, xrefs: 0049EA51

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 620d6360d3aa13391a0e80cfa8b41511d0451e9ec80c2d56d32afba16816898c
Instruction ID: 15aaeca7da54ec8869bbab4845a351bb61653b4910fe85dc256d3ec8e92877f4
Opcode Fuzzy Hash: 620d6360d3aa13391a0e80cfa8b41511d0451e9ec80c2d56d32afba16816898c
Instruction Fuzzy Hash: 5321C670A102589BDF51DF95C845BEE7FF8AF49718F00405BE408A7341DBF859898FA6

Function 004C8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004C8DAC
__fread_nolock.LIBCMT ref: 004C8DC1

Strings

EA06, xrefs: 004C8DF3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: fa9772ac6fb7f7c1bcbc8c497c45a05f070feacaaf7fd79577e7605d6b0aa5a7
Instruction ID: e213a0f7491ec45fe33183f6a22bd7ab0f5cda0afa44ae3efc3a519ecdbdb825
Opcode Fuzzy Hash: fa9772ac6fb7f7c1bcbc8c497c45a05f070feacaaf7fd79577e7605d6b0aa5a7
Instruction Fuzzy Hash: 8301F971C042187EDB68DAA9C816FFE7BF8DB11301F00459FF553D2181E878A6088760

Function 004C98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 004C98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 004C990F

Strings

aut, xrefs: 004C9909

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: afc22119e2fc3e9333e8cda7c74ce7f4dd341e59cdc8c6e9478771e901afbb22
Instruction ID: b19156f8e45d3192fd32c8e9fd7445162c15cfa4ca5b75a7768003a93882e098
Opcode Fuzzy Hash: afc22119e2fc3e9333e8cda7c74ce7f4dd341e59cdc8c6e9478771e901afbb22
Instruction Fuzzy Hash: 5AD05B7554030D7BDB509B94DC4DFD6773CE704700F0006F1BB5495091DA7155988B95

Function 004DCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabf48abf933bedadf6fe6a457516b15b89636bbe30bab8fadb4649ec4cd940d
Instruction ID: ad191325a7a8c275bf8f023c93f48280748a49b294da28569ca7a7d2e59f466c
Opcode Fuzzy Hash: eabf48abf933bedadf6fe6a457516b15b89636bbe30bab8fadb4649ec4cd940d
Instruction Fuzzy Hash: 35F128B16083019FCB14DF29C490A6ABBE5FF88318F14892EF8999B351D774E945CF86

Function 0046434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00464370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00464415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00464432

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 3812741c26f058c852feb9748f83d4920f5834f8dbad3ab574ab4ec35e5f7ec5
Instruction ID: 830baac21d24d567d9f383d9aa71f863f54fe8634a08a378de009d7eaaaa3860
Opcode Fuzzy Hash: 3812741c26f058c852feb9748f83d4920f5834f8dbad3ab574ab4ec35e5f7ec5
Instruction Fuzzy Hash: ED318171604701CFCB21DF24D88569BBBF8FF99319F00092EE59A86391F774A988CB56

Function 0048571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00485733

Part of subcall function 0048A16B: __NMSG_WRITE.LIBCMT ref: 0048A192
Part of subcall function 0048A16B: __NMSG_WRITE.LIBCMT ref: 0048A19C

__NMSG_WRITE.LIBCMT ref: 0048573A

Part of subcall function 0048A1C8: GetModuleFileNameW.KERNEL32(00000000,005233BA,00000104,?,00000001,00000000), ref: 0048A25A
Part of subcall function 0048A1C8: ___crtMessageBoxW.LIBCMT ref: 0048A308

Part of subcall function 0048309F: ___crtCorExitProcess.LIBCMT ref: 004830A5
Part of subcall function 0048309F: ExitProcess.KERNEL32 ref: 004830AE

Part of subcall function 00488B28: __getptd_noexit.LIBCMT ref: 00488B28

RtlAllocateHeap.NTDLL(01750000,00000000,00000001,00000000,?,?,?,00480DD3,?), ref: 0048575F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 8d2e102a3072f5d86076d1fd5c051111ceadba1876427ba01209284321e6117e
Instruction ID: 1565b056a4644469a0c27e2be2087e3580a3b373c10aac4c6ab53e9c7221c87b
Opcode Fuzzy Hash: 8d2e102a3072f5d86076d1fd5c051111ceadba1876427ba01209284321e6117e
Instruction Fuzzy Hash: 5F019235340A01DAE6213B36AC82A2E73489F92766F504D2FF9059A281DFBC9C41976D

Function 004C98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,004C9548,?,?,?,?,?,00000004), ref: 004C98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,004C9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 004C98D1
CloseHandle.KERNEL32(00000000,?,004C9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 004C98D8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 6531ffcaab349f09b4f22ccc3169661146cfc4886c9928716e1b97a6cf5ca92e
Instruction ID: e923bb43178b85614a184577f90ca7f7098891555fc76c9f9ac9ab32518233fe
Opcode Fuzzy Hash: 6531ffcaab349f09b4f22ccc3169661146cfc4886c9928716e1b97a6cf5ca92e
Instruction Fuzzy Hash: 84E08632140218B7D7212B54EC49FCA7B19AB06761F148130FB146D0E187B12915979C

Function 004C8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004C8D1B

Part of subcall function 00482D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00489A24), ref: 00482D69
Part of subcall function 00482D55: GetLastError.KERNEL32(00000000,?,00489A24), ref: 00482D7B

_free.LIBCMT ref: 004C8D2C
_free.LIBCMT ref: 004C8D3E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e572bb3280820806cd63a499e0b551fb9ad7511d2bd2374f1c7be07920dd6c79
Instruction ID: e6494129da0cf96fbe3f40cade1caa275fdd5e7c26c0ff795341c013d45ff74a
Opcode Fuzzy Hash: e572bb3280820806cd63a499e0b551fb9ad7511d2bd2374f1c7be07920dd6c79
Instruction Fuzzy Hash: 3FE012B1601A0246DB64B579AB40F9717EC4F983567140D1FB40ED7286CEACFC42832C

Function 0046A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0049FC01

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: f6070717ad5c7696e7f0157e04a9d0b8f1150e4e8e601447085cafefd9fd7be8
Instruction ID: 6de211c3ead2ea37dd43be2656da4b75e0d7f952b621516ef559f8fab85e36a8
Opcode Fuzzy Hash: f6070717ad5c7696e7f0157e04a9d0b8f1150e4e8e601447085cafefd9fd7be8
Instruction Fuzzy Hash: 5E224870508601DFDB24DF14C494A6ABBE1BF45308F14896EE88A9B361E739EC55CF8B

Function 00467A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00467AAB
_memmove.LIBCMT ref: 00467B16

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction ID: 8afbde4bb21420e5d84c67ee0914b3b2addf0765cbbab1205864bffbc4411254
Opcode Fuzzy Hash: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
Instruction Fuzzy Hash: 7731C4B1604606AFC704DF69C8D1D6AB3A9FF48318714862EE519CB391EB38E910CB95

Function 004647D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00464834

Part of subcall function 0048336C: __lock.LIBCMT ref: 00483372
Part of subcall function 0048336C: DecodePointer.KERNEL32(00000001,?,00464849,004B7C74), ref: 0048337E
Part of subcall function 0048336C: EncodePointer.KERNEL32(?,?,00464849,004B7C74), ref: 00483389

Part of subcall function 004648FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00464915
Part of subcall function 004648FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0046492A

Part of subcall function 00463B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00463B68
Part of subcall function 00463B3A: IsDebuggerPresent.KERNEL32 ref: 00463B7A
Part of subcall function 00463B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,005252F8,005252E0,?,?), ref: 00463BEB
Part of subcall function 00463B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00463C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00464874

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 3935725b0df5aab896f21b4ab94cbee942953586316526e18c65f7813b25d799
Instruction ID: e500bb2eaf80f113a143b9ac7e16f057fdad189594d58f43d731f00624a58a7d
Opcode Fuzzy Hash: 3935725b0df5aab896f21b4ab94cbee942953586316526e18c65f7813b25d799
Instruction Fuzzy Hash: 9311AE71804341DBCB10EF29DC4590ABBE8EF96754F10491FF440872B1EBB49A4ACB96

Function 00480DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0048571C: __FF_MSGBANNER.LIBCMT ref: 00485733
Part of subcall function 0048571C: __NMSG_WRITE.LIBCMT ref: 0048573A
Part of subcall function 0048571C: RtlAllocateHeap.NTDLL(01750000,00000000,00000001,00000000,?,?,?,00480DD3,?), ref: 0048575F

std::exception::exception.LIBCMT ref: 00480DEC
__CxxThrowException@8.LIBCMT ref: 00480E01

Part of subcall function 0048859B: RaiseException.KERNEL32(?,?,?,00519E78,00000000,?,?,?,?,00480E06,?,00519E78,?,00000001), ref: 004885F0

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 058f0dee94ac0888a8244cf81090edbcd4960c8352b1c7e41fd3c98c4e8b20ff
Instruction ID: 197556120df0fc1e2017cf18e6fdcf5aa5e6d3a8e58a2741622b842786ca7204
Opcode Fuzzy Hash: 058f0dee94ac0888a8244cf81090edbcd4960c8352b1c7e41fd3c98c4e8b20ff
Instruction Fuzzy Hash: 70F0A43150021E66DB11BAA5ED119EF7BAC9F01755F104C2FFD0496291EFB89A8483DD

Function 004855FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0048562C
__lock_file.LIBCMT ref: 0048564D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: f6e8f1975a215c2685f06db83bcd6126922c6f0166879431b00008f3a66ea995
Instruction ID: 519571b37ce275288e842fbe74f93481bf6c454cb4961ee7353e3515e7b354f2
Opcode Fuzzy Hash: f6e8f1975a215c2685f06db83bcd6126922c6f0166879431b00008f3a66ea995
Instruction Fuzzy Hash: 0501FC71800604EBCF12BF668C024DF7F61AF90325F80491FF41826251EB398651DF59

Function 004853A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00488B28: __getptd_noexit.LIBCMT ref: 00488B28

__lock_file.LIBCMT ref: 004853EB

Part of subcall function 00486C11: __lock.LIBCMT ref: 00486C34

__fclose_nolock.LIBCMT ref: 004853F6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: c8f193765952019d01a632663dcd942ac07e322e9b6bcfb0792a9985c3633b9b
Instruction ID: f0341947258810b07b1eac04f9ee4dc43eeeb75ee0fd348bf393873405e56869
Opcode Fuzzy Hash: c8f193765952019d01a632663dcd942ac07e322e9b6bcfb0792a9985c3633b9b
Instruction Fuzzy Hash: 9CF09671801A049AD7117B6698057AE66E06F41379F61890FE824AB1C1CBBC9A419B5A

Function 019B3DBD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 019B45ED
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 019B4611
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 019B4633

Memory Dump Source

Source File: 00000000.00000002.2115632679.00000000019B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 019B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19b2000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
Instruction ID: d724c87d96eeec857df72aecf846146a6029934d7986e6266525651500cf5b2a
Opcode Fuzzy Hash: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
Instruction Fuzzy Hash: DB12CD24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F81CF5A

Function 00480C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00480CB7

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 33c73c37ff59abb60a191e6ee20087866196bf8c514fd58bcef66c633cc98c59
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 4031E370A101059FC798EF08C49496EF7A6FB49300B248AA6E80ACB355D635EDC5DB89

Function 0049FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0049FCB7

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6fa219752516458a40c1aee2c77217ac9c76f68970037ab13e9287231b6d31e3
Instruction ID: b30321805d5dbec833c028c240b19fc552cff5d3707c07c2dcb1070985a754a3
Opcode Fuzzy Hash: 6fa219752516458a40c1aee2c77217ac9c76f68970037ab13e9287231b6d31e3
Instruction Fuzzy Hash: 394116746043419FDB14DF14C444B1ABBE1BF45318F0989ADE89A9B362D33AEC49CF5A

Function 00467B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00467BB3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 19ccf45a37f7b405452a079e82f884e30c806550328b14254436f43a4d7fd49d
Instruction ID: a3e9e8de670ba9604de236752f4c99e4bfd089447f2edb0b8d7f03646f3a7ea8
Opcode Fuzzy Hash: 19ccf45a37f7b405452a079e82f884e30c806550328b14254436f43a4d7fd49d
Instruction Fuzzy Hash: AA212772A04A08EBDF108F12E8416AA7FB4FB24758F20853FE486C5190EB7494D4D74E

Function 00464DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00464BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00464BEF

Part of subcall function 0048525B: __wfsopen.LIBCMT ref: 00485266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,005252F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00464E0F

Part of subcall function 00464B6A: FreeLibrary.KERNEL32(00000000), ref: 00464BA4

Part of subcall function 00464C70: _memmove.LIBCMT ref: 00464CBA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: b0013a5e1b56c9d9be6ec4d429cc264c3f7778ad92c81a43f44256b4e055bdbf
Instruction ID: 30458351c0c5fafb82f371b1fc79e3375a885991be72e2666ef3998c0ddd66ff
Opcode Fuzzy Hash: b0013a5e1b56c9d9be6ec4d429cc264c3f7778ad92c81a43f44256b4e055bdbf
Instruction Fuzzy Hash: 3611E731640305ABCF14FF71C816FAE77A4AF84B14F10882FF551A7181FE7A9A059B5A

Function 0049FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0049FD91

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 31eff0aaae29d86a4d81390ff840d6cb593018ed2d9c76d51bbbd150a24a4122
Instruction ID: e2dcb58f634145cea61ea9c37cad7ed2f8dec9af24182405873c90bd5644c793
Opcode Fuzzy Hash: 31eff0aaae29d86a4d81390ff840d6cb593018ed2d9c76d51bbbd150a24a4122
Instruction Fuzzy Hash: 3D21F2745083419FCB14DF24C444A1ABBE1BF88318F05896DE88A97762E739E819CB9B

Function 00484863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 004848A6

Part of subcall function 00488B28: __getptd_noexit.LIBCMT ref: 00488B28

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 3f593dc087b923fc88e28387d1bb582c72a1fa089d34f306a522dceebd5b5681
Instruction ID: b387456524cade0bfdcb42c6b4bcb85d9f8cf82141a1d77b5eea80e302259f55
Opcode Fuzzy Hash: 3f593dc087b923fc88e28387d1bb582c72a1fa089d34f306a522dceebd5b5681
Instruction Fuzzy Hash: 66F0F435800206ABDF12BFA18C0539E3AA0AF40328F014C0EF41096181CB7C8951DF49

Function 00464E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,005252F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00464E7E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 894c2e856ee8883e7aefe1b6abbd155374bcf2411c7e2a47c5e6ddd706483430
Instruction ID: 18b415570ef3a68ca8ac4429e3c51005d1ce1fca7845bf84cbbe162c0b09ef75
Opcode Fuzzy Hash: 894c2e856ee8883e7aefe1b6abbd155374bcf2411c7e2a47c5e6ddd706483430
Instruction Fuzzy Hash: C0F01571601B11CFCB349F64E494817BBE1BF943293208A3FE1D682621D73B9884DB4A

Function 00480791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 004807B0

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: d77526e91b6da1a6946384159d82b3756ba39276625f74004df11dd751dcc9a5
Instruction ID: 83b9871846034d6f3d3fe522afc20e53add739f2f93e299860398141c35a23f5
Opcode Fuzzy Hash: d77526e91b6da1a6946384159d82b3756ba39276625f74004df11dd751dcc9a5
Instruction Fuzzy Hash: 92E07D7290012817C720D2599C05FFA77DCDF887A4F0401F6FC0CC7204D964AC8086D4

Function 004C8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 004C8EC1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 0b98eba8c8608d2b4dcb89e16f6e997824f1d4d49ade5b0eec1f72ab153fb2ea
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: B5E092B0504B005BDB388A24D800BA373E1AB05304F00081EF2AAC3341EB667841C75D

Function 0048525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00485266

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 3453e02c6bd3c637671ca5ee1435d0261d51ee952e41fd684debf06eda4a0d7e
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 33B0927644020C77CE012A82EC02A493B199B41768F408061FB0C18162AA77A6649A89

Function 019B4DC0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 019B4DD1

Memory Dump Source

Source File: 00000000.00000002.2115632679.00000000019B2000.00000040.00000020.00020000.00000000.sdmp, Offset: 019B2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19b2000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 4397926fab4af15bdf7466387706e146f94d296a6400e5458be54cbb703b7c47
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 95E0E67498010EDFDB00EFF4D6496EE7FB4EF04701F100161FD05D2281D6309D509A62

Non-executed Functions

Function 004ECABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 004ECB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004ECB95
GetWindowLongW.USER32(?,000000F0), ref: 004ECBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004ECC00
SendMessageW.USER32 ref: 004ECC29
_wcsncpy.LIBCMT ref: 004ECC95
GetKeyState.USER32(00000011), ref: 004ECCB6
GetKeyState.USER32(00000009), ref: 004ECCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 004ECCD9
GetKeyState.USER32(00000010), ref: 004ECCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 004ECD0C
SendMessageW.USER32 ref: 004ECD33
SendMessageW.USER32(?,00001030,?,004EB348), ref: 004ECE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 004ECE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 004ECE60
SetCapture.USER32(?), ref: 004ECE69
ClientToScreen.USER32(?,?), ref: 004ECECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 004ECEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004ECEF5
ReleaseCapture.USER32 ref: 004ECF00
GetCursorPos.USER32(?), ref: 004ECF3A
ScreenToClient.USER32(?,?), ref: 004ECF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 004ECFA3
SendMessageW.USER32 ref: 004ECFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 004ED00E
SendMessageW.USER32 ref: 004ED03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 004ED05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 004ED06D
GetCursorPos.USER32(?), ref: 004ED08D
ScreenToClient.USER32(?,?), ref: 004ED09A
GetParent.USER32(?), ref: 004ED0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 004ED123
SendMessageW.USER32 ref: 004ED154
ClientToScreen.USER32(?,?), ref: 004ED1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 004ED1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 004ED20C
SendMessageW.USER32 ref: 004ED22F
ClientToScreen.USER32(?,?), ref: 004ED281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 004ED2B5

Part of subcall function 004625DB: GetWindowLongW.USER32(?,000000EB), ref: 004625EC

GetWindowLongW.USER32(?,000000F0), ref: 004ED351

Strings

pbR, xrefs: 004ECEAF
F, xrefs: 004ED235
@GUI_DRAGID, xrefs: 004ECE9C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pbR
API String ID: 3977979337-2265893649
Opcode ID: b3d35be1f48b5c433ebbd181e6c2ab9b0f1714377ff98da09ddaf0ab54a433e9
Instruction ID: 6562e8c7a0eab86b5ca1ec47c56e4c95d012c6d57ed632d57debca0b35d5af11
Opcode Fuzzy Hash: b3d35be1f48b5c433ebbd181e6c2ab9b0f1714377ff98da09ddaf0ab54a433e9
Instruction Fuzzy Hash: 1F42FE346042C0AFC724CF26D884AAABBE5FF49311F14092EF595CB3A1D735E846DB5A

Function 00476F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004771C3
_memset.LIBCMT ref: 00477539
_memmove.LIBCMT ref: 004776AC

Strings

_G, xrefs: 004B23CB
P\Q, xrefs: 004B1AB8
[:<:]], xrefs: 00477479
\b(?=\w), xrefs: 004B3769
\b(?<=\w), xrefs: 004B3773
DEFINE, xrefs: 004B2103
3cG, xrefs: 004B23A0
Q\E, xrefs: 00477FCB
[:>:]], xrefs: 00477492
]Q, xrefs: 004B1A22

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]Q$3cG$DEFINE$P\Q$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_G
API String ID: 1357608183-1836140888
Opcode ID: 71ab9b4927d8a25ebb383f3c71d54d697881681cf93c9cbaee9666c5f099ca09
Instruction ID: d906e4a2835a8ef5597c2b3dbcf988f47570a7623ae0414cc1377400f56cf2f7
Opcode Fuzzy Hash: 71ab9b4927d8a25ebb383f3c71d54d697881681cf93c9cbaee9666c5f099ca09
Instruction Fuzzy Hash: FC93A271E002159BDB24CF59C8817EEB7B1FF48310F64816BE949AB391E7789D82CB58

Function 004648D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 004648DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0049D665
IsIconic.USER32(?), ref: 0049D66E
ShowWindow.USER32(?,00000009), ref: 0049D67B
SetForegroundWindow.USER32(?), ref: 0049D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0049D69B
GetCurrentThreadId.KERNEL32 ref: 0049D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0049D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0049D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0049D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0049D6CF
SetForegroundWindow.USER32(?), ref: 0049D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0049D6E7
keybd_event.USER32(00000012,00000000), ref: 0049D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0049D6FC
keybd_event.USER32(00000012,00000000), ref: 0049D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0049D70A
keybd_event.USER32(00000012,00000000), ref: 0049D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0049D719
keybd_event.USER32(00000012,00000000), ref: 0049D71E
SetForegroundWindow.USER32(?), ref: 0049D721
AttachThreadInput.USER32(?,?,00000000), ref: 0049D748

Strings

Shell_TrayWnd, xrefs: 0049D660

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: a273a7fb870910822978af043f22100d6f5283c317bfed513314a2fb4c5c2153
Instruction ID: c871928373d0115cf3fadbe9855ca5fcf10e604834d38d704280abf5edd7e128
Opcode Fuzzy Hash: a273a7fb870910822978af043f22100d6f5283c317bfed513314a2fb4c5c2153
Instruction Fuzzy Hash: A1319571A40358BBEF202BA19C89F7F7E6CEB44B50F104036FA04EA1D2C6B55D01ABA5

Function 004B8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 004B87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 004B882B
Part of subcall function 004B87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 004B8858
Part of subcall function 004B87E1: GetLastError.KERNEL32 ref: 004B8865

_memset.LIBCMT ref: 004B8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 004B83A5
CloseHandle.KERNEL32(?), ref: 004B83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 004B83CD
GetProcessWindowStation.USER32 ref: 004B83E6
SetProcessWindowStation.USER32(00000000), ref: 004B83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 004B840A

Part of subcall function 004B81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004B8309), ref: 004B81E0
Part of subcall function 004B81CB: CloseHandle.KERNEL32(?,?,004B8309), ref: 004B81F2

Strings

winsta0, xrefs: 004B83C8
, xrefs: 004B8362
default, xrefs: 004B8405

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: b4de35ea6c03e1b569d570a52f8a9a7a0d1cff86dcea83c4e74f67a9e9fce35a
Instruction ID: ef0eb4221ce70bca903ce276b3c76d0be7f364abf2afb3d1b467b1437e5b262d
Opcode Fuzzy Hash: b4de35ea6c03e1b569d570a52f8a9a7a0d1cff86dcea83c4e74f67a9e9fce35a
Instruction Fuzzy Hash: 2F814871900249BFDF219FA9CC85AEE7BBDAF04304F14416EF910A6261DB399E15DB38

Function 004CC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004CC78D
FindClose.KERNEL32(00000000), ref: 004CC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004CC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 004CC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 004CC844
__swprintf.LIBCMT ref: 004CC890
__swprintf.LIBCMT ref: 004CC8D3

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

__swprintf.LIBCMT ref: 004CC927

Part of subcall function 00483698: __woutput_l.LIBCMT ref: 004836F1

__swprintf.LIBCMT ref: 004CC975

Part of subcall function 00483698: __flsbuf.LIBCMT ref: 00483713
Part of subcall function 00483698: __flsbuf.LIBCMT ref: 0048372B

__swprintf.LIBCMT ref: 004CC9C4
__swprintf.LIBCMT ref: 004CCA13
__swprintf.LIBCMT ref: 004CCA62

Strings

%4d, xrefs: 004CC8CD
%4d%02d%02d%02d%02d%02d, xrefs: 004CC88A
%02d, xrefs: 004CC91B, 004CC925, 004CC973, 004CC9C2, 004CCA11, 004CCA60

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 1d5aab7a078991c9ac87b801f54b7d36a9ae41d73d17e5db06fbc729e22ce78b
Instruction ID: ae76bd07993137e289a114e243d7273f54c82423ad56f9f5fef6325e252ae890
Opcode Fuzzy Hash: 1d5aab7a078991c9ac87b801f54b7d36a9ae41d73d17e5db06fbc729e22ce78b
Instruction Fuzzy Hash: B3A11BB1408244ABC750EFA5C885DAFB7ECFF94708F40092EF59586191FA79DA08CB67

Function 004CEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 004CEFB6
_wcscmp.LIBCMT ref: 004CEFCB
_wcscmp.LIBCMT ref: 004CEFE2
GetFileAttributesW.KERNEL32(?), ref: 004CEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 004CF00E
FindNextFileW.KERNEL32(00000000,?), ref: 004CF026
FindClose.KERNEL32(00000000), ref: 004CF031
FindFirstFileW.KERNEL32(*.*,?), ref: 004CF04D
_wcscmp.LIBCMT ref: 004CF074
_wcscmp.LIBCMT ref: 004CF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 004CF09D
SetCurrentDirectoryW.KERNEL32(00518920), ref: 004CF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 004CF0C5
FindClose.KERNEL32(00000000), ref: 004CF0D2
FindClose.KERNEL32(00000000), ref: 004CF0E4

Strings

*.*, xrefs: 004CF048

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 8211fd5e43ac617cc7e29c4822ecb7d2480521d199248f791162cc52a207f564
Instruction ID: f36b7cf00e5f852dd170f83b240b680390fa783d4abdf20be9c0217770cf26d0
Opcode Fuzzy Hash: 8211fd5e43ac617cc7e29c4822ecb7d2480521d199248f791162cc52a207f564
Instruction Fuzzy Hash: C03107365002587ADB149FA1DC48FEF77AD9F44720F1041BBE800D2192DB79DA48CB59

Function 004766E1 Relevance: 27.1, Strings: 21, Instructions: 889COMMON

Download Yara Rule

Strings

UTF16), xrefs: 004B10CF
NO_START_OPT), xrefs: 004B114F
ANYCRLF), xrefs: 004B12FB
0DP, xrefs: 00476733
BSR_ANYCRLF), xrefs: 004B131E
LF), xrefs: 004B12A4
3cG, xrefs: 004768FF
CR), xrefs: 004B1287
pGP, xrefs: 00476751
0FP, xrefs: 00476747
_G, xrefs: 004B1465, 004B150C, 004B15B4
-es, xrefs: 004B130F, 004B13B6
LIMIT_MATCH=, xrefs: 004B1170
CRLF), xrefs: 004B12C1
LIMIT_RECURSION=, xrefs: 004B11FC
BSR_UNICODE), xrefs: 004B1338
ANY), xrefs: 004B12DE
0EP, xrefs: 0047673D
UCP), xrefs: 004B110D
NO_AUTO_POSSESS), xrefs: 004B112E
UTF), xrefs: 004B10FA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID: -es$0DP$0EP$0FP$3cG$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pGP$_G
API String ID: 0-689884291
Opcode ID: d9c9283a022f88ee7275eec3426e0b067aa1f89afdde4bbcc916731510304afe
Instruction ID: f8df622d13a26d03605d54e01d068e89896ba4ac8447e4f75127f11dc5d684ca
Opcode Fuzzy Hash: d9c9283a022f88ee7275eec3426e0b067aa1f89afdde4bbcc916731510304afe
Instruction Fuzzy Hash: 73725E71E006199BDB24CF59C8907EEB7B5FF48310F55816BE809EB290E7389D81CBA5

Function 004E0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004E0953
RegCreateKeyExW.ADVAPI32(?,?,00000000,004EF910,00000000,?,00000000,?,?), ref: 004E09C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 004E0A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 004E0A92
RegCloseKey.ADVAPI32(?), ref: 004E0DB2
RegCloseKey.ADVAPI32(00000000), ref: 004E0DBF

Strings

REG_MULTI_SZ, xrefs: 004E0B7A
REG_DWORD, xrefs: 004E0C83
REG_BINARY, xrefs: 004E0D4D
REG_SZ, xrefs: 004E0AD0
REG_QWORD, xrefs: 004E0D00
REG_EXPAND_SZ, xrefs: 004E0A2F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 5fcd9cbfdd83c583c51512cc2e4e07806cf73a4848988762450089bb873e965e
Instruction ID: 9bdc63592bfd1737de66549b9781c7f702ad680ab7a0e3da776bc07793545e96
Opcode Fuzzy Hash: 5fcd9cbfdd83c583c51512cc2e4e07806cf73a4848988762450089bb873e965e
Instruction Fuzzy Hash: 590290756006419FCB14EF16C880E2AB7E5FF89314F04885EF8999B362DB78EC45CB4A

Function 004CF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 004CF113
_wcscmp.LIBCMT ref: 004CF128
_wcscmp.LIBCMT ref: 004CF13F

Part of subcall function 004C4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 004C43A0

FindNextFileW.KERNEL32(00000000,?), ref: 004CF16E
FindClose.KERNEL32(00000000), ref: 004CF179
FindFirstFileW.KERNEL32(*.*,?), ref: 004CF195
_wcscmp.LIBCMT ref: 004CF1BC
_wcscmp.LIBCMT ref: 004CF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 004CF1E5
SetCurrentDirectoryW.KERNEL32(00518920), ref: 004CF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 004CF20D
FindClose.KERNEL32(00000000), ref: 004CF21A
FindClose.KERNEL32(00000000), ref: 004CF22C

Strings

*.*, xrefs: 004CF190

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 9c76169d91dfbc63da0ca98381021536e99ff232b55c56219fc2c680ff664c0b
Instruction ID: 1438abc1574dd08bf285f606a79597c236d8aab6560da84c038becc124ed50cf
Opcode Fuzzy Hash: 9c76169d91dfbc63da0ca98381021536e99ff232b55c56219fc2c680ff664c0b
Instruction Fuzzy Hash: E031F73A5002597ADB20AFA0EC54FEF776D9F45324F1401BBE800A2191DB39DE49CA5C

Function 004CA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 004CA20F
__swprintf.LIBCMT ref: 004CA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 004CA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 004CA293
_memset.LIBCMT ref: 004CA2B2
_wcsncpy.LIBCMT ref: 004CA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 004CA323
CloseHandle.KERNEL32(00000000), ref: 004CA32E
RemoveDirectoryW.KERNEL32(?), ref: 004CA337
CloseHandle.KERNEL32(00000000), ref: 004CA341

Strings

\, xrefs: 004CA247
\??\%s, xrefs: 004CA22B
:, xrefs: 004CA252

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 853985590fe2a733816a5620e029d03f08f978e95e4f8a3b9a49d9280b1fc35c
Instruction ID: 72ceba797cf189f4e03f7a0be73e661f83f58cb1d28121288ff145d8f8298ce5
Opcode Fuzzy Hash: 853985590fe2a733816a5620e029d03f08f978e95e4f8a3b9a49d9280b1fc35c
Instruction Fuzzy Hash: 2831E875900159ABDB21DFA0DC85FEF37BCEF88704F1040BAF908D6161E77496548B29

Function 004C001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 004C0097
SetKeyboardState.USER32(?), ref: 004C0102
GetAsyncKeyState.USER32(000000A0), ref: 004C0122
GetKeyState.USER32(000000A0), ref: 004C0139
GetAsyncKeyState.USER32(000000A1), ref: 004C0168
GetKeyState.USER32(000000A1), ref: 004C0179
GetAsyncKeyState.USER32(00000011), ref: 004C01A5
GetKeyState.USER32(00000011), ref: 004C01B3
GetAsyncKeyState.USER32(00000012), ref: 004C01DC
GetKeyState.USER32(00000012), ref: 004C01EA
GetAsyncKeyState.USER32(0000005B), ref: 004C0213
GetKeyState.USER32(0000005B), ref: 004C0221

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 0e7e6bbd9e4d15a644a9b7d57304a449171cede95d84cdb832c1819badac509c
Instruction ID: 81721ab20c6f965c90a754c9382f6f55232c9fcf72e3b465f4eb129cbc443bb2
Opcode Fuzzy Hash: 0e7e6bbd9e4d15a644a9b7d57304a449171cede95d84cdb832c1819badac509c
Instruction Fuzzy Hash: 6251FD289047C8A9FB75DBA18854FABBFB49F01380F08459F89C1562C3DA5C9B8CC769

Function 004E03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004E0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DFDAD,?,?), ref: 004E0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004E04AC

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 004E054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 004E05E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 004E0822
RegCloseKey.ADVAPI32(00000000), ref: 004E082F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 63cdbdc3254ffb5489adbe4138bf166ecb71bc2519c7733522cc2ff29bd3188c
Instruction ID: 7186d2b93791c4a9562ec4abf4e2ae01f158bbdb0d2ff181d936e496cdd857a6
Opcode Fuzzy Hash: 63cdbdc3254ffb5489adbe4138bf166ecb71bc2519c7733522cc2ff29bd3188c
Instruction Fuzzy Hash: 77E18F70204240AFCB14DF66C881E2BBBE8FF89314F04856EF45ADB262D674ED45CB96

Function 004D4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004D418B
EmptyClipboard.USER32 ref: 004D4191
GlobalAlloc.KERNEL32(00000002,?), ref: 004D41A6
CloseClipboard.USER32 ref: 004D4245

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 4ff42f670240e665051bd86077a1692baa841e14e25a54aff03db1029d0298ba
Instruction ID: a91fc3f1cb814ce807e616dfdeabdb91cc20587d23033e6c744b37177b72ad25
Opcode Fuzzy Hash: 4ff42f670240e665051bd86077a1692baa841e14e25a54aff03db1029d0298ba
Instruction Fuzzy Hash: 8021B1752002109FDB10AF60EC59B6E7BA8EF55350F00806BF9459B3A2EB78AD06CB5D

Function 004C37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00464750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00464743,?,?,004637AE,?), ref: 00464770

Part of subcall function 004C4A31: GetFileAttributesW.KERNEL32(?,004C370B), ref: 004C4A32

FindFirstFileW.KERNEL32(?,?), ref: 004C38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 004C394B
MoveFileW.KERNEL32(?,?), ref: 004C395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 004C397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 004C399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 004C39B9

Strings

\*.*, xrefs: 004C384E, 004C3857, 004C386C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 20cfab8bf22f4e0984250ab3c2674a8c6b5c920ae94a74f74f4fef6828ddc79f
Instruction ID: 90bb123f2974738974f8ff72f2cb228fe8e5d0d9d162c545f31bc7d0708d8db1
Opcode Fuzzy Hash: 20cfab8bf22f4e0984250ab3c2674a8c6b5c920ae94a74f74f4fef6828ddc79f
Instruction Fuzzy Hash: EA51917580414C9ACF05EFA1D992EEDB778AF10309F60406EE40276192EF396F0DCB6A

Function 004CF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 004CF440
Sleep.KERNEL32(0000000A), ref: 004CF470
_wcscmp.LIBCMT ref: 004CF484
_wcscmp.LIBCMT ref: 004CF49F
FindNextFileW.KERNEL32(?,?), ref: 004CF53D
FindClose.KERNEL32(00000000), ref: 004CF553

Strings

*.*, xrefs: 004CF425

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 6126a0e8a3830e780fc179dcb53c522f57396c2bf38e217de97a2ad9fb4e49f1
Instruction ID: 2542e17b2b51a0fce8b55f6b04bd3765f7a12f7d45ee57c36f8c1f8f7c593ca0
Opcode Fuzzy Hash: 6126a0e8a3830e780fc179dcb53c522f57396c2bf38e217de97a2ad9fb4e49f1
Instruction Fuzzy Hash: A4418D75800219AFCF54DF64CC45FEEBBB5FF04314F10446BE815A6291EB38AA49CB59

Function 00473030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_G, xrefs: 00473322
3cG, xrefs: 00473225

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3cG$_G
API String ID: 674341424-1170781471
Opcode ID: d9dd1dc7041d0301c1728050a11e2cb45557182c8ae6eec2c1155ca13939a6d4
Instruction ID: 6ff9bfaf7a1e65ff2b430d3795fe5ab1c090da22cdcbd7dd61a06b70f0e6a923
Opcode Fuzzy Hash: d9dd1dc7041d0301c1728050a11e2cb45557182c8ae6eec2c1155ca13939a6d4
Instruction Fuzzy Hash: 7222AD716083009FC724DF14C881BAFB7E4AF95314F04891EF89A97291EB79E905CB9B

Function 00475760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004758A5
_memmove.LIBCMT ref: 004758F5
_memmove.LIBCMT ref: 0047595B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d473d7533d7b27cabe3126bea2e23770c0f0417f3049e0b05a809a62e60ff1ba
Instruction ID: ef76b92e1727efd7e958565a837922de3f6349a970dff0fbe91fdfbe8335ffef
Opcode Fuzzy Hash: d473d7533d7b27cabe3126bea2e23770c0f0417f3049e0b05a809a62e60ff1ba
Instruction Fuzzy Hash: C612AEB0A00609DFDF14DFA5D981AEEB3F5FF48304F10852AE409A7250EB79AD15CB69

Function 004C3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00464750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00464743,?,?,004637AE,?), ref: 00464770

Part of subcall function 004C4A31: GetFileAttributesW.KERNEL32(?,004C370B), ref: 004C4A32

FindFirstFileW.KERNEL32(?,?), ref: 004C3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 004C3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 004C3BEA
FindClose.KERNEL32(00000000), ref: 004C3C01
FindClose.KERNEL32(00000000), ref: 004C3C0A

Strings

\*.*, xrefs: 004C3B5B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 889a6c6043ec62fab1ceba6601fdd85dcf704244127d5710bf43c92223d3787d
Instruction ID: d64410e955eaac847143391e1341d1486af7718378466d3d2e5f316b0643707e
Opcode Fuzzy Hash: 889a6c6043ec62fab1ceba6601fdd85dcf704244127d5710bf43c92223d3787d
Instruction Fuzzy Hash: B43174350083859BC301EF64C891DAFB7A8AE91319F444D2EF4D596192FB29DA0DCB5B

Function 004C51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 004B87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 004B882B
Part of subcall function 004B87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 004B8858
Part of subcall function 004B87E1: GetLastError.KERNEL32 ref: 004B8865

ExitWindowsEx.USER32(?,00000000), ref: 004C51F9

Strings

SeShutdownPrivilege, xrefs: 004C51C9
, xrefs: 004C51E7
@, xrefs: 004C51EC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 37c884940cf079ee705efac641a57159400f0e5e634b1e761bfcd9f772663144
Instruction ID: 8461dc1ae14fa57afe33deb760ca701f4fa9a70ffb7b2b7b60fe1ef70c30bb00
Opcode Fuzzy Hash: 37c884940cf079ee705efac641a57159400f0e5e634b1e761bfcd9f772663144
Instruction Fuzzy Hash: 76014C396916012BF7A82268AC8AFBF72DCD704350F1008BFF903D61C2D9593C818D9D

Function 004D6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 004D62DC
WSAGetLastError.WSOCK32(00000000), ref: 004D62EB
bind.WSOCK32(00000000,?,00000010), ref: 004D6307
listen.WSOCK32(00000000,00000005), ref: 004D6316
WSAGetLastError.WSOCK32(00000000), ref: 004D6330
closesocket.WSOCK32(00000000,00000000), ref: 004D6344

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 97b78843235bbd0557d8cb9b8dd1a5850cd7ebd351dc23f8963b4e086b8da2ba
Instruction ID: e79f53d9cd2a8d2deee9c1ee6066353e3c8ca478ac34f82853a26ee80da4bf4c
Opcode Fuzzy Hash: 97b78843235bbd0557d8cb9b8dd1a5850cd7ebd351dc23f8963b4e086b8da2ba
Instruction Fuzzy Hash: 4021E4716002009FCB10EF64C895B6EB7A9EF48724F15816FFC16AB392D778AD05CB69

Function 00475520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00480DB6: std::exception::exception.LIBCMT ref: 00480DEC
Part of subcall function 00480DB6: __CxxThrowException@8.LIBCMT ref: 00480E01

_memmove.LIBCMT ref: 004B0258
_memmove.LIBCMT ref: 004B036D
_memmove.LIBCMT ref: 004B0414

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 5f4dcd029d36f97efe53caf4ff4b24e933c3b03833bbd7f2f92f52889eb326c4
Instruction ID: 0de1468d5e425d16124fb903b84c926a5a1b3ea17930cd9aa88ca3bdf6274a50
Opcode Fuzzy Hash: 5f4dcd029d36f97efe53caf4ff4b24e933c3b03833bbd7f2f92f52889eb326c4
Instruction Fuzzy Hash: A602D0B0A00209DBCF04DF65D981AAE7BF5EF44304F14846EE80ADB351EB79D915CBA9

Function 00461287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

DefDlgProcW.USER32(?,?,?,?,?), ref: 004619FA
GetSysColor.USER32(0000000F), ref: 00461A4E
SetBkColor.GDI32(?,00000000), ref: 00461A61

Part of subcall function 00461290: DefDlgProcW.USER32(?,00000020,?), ref: 004612D8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 7b315d027a3dededba39727fc0b9df76f185c34da2b5ca66756cb1602ccedd16
Instruction ID: 82b38b548890e4c2312026330f87affa780ee11ad9c404672efffd9c1ef79c70
Opcode Fuzzy Hash: 7b315d027a3dededba39727fc0b9df76f185c34da2b5ca66756cb1602ccedd16
Instruction Fuzzy Hash: 90A13DB1111594BEDA24AB6A9D44D7F295CDF4234BB1C012FF502D52B2FA2C9D02D2BF

Function 004D6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004D7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 004D7DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 004D679E
WSAGetLastError.WSOCK32(00000000), ref: 004D67C7
bind.WSOCK32(00000000,?,00000010), ref: 004D6800
WSAGetLastError.WSOCK32(00000000), ref: 004D680D
closesocket.WSOCK32(00000000,00000000), ref: 004D6821

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 7b30354e68d1c3561ec92643fe0bf2d6a80050d0efa59dfe7673c916c9f91e92
Instruction ID: 2aa6493221e7b59ea2df5b1bc8c5cf80cbabf1bb1e14e0715c4e36fc6698dff1
Opcode Fuzzy Hash: 7b30354e68d1c3561ec92643fe0bf2d6a80050d0efa59dfe7673c916c9f91e92
Instruction Fuzzy Hash: 7541E775600210AFDB10BF658C86F6E77E8DF05718F04856EF915AB3C3DA789D0087AA

Function 004E5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 004E53C5
IsWindowEnabled.USER32 ref: 004E53D3
GetForegroundWindow.USER32(?,?,00000001), ref: 004E53E0
IsIconic.USER32 ref: 004E53EE
IsZoomed.USER32 ref: 004E53FC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c5ae612b32128967eea5507c487ba3cbe136f952926cf5d80606aa2f23ebe419
Instruction ID: 2fedb0e0a5a44a60bc62bab826834ae2bb55a85a4b4dc20c6988000331192b81
Opcode Fuzzy Hash: c5ae612b32128967eea5507c487ba3cbe136f952926cf5d80606aa2f23ebe419
Instruction Fuzzy Hash: C211E6713005506BDB206F279C84A6B7B98EF443A6B00443AF845D7242DBB89C028AAD

Function 004B80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 004B80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 004B80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 004B80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 004B80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 004B80F6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: dba756f4cc5bf7414aa7526cd404043e8522cfa1d6abcb1aadd42dd64c523cea
Instruction ID: 1574f16a42579d3f674832218807407265cd146c1a720032dd8b859d2efcd283
Opcode Fuzzy Hash: dba756f4cc5bf7414aa7526cd404043e8522cfa1d6abcb1aadd42dd64c523cea
Instruction Fuzzy Hash: 80F0C230201214AFEB104FB8ECCCEA73BACEF8A754B00003AF905CA291CB609D05DA78

Function 004CC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004CC432
CoCreateInstance.OLE32(004F2D6C,00000000,00000001,004F2BDC,?), ref: 004CC44A

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

CoUninitialize.OLE32 ref: 004CC6B7

Strings

.lnk, xrefs: 004CC3C6, 004CC3EE, 004CC3F8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 3e633f5d4dae46bdae3e4a6a843d137f2e13bde119bd2059b943c30f63033f63
Instruction ID: b7f1ad0051f81456ecc9e545f2fe762900d8f1e3da6da4fbdcc5ff9138929989
Opcode Fuzzy Hash: 3e633f5d4dae46bdae3e4a6a843d137f2e13bde119bd2059b943c30f63033f63
Instruction Fuzzy Hash: AEA14AB1104205AFD700EF55C891EABB7ECEF94358F00492EF1958B192EB75EE09CB56

Function 00464B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00464AD0), ref: 00464B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00464B57

Strings

kernel32.dll, xrefs: 00464B40
GetNativeSystemInfo, xrefs: 00464B51

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 65afdbd3538ad9d25f1b0b0bb2112d775baf46cf21b73b67cbd0eab769988d2b
Instruction ID: cdff702d90964d7f596b989bc578db94c760f18cfdb3931ea04d808097fdde2b
Opcode Fuzzy Hash: 65afdbd3538ad9d25f1b0b0bb2112d775baf46cf21b73b67cbd0eab769988d2b
Instruction Fuzzy Hash: 44D01234E10757CFDB209F32D858B06B6D4AF85751B21C83F9485DA650E678F884C65D

Function 004DEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004DEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 004DEE4B

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Process32NextW.KERNEL32(00000000,?), ref: 004DEF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 004DEF1A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 3cb20bc50f72ff09cd6b010d033af6e50c5d96abdfac8644e89dd48ac4c4dd8b
Instruction ID: 303e09373a350da1e53c7204c271bdd5591799d98eea2f3dccac7a6fb322720f
Opcode Fuzzy Hash: 3cb20bc50f72ff09cd6b010d033af6e50c5d96abdfac8644e89dd48ac4c4dd8b
Instruction Fuzzy Hash: 3251AFB1508301AFD310EF21CC85E6BB7E8EF94718F40482EF595972A1EB74AD08CB96

Function 004BE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 004BE628

Strings

|, xrefs: 004BE658
(, xrefs: 004BE66E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 607c71c0d911b85ecd797cf61db0c48ad0a91b47e32ec335a4a4d9a9c7ada9ee
Instruction ID: 2941843bec20a87fb60e46892b5b2982617374ca0554c72746b0beb21738d23c
Opcode Fuzzy Hash: 607c71c0d911b85ecd797cf61db0c48ad0a91b47e32ec335a4a4d9a9c7ada9ee
Instruction Fuzzy Hash: 4D323675A007059FD728CF2AC4819AAB7F0FF88310B15C56EE89ADB3A1DB74E941CB54

Function 004D22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,004D180A,00000000), ref: 004D23E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 004D2418

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: d6f3ca72079cc0094e881d611c95315a282525b806499b6fe8bd06fe8d7c9abb
Instruction ID: 53c22c5d929742595ccc0215f2ded7df898ad13c74b815dd87af834727b374b8
Opcode Fuzzy Hash: d6f3ca72079cc0094e881d611c95315a282525b806499b6fe8bd06fe8d7c9abb
Instruction Fuzzy Hash: 5A410771504209BFEB20DEA5DE91EBF77ACEB50314F10402FFA00A6341DAF89E419658

Function 004CB333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004CB343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 004CB39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 004CB3EA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 38d31354e5541f85b1f6a2ca08c4ff971317e4b0d37ef36d0cd02829862539a9
Instruction ID: 221eaad913d183cc6d816535aff987383f8d5182fb122f3154ee574ccff0de22
Opcode Fuzzy Hash: 38d31354e5541f85b1f6a2ca08c4ff971317e4b0d37ef36d0cd02829862539a9
Instruction Fuzzy Hash: BE217C75A00508EFCB00EFA5D881AEDBBB8FF49314F1480AEE905AB361DB359919CB55

Function 004B87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00480DB6: std::exception::exception.LIBCMT ref: 00480DEC
Part of subcall function 00480DB6: __CxxThrowException@8.LIBCMT ref: 00480E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 004B882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 004B8858
GetLastError.KERNEL32 ref: 004B8865

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 2db0e84eb14ddbb1f0bd33a2fad52deebd7951a388c9a9a81a2df62bf7de6111
Instruction ID: ac7526cb11d51c4a29cacf4053aa554d41c7b1bf08c08193f8f5921dcd2982d3
Opcode Fuzzy Hash: 2db0e84eb14ddbb1f0bd33a2fad52deebd7951a388c9a9a81a2df62bf7de6111
Instruction Fuzzy Hash: 0D11BCB2814204AFE718EFA4DC85D6BB7FDEB44310B20852EF45687212EB34BC04CB68

Function 004B874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004B8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 004B878B
FreeSid.ADVAPI32(?), ref: 004B879B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5f74f4b8082796be6b3a83536a9d73ee02dddd9a09d5b363379d12a3173cf2c7
Instruction ID: 3773144be0128212895637a64543b20454c2ad617f7763fbd1c03ed80846bf6d
Opcode Fuzzy Hash: 5f74f4b8082796be6b3a83536a9d73ee02dddd9a09d5b363379d12a3173cf2c7
Instruction Fuzzy Hash: 79F04F75D1130CBFDF00DFF4DC89AAEB7BCEF08211F104479A501E6182D6756A088B54

Function 004C8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 004C889B

Part of subcall function 0048520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,004C8F6E,00000000,?,?,?,?,004C911F,00000000,?), ref: 00485213
Part of subcall function 0048520A: __aulldiv.LIBCMT ref: 00485233

Strings

0eR, xrefs: 004C8892

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0eR
API String ID: 2893107130-1187353528
Opcode ID: 4bf935f4fa453206e4ad9d1f0dd5c698bcb89275f9de103964a9b19ab9e6e9d7
Instruction ID: 46e39e06204d023d5711b6745124ac4e2117a9db022ccb6b24005041245d78cf
Opcode Fuzzy Hash: 4bf935f4fa453206e4ad9d1f0dd5c698bcb89275f9de103964a9b19ab9e6e9d7
Instruction Fuzzy Hash: 0F21B4366355108BC729CF25D841B52B3E1EFA5311B688E6DD0F5CB2C0CA38B905DB54

Function 004CC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 004CC6FB
FindClose.KERNEL32(00000000), ref: 004CC72B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 23871dabd55b883480218a5cc7893b0921f6028e57a0fce9d5583e2885b0baff
Instruction ID: d2d7fb118f6ee31d2d47e392ea825c26224462e5d992ded580863be4fae661e2
Opcode Fuzzy Hash: 23871dabd55b883480218a5cc7893b0921f6028e57a0fce9d5583e2885b0baff
Instruction Fuzzy Hash: 4811A1766102009FDB10EF29D885A2AF7E8FF85324F00851EF9A9CB291DB74AC05CF85

Function 004CA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,004D9468,?,004EFB84,?), ref: 004CA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,004D9468,?,004EFB84,?), ref: 004CA0A9

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 4cec0cde55a4e98621996bae2dfe0c0908bdb1181566b6c23b306bc01e81cf0d
Instruction ID: 09e6063b60919243a674626d2e74448d3a7e82b8e1a82f94fc149c8d209522be
Opcode Fuzzy Hash: 4cec0cde55a4e98621996bae2dfe0c0908bdb1181566b6c23b306bc01e81cf0d
Instruction Fuzzy Hash: 97F0E23510422DABDB209FA5CC88FEA776CFF08361F00417AF908D6181D6309904CBA6

Function 004B81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,004B8309), ref: 004B81E0
CloseHandle.KERNEL32(?,?,004B8309), ref: 004B81F2

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: ce3a7ce8e7a51f5c823bdfbd6b7f1b54f41653a356fccbddd01ed73629fecfb1
Instruction ID: 0fe1005575465da68a42542ec0b52d640d1b51b414c7ee8ff67a78c9092c823f
Opcode Fuzzy Hash: ce3a7ce8e7a51f5c823bdfbd6b7f1b54f41653a356fccbddd01ed73629fecfb1
Instruction Fuzzy Hash: 9EE08C32011610AFE7212B21EC08D777BEEEF003147108C3EF8A684471CB22AC94DB18

Function 0048A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00488D57,?,?,?,00000001), ref: 0048A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0048A163

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 55e908badd7c02d3a5cebcd6a439fc959496d811faf5d06d8bfdc0bb005b536f
Instruction ID: 69cc497cc70884dbe63835d5b42619d2e2460279b98d61232b1b907326d7a2e8
Opcode Fuzzy Hash: 55e908badd7c02d3a5cebcd6a439fc959496d811faf5d06d8bfdc0bb005b536f
Instruction Fuzzy Hash: B1B09231054248ABCA002B91EC49B883F68EB44AA2F404030FA0D88C66CB6255548A99

Function 0048F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1eb75bb591dd2d49fd8217e8e28569b6aaa6dd41d0658f4d02341d47575b3d2
Instruction ID: e4c546acac9ded85e84fee0d0ae8e37eab5fe26506418303d9a2f71d9a9a7fd1
Opcode Fuzzy Hash: f1eb75bb591dd2d49fd8217e8e28569b6aaa6dd41d0658f4d02341d47575b3d2
Instruction Fuzzy Hash: 03322961D29F014DD723A634D83233A6249AFB73C8F15DB37F819B5AA5EB2CD4938204

Function 0049242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cff946c68b4f1e1d74f0e83646eb5456c1abf10e1b54f6817e394437bcd7696
Instruction ID: 5e46eec163cd90dabd2bed2f256e189790f77264a85d51e0df50b6b5453542d3
Opcode Fuzzy Hash: 6cff946c68b4f1e1d74f0e83646eb5456c1abf10e1b54f6817e394437bcd7696
Instruction Fuzzy Hash: 55B1F260D2AF414DD72396398831336BB5CAFBB2C5F51D72BFC1A74D22EB2185A38145

Function 004C4C53 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 004C4C76

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 499fddd6b6c31e6bdbbd00f445cbb61e5c72e10924e52522a6fecc686e03de13
Instruction ID: 07aedc916a3fa6b34de7c9d3b5096a17552ab83263ad46bdef455de46c462e0f
Opcode Fuzzy Hash: 499fddd6b6c31e6bdbbd00f445cbb61e5c72e10924e52522a6fecc686e03de13
Instruction Fuzzy Hash: 4BD05EAC12220838ECE807208FBFFFB1109E3C0781F86814F7241892E1E8DC6C01A03D

Function 004B87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,004B8389), ref: 004B87D1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 4a2aa67270783bf0cdcfd8f232ad9100fdb8dc5446c65927db5c16150a016ea4
Instruction ID: 04ac73d16242db4295f5a685f4790f845751ef5e976a60517e70538d5209b3e0
Opcode Fuzzy Hash: 4a2aa67270783bf0cdcfd8f232ad9100fdb8dc5446c65927db5c16150a016ea4
Instruction Fuzzy Hash: 6FD05E3226050EABEF018EA4DC01EAE3B69EB04B01F408121FE15C50A1C775E835AB60

Function 0048A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0048A12A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1eb099bbeba89eb9d8c4df0d287f060314658f1b5814069e821bf15df0e2af54
Instruction ID: dc03f6331b18798c6b05bae5acd95e91403a7fcda5b6994133efc92b8b49dc20
Opcode Fuzzy Hash: 1eb099bbeba89eb9d8c4df0d287f060314658f1b5814069e821bf15df0e2af54
Instruction Fuzzy Hash: 90A0113000020CAB8A002B82EC08888BFACEB002A0B008030F80C888228B32A8208A88

Function 00478808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4d28ad124055649b6ac08701756986f2b2e5b87976b26dfc5a6270c9a84339
Instruction ID: eb960ed1b565704715978639a976b5d285a2b1a738db04df1eba034923f66ad3
Opcode Fuzzy Hash: 8c4d28ad124055649b6ac08701756986f2b2e5b87976b26dfc5a6270c9a84339
Instruction Fuzzy Hash: E0223970948106CBDF288B59C4987FEB7A1FB41304F24C06FD94A87692DB7C9D92CB5A

Function 004821C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: c29eb9bff85f71b4b9d067bc307f86df6ef22ca6a51b0fe271f7e9ecc6b513b6
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: FFC1B6322050530ADB2D6639853413FFAE55EA27B131A4F5FD8B3CB2D4EE18D926D724

Function 004825FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: cd9b77871571200c71329510492676445b5fa6b27770b92e6849fab6fe4daccf
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 89C1B6322050930ADF2D663A853413FBAE15E927B131A0F6FD4B3DB2D4EE58D925E714

Function 00481978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a9752f27fb81ab5aa4bbd72cd8370a5e04702e940c7b8555e72091ea34e19cff
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 8AC1823220509309DF2D6639C43413FBAE55EA27B131A4F6FD4B3CB2E4EE28D9269714

Function 004D7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004D785B
DeleteObject.GDI32(00000000), ref: 004D786D
DestroyWindow.USER32 ref: 004D787B
GetDesktopWindow.USER32 ref: 004D7895
GetWindowRect.USER32(00000000), ref: 004D789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 004D79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 004D79ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7A35
GetClientRect.USER32(00000000,?), ref: 004D7A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 004D7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7ABB
GlobalLock.KERNEL32(00000000), ref: 004D7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7AD3
GlobalUnlock.KERNEL32(00000000), ref: 004D7ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7AE3
GlobalFree.KERNEL32(00000000), ref: 004D7AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,004F2CAC,00000000), ref: 004D7B16
GlobalFree.KERNEL32(00000000), ref: 004D7B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 004D7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 004D7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 004D7D7A

Strings

AutoIt v3, xrefs: 004D7A2D
static, xrefs: 004D7A75, 004D7BCC
, xrefs: 004D7D00
DISPLAY, xrefs: 004D7BDD

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: fcb68b15c93a331ab532e8bb874a4c4c2c68f5aea3bf714cfc336bbc8720a7d8
Instruction ID: d96e5c256a72f21f056a0c95d2b283dfdd622bda571369383298b31afbe0db74
Opcode Fuzzy Hash: fcb68b15c93a331ab532e8bb874a4c4c2c68f5aea3bf714cfc336bbc8720a7d8
Instruction Fuzzy Hash: F7027971900114EFDB14DFA4CC99EAE7BB9EF49310F10816AF905AB3A1E774AD05CB68

Function 004E356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,004EF910), ref: 004E3627
IsWindowVisible.USER32(?), ref: 004E364B

Strings

TABRIGHT, xrefs: 004E369D
EDITPASTE, xrefs: 004E395F
GETCURRENTCOL, xrefs: 004E3928
FINDSTRING, xrefs: 004E3776
CURRENTTAB, xrefs: 004E36BD
ISENABLED, xrefs: 004E366B
SETCURRENTSELECTION, xrefs: 004E37B6
ISVISIBLE, xrefs: 004E3637
ADDSTRING, xrefs: 004E3716
GETSELECTED, xrefs: 004E38A3
GETCURRENTSELECTION, xrefs: 004E37E3
TABLEFT, xrefs: 004E3687
SELECTSTRING, xrefs: 004E3806
GETLINECOUNT, xrefs: 004E38C6
UNCHECK, xrefs: 004E3883
DELSTRING, xrefs: 004E3749
SHOWDROPDOWN, xrefs: 004E36E0
ISCHECKED, xrefs: 004E3839
SENDCOMMANDID, xrefs: 004E39DA
GETLINE, xrefs: 004E399B
HIDEDROPDOWN, xrefs: 004E3700
GETCURRENTLINE, xrefs: 004E38ED
CHECK, xrefs: 004E386D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: d9a62c0f7653edde6ede084cf449e860df2ca008d30e92cbca9e4f0786b54438
Instruction ID: c8ccc09a012f0f80d5a1fe3b607bccd40bb4f206b2062925bee01124eb998a4d
Opcode Fuzzy Hash: d9a62c0f7653edde6ede084cf449e860df2ca008d30e92cbca9e4f0786b54438
Instruction Fuzzy Hash: E3D1D7702143409BCB05FF12C456AAE7BD5AF50349F05486EF8815B3A3DB39EE4ACB5A

Function 004EA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 004EA630
GetSysColorBrush.USER32(0000000F), ref: 004EA661
GetSysColor.USER32(0000000F), ref: 004EA66D
SetBkColor.GDI32(?,000000FF), ref: 004EA687
SelectObject.GDI32(?,00000000), ref: 004EA696
InflateRect.USER32(?,000000FF,000000FF), ref: 004EA6C1
GetSysColor.USER32(00000010), ref: 004EA6C9
CreateSolidBrush.GDI32(00000000), ref: 004EA6D0
FrameRect.USER32(?,?,00000000), ref: 004EA6DF
DeleteObject.GDI32(00000000), ref: 004EA6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 004EA731
FillRect.USER32(?,?,00000000), ref: 004EA763
GetWindowLongW.USER32(?,000000F0), ref: 004EA78E

Part of subcall function 004EA8CA: GetSysColor.USER32(00000012), ref: 004EA903
Part of subcall function 004EA8CA: SetTextColor.GDI32(?,?), ref: 004EA907
Part of subcall function 004EA8CA: GetSysColorBrush.USER32(0000000F), ref: 004EA91D
Part of subcall function 004EA8CA: GetSysColor.USER32(0000000F), ref: 004EA928
Part of subcall function 004EA8CA: GetSysColor.USER32(00000011), ref: 004EA945
Part of subcall function 004EA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 004EA953
Part of subcall function 004EA8CA: SelectObject.GDI32(?,00000000), ref: 004EA964
Part of subcall function 004EA8CA: SetBkColor.GDI32(?,00000000), ref: 004EA96D
Part of subcall function 004EA8CA: SelectObject.GDI32(?,?), ref: 004EA97A
Part of subcall function 004EA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 004EA999
Part of subcall function 004EA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004EA9B0
Part of subcall function 004EA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 004EA9C5
Part of subcall function 004EA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004EA9ED

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 617529aef66c8640a49e12d8efd7b861cbfc59767d3cc0199843a12378d0b02f
Instruction ID: cdb8b770ab9e7acd69449c37c2f63d6a6a1433f4f71aca3492af8959d13dc878
Opcode Fuzzy Hash: 617529aef66c8640a49e12d8efd7b861cbfc59767d3cc0199843a12378d0b02f
Instruction Fuzzy Hash: 2091A171008341FFD7109F64DC48A6BBBB9FF89321F100B2AF5629A1A2D734E949CB56

Function 00462C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00462CA2
DeleteObject.GDI32(00000000), ref: 00462CE8
DeleteObject.GDI32(00000000), ref: 00462CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00462CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00462D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0049C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0049C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0049C89D

Part of subcall function 00461B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00462036,?,00000000,?,?,?,?,004616CB,00000000,?), ref: 00461B9A

SendMessageW.USER32(?,00001053), ref: 0049C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0049C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0049C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0049C912

Strings

0, xrefs: 0049C731

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: a3862bd5a28d3d21bb7719a8c2acb2da429be15f5d157de4c758828038c1d6af
Instruction ID: 518841ae9fe9b9b48c70e39c33f6141977771259f91c979db9e472d4f1524cf8
Opcode Fuzzy Hash: a3862bd5a28d3d21bb7719a8c2acb2da429be15f5d157de4c758828038c1d6af
Instruction Fuzzy Hash: 9A12AC30600651EFDB10DF24C9C8BAABBE1BF44311F54457AE895CB262D779EC42CB9A

Function 004D74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 004D74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 004D759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 004D75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 004D75ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 004D7633
GetClientRect.USER32(00000000,?), ref: 004D763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 004D7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 004D7692
GetStockObject.GDI32(00000011), ref: 004D76A2
SelectObject.GDI32(00000000,00000000), ref: 004D76A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 004D76B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004D76BF
DeleteDC.GDI32(00000000), ref: 004D76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 004D76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 004D770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 004D7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 004D775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 004D776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 004D779B
GetStockObject.GDI32(00000011), ref: 004D77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 004D77B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 004D77BB

Strings

AutoIt v3, xrefs: 004D762B
msctls_progress32, xrefs: 004D773C
static, xrefs: 004D767D, 004D7795
DISPLAY, xrefs: 004D7688

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: acfdb2c0052c0d910c4718e13f98d12077f02078d82a27b9d4c9f530cc654df8
Instruction ID: 3fae71466fb1d53dddb472df92eaf35b87763c325eb23976575054070662c026
Opcode Fuzzy Hash: acfdb2c0052c0d910c4718e13f98d12077f02078d82a27b9d4c9f530cc654df8
Instruction Fuzzy Hash: 6DA1A171A00214BFEB10DBA4DC8AFAE7BB9EF05714F104125FA04AB2E1D774AD05CB64

Function 004CAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004CAD1E
GetDriveTypeW.KERNEL32(?,004EFAC0,?,\\.\,004EF910), ref: 004CADFB
SetErrorMode.KERNEL32(00000000,004EFAC0,?,\\.\,004EF910), ref: 004CAF59

Strings

Virtual, xrefs: 004CAF21
Removable, xrefs: 004CAE4D
ATAPI, xrefs: 004CAECD
Fibre, xrefs: 004CAEE9
Fixed, xrefs: 004CAE43
CDROM, xrefs: 004CAE2F
PhysicalDrive, xrefs: 004CADA7
ATA, xrefs: 004CAED4
iSCSI, xrefs: 004CAEFE
Unknown, xrefs: 004CAE1B, 004CAEBF
FileBackedVirtual, xrefs: 004CAF28
SAS, xrefs: 004CAF05
USB, xrefs: 004CAEF0
SCSI, xrefs: 004CAEC6
\\.\, xrefs: 004CAD70
RAID, xrefs: 004CAEF7
SATA, xrefs: 004CAF0C
SSD, xrefs: 004CAE86
1394, xrefs: 004CAEDB
Network, xrefs: 004CAE39
RAMDisk, xrefs: 004CAE25
MMC, xrefs: 004CAF1A
SSA, xrefs: 004CAEE2

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 28acde3de75faf1484b712f64e8e843e428323ab83c668ca203e6d79f21ba4f0
Instruction ID: f7f0bcfa949a5991d988b1a348af0908171eb210dd633d6c8bdfec06f8e56564
Opcode Fuzzy Hash: 28acde3de75faf1484b712f64e8e843e428323ab83c668ca203e6d79f21ba4f0
Instruction Fuzzy Hash: C651F9B864820DDB8B90DB10C982EFE7761FF0871CB20455FE407A7290DA389D62DB5B

Function 004668DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00466931
__wcsnicmp.LIBCMT ref: 00466949
__wcsnicmp.LIBCMT ref: 00466961
__wcsnicmp.LIBCMT ref: 00466979
__wcsnicmp.LIBCMT ref: 00466991
__wcsnicmp.LIBCMT ref: 004669A9
__wcsnicmp.LIBCMT ref: 004669C1
__wcsnicmp.LIBCMT ref: 004669D5
__wcsnicmp.LIBCMT ref: 00466A16
__wcsnicmp.LIBCMT ref: 00466A2A
__wcsnicmp.LIBCMT ref: 00466A3E
__wcsnicmp.LIBCMT ref: 00466A52

Strings

Bad directive syntax error, xrefs: 0049E31A
#notrayicon, xrefs: 00466943
#include, xrefs: 004669A3
#include-once, xrefs: 0046698B
Cannot parse #include, xrefs: 0049E3F0
#OnAutoItStartRegister, xrefs: 00466973
#pragma compile, xrefs: 0046692B
#ce, xrefs: 00466A4C
#comments-start, xrefs: 004669BB, 00466A10
#cs, xrefs: 004669CF, 00466A24
#requireadmin, xrefs: 0046695B
Unterminated group of comments, xrefs: 0049E403
#comments-end, xrefs: 00466A38

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: aea5c72a638f156128ee49d44a03d02cd45b41c20d5cd93deed5513fc06eaea8
Instruction ID: 1f3028768561e3effa079c82a830135bbd0d9916adbc6a143aefc71688f40cd4
Opcode Fuzzy Hash: aea5c72a638f156128ee49d44a03d02cd45b41c20d5cd93deed5513fc06eaea8
Instruction Fuzzy Hash: 3281D9B06402056ADF20BE62DC42FBF3B68AF15704F14402BFD056A196FB6DDE4AC65E

Function 004E9A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 004E9AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004E9B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 004E9BA7

Strings

0, xrefs: 004E9BE4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: dd619bfccf4e35d9d631eed72433af0b5814a6293c7ea7199e4fe614a9e5a42a
Instruction ID: fe4f9f0d87d71dfaf02dd833f6e3b5464397f27a9f82f2368e4b0270a2c063a1
Opcode Fuzzy Hash: dd619bfccf4e35d9d631eed72433af0b5814a6293c7ea7199e4fe614a9e5a42a
Instruction Fuzzy Hash: 9402E030104281AFD725CF26C889BABBBE4FF45306F04852EF999962E1C778DD45CB56

Function 004EA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 004EA903
SetTextColor.GDI32(?,?), ref: 004EA907
GetSysColorBrush.USER32(0000000F), ref: 004EA91D
GetSysColor.USER32(0000000F), ref: 004EA928
CreateSolidBrush.GDI32(?), ref: 004EA92D
GetSysColor.USER32(00000011), ref: 004EA945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 004EA953
SelectObject.GDI32(?,00000000), ref: 004EA964
SetBkColor.GDI32(?,00000000), ref: 004EA96D
SelectObject.GDI32(?,?), ref: 004EA97A
InflateRect.USER32(?,000000FF,000000FF), ref: 004EA999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 004EA9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 004EA9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 004EA9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 004EAA14
InflateRect.USER32(?,000000FD,000000FD), ref: 004EAA32
DrawFocusRect.USER32(?,?), ref: 004EAA3D
GetSysColor.USER32(00000011), ref: 004EAA4B
SetTextColor.GDI32(?,00000000), ref: 004EAA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004EAA67
SelectObject.GDI32(?,004EA5FA), ref: 004EAA7E
DeleteObject.GDI32(?), ref: 004EAA89
SelectObject.GDI32(?,?), ref: 004EAA8F
DeleteObject.GDI32(?), ref: 004EAA94
SetTextColor.GDI32(?,?), ref: 004EAA9A
SetBkColor.GDI32(?,?), ref: 004EAAA4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: d62634a39f16ce5be2ca97a065bf13bc6403a12a95ab31e45007a1fb0f2815d2
Instruction ID: 2b0a166b393bdc1883ba27ede0a018b0478c6a3fbec02eb3eb1e601b13ca5203
Opcode Fuzzy Hash: d62634a39f16ce5be2ca97a065bf13bc6403a12a95ab31e45007a1fb0f2815d2
Instruction Fuzzy Hash: 01517D71800248FFDB109FA4DC88EAEBBB9EB48320F114526F911AB2A2D7759D44CF54

Function 004E89D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 004E8AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004E8AD2
CharNextW.USER32(0000014E), ref: 004E8B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 004E8B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 004E8B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004E8B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 004E8B86
SetWindowTextW.USER32(?,0000014E), ref: 004E8BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 004E8BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 004E8C1F
_memset.LIBCMT ref: 004E8C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 004E8C8D
_memset.LIBCMT ref: 004E8CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 004E8D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 004E8D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 004E8E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 004E8E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 004E8E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 004E8EB4
DrawMenuBar.USER32(?), ref: 004E8EC3
SetWindowTextW.USER32(?,0000014E), ref: 004E8EEB

Strings

0, xrefs: 004E8E55

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 40a432ea850f67b99b1e2f00951c8e7b0250d6e60e7cdd7e8a260ee6710ddcd6
Instruction ID: 383c1d963c45569c6a92c2cc42b32706f01df642065cdea17a3478f170cf1dbb
Opcode Fuzzy Hash: 40a432ea850f67b99b1e2f00951c8e7b0250d6e60e7cdd7e8a260ee6710ddcd6
Instruction Fuzzy Hash: 7FE1B470900288AFDF209F62CC84EEF7B79EF05711F10416BF919AA291DB789985CF59

Function 004E488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 004E49CA
GetDesktopWindow.USER32 ref: 004E49DF
GetWindowRect.USER32(00000000), ref: 004E49E6
GetWindowLongW.USER32(?,000000F0), ref: 004E4A48
DestroyWindow.USER32(?), ref: 004E4A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 004E4A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004E4ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 004E4AE1
SendMessageW.USER32(?,00000421,?,?), ref: 004E4AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 004E4B09
IsWindowVisible.USER32(?), ref: 004E4B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 004E4B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 004E4B58
GetWindowRect.USER32(?,?), ref: 004E4B70
MonitorFromPoint.USER32(?,?,00000002), ref: 004E4B96
GetMonitorInfoW.USER32(00000000,?), ref: 004E4BB0
CopyRect.USER32(?,?), ref: 004E4BC7
SendMessageW.USER32(?,00000412,00000000), ref: 004E4C32

Strings

tooltips_class32, xrefs: 004E4A96
(, xrefs: 004E4BA3
0, xrefs: 004E4975

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: abffcc569ab44fbd2b1d9357cb4f4ba44319027b825846a3deb3929a1546d428
Instruction ID: b2e1b50d1c76b66c8cb3b1d8dc4b97c879892450f1c66f217ef7e1088cda1629
Opcode Fuzzy Hash: abffcc569ab44fbd2b1d9357cb4f4ba44319027b825846a3deb3929a1546d428
Instruction Fuzzy Hash: 51B18D70604380AFDB04DF66C884B6BBBE4BF84715F008A2EF5999B291D774EC05CB5A

Function 004C449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 004C44AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 004C44D2
_wcscpy.LIBCMT ref: 004C4500
_wcscmp.LIBCMT ref: 004C450B
_wcscat.LIBCMT ref: 004C4521
_wcsstr.LIBCMT ref: 004C452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 004C4548
_wcscat.LIBCMT ref: 004C4591
_wcscat.LIBCMT ref: 004C4598
_wcsncpy.LIBCMT ref: 004C45C3

Strings

%u.%u.%u.%u, xrefs: 004C4626
DefaultLangCodepage, xrefs: 004C45AB
\VarFileInfo\Translation, xrefs: 004C4540
04090000, xrefs: 004C457E
StringFileInfo\, xrefs: 004C451B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 741949996bb358d0e59ba3a453d559a9a0865a699a17a13d58d1f2bb5fe08589
Instruction ID: 5cfd3ab34ecfb57689b77df71190305474d5980eae78ae2660fc00b9aa11ff49
Opcode Fuzzy Hash: 741949996bb358d0e59ba3a453d559a9a0865a699a17a13d58d1f2bb5fe08589
Instruction Fuzzy Hash: 9141E831A002007BDB50BA758D43FBF7BACDF81714F10086FF905A6182EA7C9A0597AD

Function 004627D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004628BC
GetSystemMetrics.USER32(00000007), ref: 004628C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 004628EF
GetSystemMetrics.USER32(00000008), ref: 004628F7
GetSystemMetrics.USER32(00000004), ref: 0046291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00462939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00462949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0046297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00462990
GetClientRect.USER32(00000000,000000FF), ref: 004629AE
GetStockObject.GDI32(00000011), ref: 004629CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 004629D5

Part of subcall function 00462344: GetCursorPos.USER32(?), ref: 00462357
Part of subcall function 00462344: ScreenToClient.USER32(005257B0,?), ref: 00462374
Part of subcall function 00462344: GetAsyncKeyState.USER32(00000001), ref: 00462399
Part of subcall function 00462344: GetAsyncKeyState.USER32(00000002), ref: 004623A7

SetTimer.USER32(00000000,00000000,00000028,00461256), ref: 004629FC

Strings

AutoIt v3 GUI, xrefs: 00462974

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 49c551d613f732dc55c90532ce2545f7c2e11d503b099f096cc945d30ec952bd
Instruction ID: 17dd3e435a4db7dcdf073238fe3913ec21e7f44eaebdb05edbeef142d966ef31
Opcode Fuzzy Hash: 49c551d613f732dc55c90532ce2545f7c2e11d503b099f096cc945d30ec952bd
Instruction Fuzzy Hash: 6DB1A470600609EFDB14DFA8DD85BAE7BB4FF08314F10422AFA15E7291E7B89845CB59

Function 004BA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 004BA47A
__swprintf.LIBCMT ref: 004BA51B
_wcscmp.LIBCMT ref: 004BA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 004BA583
_wcscmp.LIBCMT ref: 004BA5BF
GetClassNameW.USER32(?,?,00000400), ref: 004BA5F6
GetDlgCtrlID.USER32(?), ref: 004BA648
GetWindowRect.USER32(?,?), ref: 004BA67E
GetParent.USER32(?), ref: 004BA69C
ScreenToClient.USER32(00000000), ref: 004BA6A3
GetClassNameW.USER32(?,?,00000100), ref: 004BA71D
_wcscmp.LIBCMT ref: 004BA731
GetWindowTextW.USER32(?,?,00000400), ref: 004BA757
_wcscmp.LIBCMT ref: 004BA76B

Part of subcall function 0048362C: _iswctype.LIBCMT ref: 00483634

Strings

%s%u, xrefs: 004BA515

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 1bc685696df6c9be7547874ced3a816bccb0788eee0b5404e213c7cb9e5a816d
Instruction ID: cae957032b41ec50efab612234430325571c0f0b609fc822d50c54a0486ef219
Opcode Fuzzy Hash: 1bc685696df6c9be7547874ced3a816bccb0788eee0b5404e213c7cb9e5a816d
Instruction Fuzzy Hash: E6A1B371204206BFD714DF64C884BEBB7E8FF44314F00452AF999D6251DB38E966CBAA

Function 004BAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 004BAF18
_wcscmp.LIBCMT ref: 004BAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 004BAF51
CharUpperBuffW.USER32(?,00000000), ref: 004BAF6E
_wcscmp.LIBCMT ref: 004BAF8C
_wcsstr.LIBCMT ref: 004BAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 004BAFD5
_wcscmp.LIBCMT ref: 004BAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 004BB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 004BB055
_wcscmp.LIBCMT ref: 004BB065
GetClassNameW.USER32(00000010,?,00000400), ref: 004BB08D
GetWindowRect.USER32(00000004,?), ref: 004BB0F6

Strings

@, xrefs: 004BAEF9
ThumbnailClass, xrefs: 004BAFE0, 004BB060

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 96cc48e7b20fa8c593a036a5e8acb6a781fa5375669c88a8fb8f4b77767d938c
Instruction ID: 21022c20660766eda98a2fe5e86be7d8dce9c9e11d0afd2434b61ea5ed82d727
Opcode Fuzzy Hash: 96cc48e7b20fa8c593a036a5e8acb6a781fa5375669c88a8fb8f4b77767d938c
Instruction Fuzzy Hash: 5E81AE710082059BDB01DF15C881BFB7BE8EF44758F04846BED858A192EB78DD49CBBA

Function 004EC5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

DragQueryPoint.SHELL32(?,?), ref: 004EC627

Part of subcall function 004EAB37: ClientToScreen.USER32(?,?), ref: 004EAB60
Part of subcall function 004EAB37: GetWindowRect.USER32(?,?), ref: 004EABD6
Part of subcall function 004EAB37: PtInRect.USER32(?,?,004EC014), ref: 004EABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 004EC690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 004EC69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 004EC6BE
_wcscat.LIBCMT ref: 004EC6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 004EC705
SendMessageW.USER32(?,000000B0,?,?), ref: 004EC71E
SendMessageW.USER32(?,000000B1,?,?), ref: 004EC735
SendMessageW.USER32(?,000000B1,?,?), ref: 004EC757
DragFinish.SHELL32(?), ref: 004EC75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 004EC851

Strings

pbR, xrefs: 004EC79B
@GUI_DRAGID, xrefs: 004EC7C9
@GUI_DROPID, xrefs: 004EC77E
@GUI_DRAGFILE, xrefs: 004EC800

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pbR
API String ID: 169749273-474899137
Opcode ID: d1496992ee65a21f9b3a848f8b024c2919ee0db53c447977c12faf0b3d4c433a
Instruction ID: 25825b23bfd00832575f26515b601b221d93c4c120d6e52f378ab31374a02ec6
Opcode Fuzzy Hash: d1496992ee65a21f9b3a848f8b024c2919ee0db53c447977c12faf0b3d4c433a
Instruction Fuzzy Hash: 5A618B71108380AFC701EF65CC85DAFBBE8FF99314F40092EF591961A1EB749A49CB5A

Function 004BABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 004BAC33

Strings

[LAST, xrefs: 004BACE0
[HANDLE:, xrefs: 004BAC3F
[REGEXPTITLE:, xrefs: 004BAC5B
REGEXP=, xrefs: 004BAC48
LAST, xrefs: 004BABF8
CLASSNAME=, xrefs: 004BAC70
ALL, xrefs: 004BACC7
ACTIVE, xrefs: 004BAC0E
[ALL, xrefs: 004BACD9
HANDLE=, xrefs: 004BAC2C
[CLASS:, xrefs: 004BAC83
[ACTIVE, xrefs: 004BAC20

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: e1faa0bafd2924b3d3f7a0930cb1a102f1a798d8df278e3cdf61382220d21bdf
Instruction ID: ff478e6e8b94c8acc93cedfcc4a3699ea093ab497faa75d47d5902ca7c7f8558
Opcode Fuzzy Hash: e1faa0bafd2924b3d3f7a0930cb1a102f1a798d8df278e3cdf61382220d21bdf
Instruction Fuzzy Hash: EB31E430688209A6EA00FA65DE03EEE7B74AF14B18F20091FF441710D1FF696F14C66B

Function 004D4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 004D5013
LoadCursorW.USER32(00000000,00007F00), ref: 004D501E
LoadCursorW.USER32(00000000,00007F03), ref: 004D5029
LoadCursorW.USER32(00000000,00007F8B), ref: 004D5034
LoadCursorW.USER32(00000000,00007F01), ref: 004D503F
LoadCursorW.USER32(00000000,00007F81), ref: 004D504A
LoadCursorW.USER32(00000000,00007F88), ref: 004D5055
LoadCursorW.USER32(00000000,00007F80), ref: 004D5060
LoadCursorW.USER32(00000000,00007F86), ref: 004D506B
LoadCursorW.USER32(00000000,00007F83), ref: 004D5076
LoadCursorW.USER32(00000000,00007F85), ref: 004D5081
LoadCursorW.USER32(00000000,00007F82), ref: 004D508C
LoadCursorW.USER32(00000000,00007F84), ref: 004D5097
LoadCursorW.USER32(00000000,00007F04), ref: 004D50A2
LoadCursorW.USER32(00000000,00007F02), ref: 004D50AD
LoadCursorW.USER32(00000000,00007F89), ref: 004D50B8
GetCursorInfo.USER32(?), ref: 004D50C8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 457c158452fc26621dd20328d0cb3495fbe1a4680fbca4b3b8484acee3494334
Instruction ID: 07ef4f0b4be4bfd90202afde0e0d5c873c38d67440e9bdc9e0d148df7e3e233a
Opcode Fuzzy Hash: 457c158452fc26621dd20328d0cb3495fbe1a4680fbca4b3b8484acee3494334
Instruction Fuzzy Hash: DE3113B1D08319AADF109FB68C8996FBFE8FF04750F50453BA50CE7281DA78A5048F95

Function 004EA1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004EA259
DestroyWindow.USER32(?,?), ref: 004EA2D3

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 004EA34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 004EA36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004EA382
DestroyWindow.USER32(00000000), ref: 004EA3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00460000,00000000), ref: 004EA3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 004EA3F4
GetDesktopWindow.USER32 ref: 004EA40D
GetWindowRect.USER32(00000000), ref: 004EA414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 004EA42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 004EA444

Part of subcall function 004625DB: GetWindowLongW.USER32(?,000000EB), ref: 004625EC

Strings

tooltips_class32, xrefs: 004EA346, 004EA3D4
0, xrefs: 004EA26F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 64fddee79dd8614889763cedfeefe5b4bb11cd26dee48431c8b919c2f10b03e7
Instruction ID: fe8425cf4c9e9f7ddf4e4b25d6f0bf9ea37acb3014bd052faaa21a48794a0079
Opcode Fuzzy Hash: 64fddee79dd8614889763cedfeefe5b4bb11cd26dee48431c8b919c2f10b03e7
Instruction Fuzzy Hash: 95719C70140284AFD721CF29CC48F677BE5FB89304F44452EF9858B2A1D7B8A916CB5A

Function 004E4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004E4424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004E446F

Strings

EXISTS, xrefs: 004E44D8
UNCHECK, xrefs: 004E464B
ISCHECKED, xrefs: 004E45F2
GETTOTALCOUNT, xrefs: 004E4456
EXPAND, xrefs: 004E4521
COLLAPSE, xrefs: 004E44B5
CHECK, xrefs: 004E448F
SELECT, xrefs: 004E4620
GETSELECTED, xrefs: 004E457F
GETTEXT, xrefs: 004E45C2
GETITEMCOUNT, xrefs: 004E4551

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: cf14c0b204be0cd7734ca92b54b062a5bd9a03829937b838e99b3f194501bd25
Instruction ID: 06533577cdd7847b19df7b2936a320c129eb832b9ee78b830ab37628fb7a0ce3
Opcode Fuzzy Hash: cf14c0b204be0cd7734ca92b54b062a5bd9a03829937b838e99b3f194501bd25
Instruction Fuzzy Hash: 2091C6706103009FCB04EF22C451A6EB7E5AF95358F04485EF8925B3A2DB3CED4ACB5A

Function 004EB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 004EB8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,004E91C2), ref: 004EB910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004EB949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 004EB98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 004EB9C3
FreeLibrary.KERNEL32(?), ref: 004EB9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 004EB9DF
DestroyIcon.USER32(?,?,?,?,?,004E91C2), ref: 004EB9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 004EBA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 004EBA17

Part of subcall function 00482EFD: __wcsicmp_l.LIBCMT ref: 00482F86

Strings

.dll, xrefs: 004EB86D
.icl, xrefs: 004EB82A
.exe, xrefs: 004EB84A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 030372d3c332fced2c2eb2e1d3425bb5105583a2b65cc8dd5b174fc38f9d8ae9
Instruction ID: 00a3dcac72af91147cb421a314eabbd74eb187773e3f4d688150519143b38888
Opcode Fuzzy Hash: 030372d3c332fced2c2eb2e1d3425bb5105583a2b65cc8dd5b174fc38f9d8ae9
Instruction Fuzzy Hash: D061C1B1500255BAEB14DF66CC81BBF77A8FB04711F10451AFD15D62C2DB78A980DBA4

Function 004CA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

CharLowerBuffW.USER32(?,?), ref: 004CA3CB
GetDriveTypeW.KERNEL32 ref: 004CA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 004CA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 004CA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 004CA4C5

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

Strings

close cd wait, xrefs: 004CA4B0
type cdaudio alias cd wait, xrefs: 004CA443
open , xrefs: 004CA427
closed, xrefs: 004CA3DF, 004CA3E8
open, xrefs: 004CA3F2
set cd door , xrefs: 004CA466
wait, xrefs: 004CA482
close, xrefs: 004CA3D1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: db85439679f4211267d6cab1e57d5cefa416c9569e68a2bb9cc5594bdb5d73d2
Instruction ID: e1ac1f7ea3b8a7bd01980426d1acb959e1c004a5c6bde1b12e5bd0e310cff4d9
Opcode Fuzzy Hash: db85439679f4211267d6cab1e57d5cefa416c9569e68a2bb9cc5594bdb5d73d2
Instruction Fuzzy Hash: DE515BB51143049FC744EF21C881D6AB7E8FF9471CF00896EF89657261EB75AD0ACB4A

Function 004BF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0049E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 004BF8DF
LoadStringW.USER32(00000000,?,0049E029,00000001), ref: 004BF8E8

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0049E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 004BF90A
LoadStringW.USER32(00000000,?,0049E029,00000001), ref: 004BF90D
__swprintf.LIBCMT ref: 004BF95D
__swprintf.LIBCMT ref: 004BF96E
_wprintf.LIBCMT ref: 004BFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004BFA2E

Strings

Line %d:, xrefs: 004BF968
%s (%d) : ==> %s: %s %s, xrefs: 004BFA12
Error: , xrefs: 004BF9E5
Line %d (File "%s"):, xrefs: 004BF957
^ ERROR, xrefs: 004BF9C3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: f864348e3f463180a4f76e5eb04b707b5ca987a5e0f105e4505a73fbaa7d367b
Instruction ID: 2087e41e504682e94d3b86af837173398986e57a8745443693b0125618040ea8
Opcode Fuzzy Hash: f864348e3f463180a4f76e5eb04b707b5ca987a5e0f105e4505a73fbaa7d367b
Instruction Fuzzy Hash: 4841407290010DAACF15FBE1DD86DFE7778AF18308F50046AB50576092EA396F49CB6A

Function 004EBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,004E9207,?,?), ref: 004EBA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,004E9207,?,?,00000000,?), ref: 004EBA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,004E9207,?,?,00000000,?), ref: 004EBA78
CloseHandle.KERNEL32(00000000,?,?,?,?,004E9207,?,?,00000000,?), ref: 004EBA85
GlobalLock.KERNEL32(00000000), ref: 004EBA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,004E9207,?,?,00000000,?), ref: 004EBA9D
GlobalUnlock.KERNEL32(00000000), ref: 004EBAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,004E9207,?,?,00000000,?), ref: 004EBAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,004E9207,?,?,00000000,?), ref: 004EBABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,004F2CAC,?), ref: 004EBAD7
GlobalFree.KERNEL32(00000000), ref: 004EBAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 004EBB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 004EBB36
DeleteObject.GDI32(00000000), ref: 004EBB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 004EBB74

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 0db6daae3f10b5c59a84ee1d73f285063b20633b5ddb72214887fa176d316e44
Instruction ID: 33eb3b3447a1dbc967beefbf283bf0184b1417ee2777cb57908462f91bb4a331
Opcode Fuzzy Hash: 0db6daae3f10b5c59a84ee1d73f285063b20633b5ddb72214887fa176d316e44
Instruction Fuzzy Hash: 10415975600248EFCB119F66DC88EABBBB8FB89711F108079F905DB261D735AE05CB64

Function 004CD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 004CDA10
_wcscat.LIBCMT ref: 004CDA28
_wcscat.LIBCMT ref: 004CDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 004CDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 004CDA63
GetFileAttributesW.KERNEL32(?), ref: 004CDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 004CDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 004CDAA7

Strings

*.*, xrefs: 004CDAE6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: a66ae13d619617dbc17ffe56edab4416f32223da95778af4c5d9a92882cda932
Instruction ID: 4b64cdb4113bb0d02aa2aea19bd220a7823374663f1af2c6891df6e0b1e46b67
Opcode Fuzzy Hash: a66ae13d619617dbc17ffe56edab4416f32223da95778af4c5d9a92882cda932
Instruction Fuzzy Hash: 718182B99042419FCBA4EF65C840E6BB7E8AF89314F14483FF889C7251E638DD45CB5A

Function 004EC1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 004EC1FC
GetFocus.USER32 ref: 004EC20C
GetDlgCtrlID.USER32(00000000), ref: 004EC217
_memset.LIBCMT ref: 004EC342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 004EC36D
GetMenuItemCount.USER32(?), ref: 004EC38D
GetMenuItemID.USER32(?,00000000), ref: 004EC3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 004EC3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 004EC41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 004EC454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 004EC489

Strings

0, xrefs: 004EC33A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 93e7f2904a3434b2de2b975d7ddf1e69d89ee7f5a23369adde0d195971acf110
Instruction ID: 957719aa0e814bcf6047e90b7d068a291ac1c0134af9ec59fc235d8fc706fbad
Opcode Fuzzy Hash: 93e7f2904a3434b2de2b975d7ddf1e69d89ee7f5a23369adde0d195971acf110
Instruction Fuzzy Hash: FE819D71608381AFD710CF26C8C4A7BBBE4FB88315F00492EF99597292D774D906CB9A

Function 004D731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004D738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 004D739B
CreateCompatibleDC.GDI32(?), ref: 004D73A7
SelectObject.GDI32(00000000,?), ref: 004D73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 004D7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 004D7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 004D7468
SelectObject.GDI32(00000006,?), ref: 004D7470
DeleteObject.GDI32(?), ref: 004D7479
DeleteDC.GDI32(00000006), ref: 004D7480
ReleaseDC.USER32(00000000,?), ref: 004D748B

Strings

(, xrefs: 004D7410

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 5bb198b45c840845f3975d11c4679bb6040d5173190fa16c2b52a16f45cb9f49
Instruction ID: 1687474a413a9f9dbe77e5a81e5b588807522d701d2c6e5db634d9a52d458f16
Opcode Fuzzy Hash: 5bb198b45c840845f3975d11c4679bb6040d5173190fa16c2b52a16f45cb9f49
Instruction Fuzzy Hash: 8F514671904209EFCB14CFA8CC84AAFBBB9EF48310F14842EF95A9B311D735A945CB54

Function 00466A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00480957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00466B0C,?,00008000), ref: 00480973

Part of subcall function 00464750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00464743,?,?,004637AE,?), ref: 00464770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00466BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00466CFA

Part of subcall function 0046586D: _wcscpy.LIBCMT ref: 004658A5

Part of subcall function 0048363D: _iswctype.LIBCMT ref: 00483645

Strings

Error opening the file, xrefs: 0049E43D, 0049E4B8
Bad directive syntax error, xrefs: 0049E79D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0049E421
EA06, xrefs: 0049E452
Unterminated string, xrefs: 0049E7E4
>>>AUTOIT SCRIPT<<<, xrefs: 0049E496
AU3!, xrefs: 00466B61

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 0402368acae33e53bc5087f1480791d79aedce46ac6c826b7e811c891479156f
Instruction ID: 87a2d6a42d401e480b7c2677b6b1e41d2986c0a7249036082d410469b5f5dc89
Opcode Fuzzy Hash: 0402368acae33e53bc5087f1480791d79aedce46ac6c826b7e811c891479156f
Instruction Fuzzy Hash: B2029F701083409FCB14EF26C8919AFBBE5BF94318F14492EF495972A1EB38D949CB5B

Function 004C2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 004C2DDD
GetMenuItemCount.USER32(00525890), ref: 004C2E66
DeleteMenu.USER32(00525890,00000005,00000000,000000F5,?,?), ref: 004C2EF6
DeleteMenu.USER32(00525890,00000004,00000000), ref: 004C2EFE
DeleteMenu.USER32(00525890,00000006,00000000), ref: 004C2F06
DeleteMenu.USER32(00525890,00000003,00000000), ref: 004C2F0E
GetMenuItemCount.USER32(00525890), ref: 004C2F16
SetMenuItemInfoW.USER32(00525890,00000004,00000000,00000030), ref: 004C2F4C
GetCursorPos.USER32(?), ref: 004C2F56
SetForegroundWindow.USER32(00000000), ref: 004C2F5F
TrackPopupMenuEx.USER32(00525890,00000000,?,00000000,00000000,00000000), ref: 004C2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 004C2F7E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 738c9c61d7156b7cae1ef1d75256c9faecbe88889e9c387542153b592673f979
Instruction ID: b8735137fbde86e8332795adbd23fd9a4c400083fcdba808a14a1ee5b5f4f9e1
Opcode Fuzzy Hash: 738c9c61d7156b7cae1ef1d75256c9faecbe88889e9c387542153b592673f979
Instruction Fuzzy Hash: 4F71E178600209BBEB618F15DD85FAABF64FF04324F14022FF615AA2E1C7F95810DB99

Function 004D88AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004D88D7
CoInitialize.OLE32(00000000), ref: 004D8904
CoUninitialize.OLE32 ref: 004D890E
GetRunningObjectTable.OLE32(00000000,?), ref: 004D8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 004D8B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,004F2C0C), ref: 004D8B6F
CoGetObject.OLE32(?,00000000,004F2C0C,?), ref: 004D8B92
SetErrorMode.KERNEL32(00000000), ref: 004D8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004D8C25
VariantClear.OLEAUT32(?), ref: 004D8C35

Strings

,,O, xrefs: 004D88C1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,O
API String ID: 2395222682-289689913
Opcode ID: d69db33a868d15515dcb877e3f35b0f439a1ba2208020704cd40ca0e62c5885e
Instruction ID: 7b738845a437e80f7271cf552bf32776dabc6a0c058bbbecefef8d8b45b3649c
Opcode Fuzzy Hash: d69db33a868d15515dcb877e3f35b0f439a1ba2208020704cd40ca0e62c5885e
Instruction Fuzzy Hash: 9EC133B1208345AFC700DF65C89492BB7E9BF88748F00492EF98A9B351DB75ED06CB56

Function 004B77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

_memset.LIBCMT ref: 004B786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 004B78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 004B78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 004B78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 004B7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 004B792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 004B7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 004B793A

Strings

\CLSID, xrefs: 004B7822
SOFTWARE\Classes\, xrefs: 004B780C
\IPC$, xrefs: 004B7882

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: d644cf7092393533de03273b60fe0e054cc83a4eea87b7c2a8d567a32fb3374b
Instruction ID: 6f3556f689f392c6058fab1199b429ad582ddc20cc0624c88bc9a5c82fdd1dad
Opcode Fuzzy Hash: d644cf7092393533de03273b60fe0e054cc83a4eea87b7c2a8d567a32fb3374b
Instruction Fuzzy Hash: CD411A72C1422DAADF11EB95DC85DEEB778FF54314F00412AE815A72A2EB345E08CBA5

Function 004E0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DFDAD,?,?), ref: 004E0E31

Strings

HKEY_CLASSES_ROOT, xrefs: 004E0EC4
HKEY_CURRENT_CONFIG, xrefs: 004E0EEE
HKCR, xrefs: 004E0ED9
HKEY_CURRENT_USER, xrefs: 004E0F10
HKEY_USERS, xrefs: 004E0F32
HKLM, xrefs: 004E0EAF
HKCU, xrefs: 004E0F21
HKEY_LOCAL_MACHINE, xrefs: 004E0E9A
HKU, xrefs: 004E0F43
HKCC, xrefs: 004E0EFF

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: cd97ccdbbee2f4e78ccdceee48bfc5a19df33409c9d81f12b28aebe82fbb8049
Instruction ID: 380a4960450ae28c76ad768bc963ac848a0fb33d53f38daa3dc77e0228b119de
Opcode Fuzzy Hash: cd97ccdbbee2f4e78ccdceee48bfc5a19df33409c9d81f12b28aebe82fbb8049
Instruction Fuzzy Hash: 644186355103858BDF24EF12D8626EF3760FF21309F14085AFC6517251D7B89D9ACBA5

Function 004BF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0049E2A0,00000010,?,Bad directive syntax error,004EF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 004BF7C2
LoadStringW.USER32(00000000,?,0049E2A0,00000010), ref: 004BF7C9

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

_wprintf.LIBCMT ref: 004BF7FC
__swprintf.LIBCMT ref: 004BF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 004BF88D

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 004BF7F7
., xrefs: 004BF873
Line %d:, xrefs: 004BF818
Line %d (File "%s"):, xrefs: 004BF833
Error: , xrefs: 004BF85B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: a22ff019eeed56ce28f3d0d24f9cdb7ce5f46ccbcc67d6fbdb04f299dd81e5e5
Instruction ID: 89122bf688981fe83aa5b97cc9031d8bdb67408c503affa1f5de8721f7d7131b
Opcode Fuzzy Hash: a22ff019eeed56ce28f3d0d24f9cdb7ce5f46ccbcc67d6fbdb04f299dd81e5e5
Instruction Fuzzy Hash: 6A21733294021DFBCF12EF91CC4AEFE7739BF14308F04086AF515650A2EA359658DB59

Function 004C52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

Part of subcall function 00467924: _memmove.LIBCMT ref: 004679AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 004C5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 004C5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 004C5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 004C5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 004C537A

Strings

status PlayMe mode, xrefs: 004C532B
play PlayMe wait, xrefs: 004C5364
play PlayMe, xrefs: 004C5375
open , xrefs: 004C52DF
close PlayMe, xrefs: 004C5341, 004C536E
alias PlayMe, xrefs: 004C5309

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 3237acda73254f387db513f09fd5241d826aa958ed6072ed0f84e0fae64a2cf2
Instruction ID: f52f13d8eebc12762787a36c5701263ae0a0dff51eed9c85695d35a617f73250
Opcode Fuzzy Hash: 3237acda73254f387db513f09fd5241d826aa958ed6072ed0f84e0fae64a2cf2
Instruction Fuzzy Hash: AB11B660A5016979E760B662CC49DFF7FBCFBE1B88F00042E7811920E1EEA41D84C565

Function 004C46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004C46D2
gethostname.WSOCK32(?,00000100), ref: 004C46EC
gethostbyname.WSOCK32(?), ref: 004C46F9
_wcscpy.LIBCMT ref: 004C4721
_memmove.LIBCMT ref: 004C4734
inet_ntoa.WSOCK32(?), ref: 004C473F
_strcat.LIBCMT ref: 004C474D
_wcscpy.LIBCMT ref: 004C4764
WSACleanup.WSOCK32 ref: 004C4772
_wcscpy.LIBCMT ref: 004C4780

Strings

0.0.0.0, xrefs: 004C471B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: efcf0f386ec482d0b741369cb96d1a5cbd0a84479a5dce940a90d12615b235d4
Instruction ID: fd94eb14d077dbe8a216fb291fbddf4f21b8a1905c2c1190181774807a0e286f
Opcode Fuzzy Hash: efcf0f386ec482d0b741369cb96d1a5cbd0a84479a5dce940a90d12615b235d4
Instruction Fuzzy Hash: 7711F335900114ABCB60BB719D86FEF77ACEB41315F0005BFF84596192EF788A858758

Function 004C4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 004C4F7A

Part of subcall function 0048049F: timeGetTime.WINMM(?,75A8B400,00470E7B), ref: 004804A3

Sleep.KERNEL32(0000000A), ref: 004C4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 004C4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 004C4FEC
SetActiveWindow.USER32 ref: 004C500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 004C5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 004C5038
Sleep.KERNEL32(000000FA), ref: 004C5043
IsWindow.USER32 ref: 004C504F
EndDialog.USER32(00000000), ref: 004C5060

Strings

BUTTON, xrefs: 004C4FDE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a1ccc33e4b7c3bd4395bc345aea9ae808fa2c039357be4bcf3d8b729a46faf50
Instruction ID: 7ea73a22a626d7d0b62f5779f3e1b53376b8648bb2198ecb80c7f3511724dc71
Opcode Fuzzy Hash: a1ccc33e4b7c3bd4395bc345aea9ae808fa2c039357be4bcf3d8b729a46faf50
Instruction Fuzzy Hash: 4521C278200644BFE7605F30EDC8F2A3B69EF66745B44103DF401852B2EB355E4AA769

Function 004CD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

CoInitialize.OLE32(00000000), ref: 004CD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 004CD67D
SHGetDesktopFolder.SHELL32(?), ref: 004CD691
CoCreateInstance.OLE32(004F2D7C,00000000,00000001,00518C1C,?), ref: 004CD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 004CD74C
CoTaskMemFree.OLE32(?,?), ref: 004CD7A4
_memset.LIBCMT ref: 004CD7E1
SHBrowseForFolderW.SHELL32(?), ref: 004CD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 004CD840
CoTaskMemFree.OLE32(00000000), ref: 004CD847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 004CD87E
CoUninitialize.OLE32(00000001,00000000), ref: 004CD880

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 951cf17ed4507fdc7d1aa16dda80cf11ca20eb28c5ecd7bcd2bcdaba5b0203ab
Instruction ID: b0c57cd72880aebfded5ab2e38902c5dc42b632299b936c272b198f3ffc68306
Opcode Fuzzy Hash: 951cf17ed4507fdc7d1aa16dda80cf11ca20eb28c5ecd7bcd2bcdaba5b0203ab
Instruction Fuzzy Hash: 6FB10A75A00109AFDB44DFA5C884EAEBBB9FF48304B14846DF809DB261DB34ED45CB55

Function 004BC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 004BC283
GetWindowRect.USER32(00000000,?), ref: 004BC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 004BC2F3
GetDlgItem.USER32(?,00000002), ref: 004BC2FE
GetWindowRect.USER32(00000000,?), ref: 004BC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 004BC364
GetDlgItem.USER32(?,000003E9), ref: 004BC372
GetWindowRect.USER32(00000000,?), ref: 004BC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 004BC3C6
GetDlgItem.USER32(?,000003EA), ref: 004BC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 004BC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 004BC3FE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: e389d741a798c178f90f525bc21e494a2bdfd2159f194c61d80c9db5a2cd56d3
Instruction ID: 1267de266c8e11352681d6c679c48b142144d99abab9f4a502d5f4e7c9ea58dd
Opcode Fuzzy Hash: e389d741a798c178f90f525bc21e494a2bdfd2159f194c61d80c9db5a2cd56d3
Instruction Fuzzy Hash: 83513C71B00205ABDB18CFB9DDD9AAEBBBAEB88710F14813DF916D6291D7709D048B14

Function 0046201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00461B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00462036,?,00000000,?,?,?,?,004616CB,00000000,?), ref: 00461B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 004620D3
KillTimer.USER32(-00000001,?,?,?,?,004616CB,00000000,?,?,00461AE2,?,?), ref: 0046216E
DestroyAcceleratorTable.USER32(00000000), ref: 0049BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004616CB,00000000,?,?,00461AE2,?,?), ref: 0049BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004616CB,00000000,?,?,00461AE2,?,?), ref: 0049BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,004616CB,00000000,?,?,00461AE2,?,?), ref: 0049BD0A
DeleteObject.GDI32(00000000), ref: 0049BD1C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 02f814f7d863a93765d4b775151a2e4d9cd9aca594f801895219c4c7d54947c2
Instruction ID: 8242a8b40054241beaa8bb5611c3a8cea8a0482948198da1dd71f0505929d930
Opcode Fuzzy Hash: 02f814f7d863a93765d4b775151a2e4d9cd9aca594f801895219c4c7d54947c2
Instruction Fuzzy Hash: D061C330101A50EFCB359F14DA48B267BF1FF51306F14853EE5425A671E7B8A846DB8A

Function 004621A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004625DB: GetWindowLongW.USER32(?,000000EB), ref: 004625EC

GetSysColor.USER32(0000000F), ref: 004621D3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 83aeafbde9ab6faed72c9ceebc977f6b2221a7679167bc807f2647e4ac18487b
Instruction ID: ecb92e367678eac69c0bee2716c7c9326781ead815e46ab9a400f3f52e7b785f
Opcode Fuzzy Hash: 83aeafbde9ab6faed72c9ceebc977f6b2221a7679167bc807f2647e4ac18487b
Instruction Fuzzy Hash: 1941C631000944EBDF215F28ED98BBA3B65EB06331F1442B6FD618E2E2D7754C42DB5A

Function 004CA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,004EF910), ref: 004CA90B
GetDriveTypeW.KERNEL32(00000061,005189A0,00000061), ref: 004CA9D5
_wcscpy.LIBCMT ref: 004CA9FF

Strings

fixed, xrefs: 004CA953
removable, xrefs: 004CA93D
unknown, xrefs: 004CA996
cdrom, xrefs: 004CA927
all, xrefs: 004CA911
ramdisk, xrefs: 004CA97F
network, xrefs: 004CA969

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 8d8e6a17581a1c95a0b2986925cf88a9a3f24e4c8e23cd5c4673555fa874ec64
Instruction ID: a866b46e5fc030b8c02d90abceada53e50168f095d536eff52c1d63f14124783
Opcode Fuzzy Hash: 8d8e6a17581a1c95a0b2986925cf88a9a3f24e4c8e23cd5c4673555fa874ec64
Instruction Fuzzy Hash: 6B51BB791183049BC754EF15C892EAFB7A5EF80308F144C2EF496572A2EB399D19CB4B

Function 00469837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00469862
__swprintf.LIBCMT ref: 004698AC
__i64tow.LIBCMT ref: 0049F5E6

Strings

0x%p, xrefs: 0049F5C8
False, xrefs: 0049F5AE
%.15g, xrefs: 004698A6
True, xrefs: 0049F5A7

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 526d6ed179bd64109ecd0c7c5c065df69f9d7057ea221aa01b04e8df621d09e0
Instruction ID: 74ba5cad12adaae96cafba3cd470c9feecf3c7c3a7509883772121c40d06c162
Opcode Fuzzy Hash: 526d6ed179bd64109ecd0c7c5c065df69f9d7057ea221aa01b04e8df621d09e0
Instruction Fuzzy Hash: F5411531610205AEEB24EF35C842A7A77E8FF05314F20487FE449D7292FA799D468B1A

Function 004E7152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004E716A
CreateMenu.USER32 ref: 004E7185
SetMenu.USER32(?,00000000), ref: 004E7194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004E7221
IsMenu.USER32(?), ref: 004E7237
CreatePopupMenu.USER32 ref: 004E7241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004E726E
DrawMenuBar.USER32 ref: 004E7276

Strings

0, xrefs: 004E7160
F, xrefs: 004E7262

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 57785276cbb379afd17a6dfcf6b7305d5d648f7308c21b651b7ae6f764ccef97
Instruction ID: 6135db1a3584875d4f797a7cf0d8aa37108b99ae84b0e8c0e7d46359aaf17cfc
Opcode Fuzzy Hash: 57785276cbb379afd17a6dfcf6b7305d5d648f7308c21b651b7ae6f764ccef97
Instruction Fuzzy Hash: EC41BC74A01245EFDB20CF65E884EAABBF5FF09311F144069FA05AB362D735A914CF94

Function 004E74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 004E755E
CreateCompatibleDC.GDI32(00000000), ref: 004E7565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 004E7578
SelectObject.GDI32(00000000,00000000), ref: 004E7580
GetPixel.GDI32(00000000,00000000,00000000), ref: 004E758B
DeleteDC.GDI32(00000000), ref: 004E7594
GetWindowLongW.USER32(?,000000EC), ref: 004E759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 004E75B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 004E75BE

Strings

static, xrefs: 004E74F6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 1c7ba2c1cdcb43ad21f3e63ff51fe7a0503236c4ab61b8f61d314b2fb89bd92b
Instruction ID: b1d2fa93c445d95c13a7179ecb71c5faad9cb511d652cafae62cd332b7eca08a
Opcode Fuzzy Hash: 1c7ba2c1cdcb43ad21f3e63ff51fe7a0503236c4ab61b8f61d314b2fb89bd92b
Instruction Fuzzy Hash: 3A31AD32104294BBDF119F65DC48FEB3FA9FF09365F100226FA15A61A1C739E815DBA8

Function 00486E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00486E3E

Part of subcall function 00488B28: __getptd_noexit.LIBCMT ref: 00488B28

__gmtime64_s.LIBCMT ref: 00486ED7
__gmtime64_s.LIBCMT ref: 00486F0D
__gmtime64_s.LIBCMT ref: 00486F2A
__allrem.LIBCMT ref: 00486F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00486F9C
__allrem.LIBCMT ref: 00486FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00486FD1
__allrem.LIBCMT ref: 00486FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00487006
__invoke_watson.LIBCMT ref: 00487077

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 0a5fcfb9257d79aad6664d7cd26a84d5b2ab98b40db44e54702cb3c198d328b4
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: B2710476A00716ABDB14BE69DC41B6FB7A8AF05328F144A3FF514D7381E778D9008798

Function 004C2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C2542
GetMenuItemInfoW.USER32(00525890,000000FF,00000000,00000030), ref: 004C25A3
SetMenuItemInfoW.USER32(00525890,00000004,00000000,00000030), ref: 004C25D9
Sleep.KERNEL32(000001F4), ref: 004C25EB
GetMenuItemCount.USER32(?), ref: 004C262F
GetMenuItemID.USER32(?,00000000), ref: 004C264B
GetMenuItemID.USER32(?,-00000001), ref: 004C2675
GetMenuItemID.USER32(?,?), ref: 004C26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 004C2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004C2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004C2735

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 3027f9644e6f594ebd3ef407b52ea7802c556279e83fce80f9b33bd39a437823
Instruction ID: 57bd434192f9f1a69efdb147b0f60a83eacec3a06c01940e20a4636a0417134d
Opcode Fuzzy Hash: 3027f9644e6f594ebd3ef407b52ea7802c556279e83fce80f9b33bd39a437823
Instruction Fuzzy Hash: 4661A178900649AFDB51CF64CE88EBF7BB8EB41304F14046EE841A7251D7F9AD06DB25

Function 004E6F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 004E6FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 004E6FA8
GetWindowLongW.USER32(?,000000F0), ref: 004E6FCC
_memset.LIBCMT ref: 004E6FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004E6FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 004E7067

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 4ddca7656bc50f73eb1036ab016bf2f813342cc3259e6ca36873ee3b57d52e45
Instruction ID: 205f3c157feb12ff5fb54828ef777fb66bce13c95981e10905c8a8d3b4195a7a
Opcode Fuzzy Hash: 4ddca7656bc50f73eb1036ab016bf2f813342cc3259e6ca36873ee3b57d52e45
Instruction Fuzzy Hash: 31618971900288AFDB10DFA5CC81EEE77B8EF09710F14016AFA04AB3A1D774A946DB94

Function 004B6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 004B6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 004B6C18
VariantInit.OLEAUT32(?), ref: 004B6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 004B6C4A
VariantCopy.OLEAUT32(?,?), ref: 004B6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 004B6CB1
VariantClear.OLEAUT32(?), ref: 004B6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 004B6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 004B6CDC
VariantClear.OLEAUT32(?), ref: 004B6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 004B6CF9

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 92763cd14db13362346d73dd56534ebe6cbb55cd926f3c3be1fd7ce636f9d4be
Instruction ID: 84f1e59f2939a39e9ba864f4380601cba71a307a78b5b10646271def63c8a27d
Opcode Fuzzy Hash: 92763cd14db13362346d73dd56534ebe6cbb55cd926f3c3be1fd7ce636f9d4be
Instruction Fuzzy Hash: BA4184719001199FCF00DFA5D884DEEBBB9EF18304F01807AE955DB261DB38A949CBA4

Function 004D83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

CoInitialize.OLE32 ref: 004D8403
CoUninitialize.OLE32 ref: 004D840E
CoCreateInstance.OLE32(?,00000000,00000017,004F2BEC,?), ref: 004D846E
IIDFromString.OLE32(?,?), ref: 004D84E1
VariantInit.OLEAUT32(?), ref: 004D857B
VariantClear.OLEAUT32(?), ref: 004D85DC

Strings

NULL Pointer assignment, xrefs: 004D84B3
Failed to create object, xrefs: 004D8479, 004D852F
Invalid parameter, xrefs: 004D84FA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: b26c6e1b81a30e317a44d228060503598a5088eae1661733875b877a16180f5e
Instruction ID: 8fa8e6e29cf2813a62ad2d6ce509b364e87d760d1634a5d6c8db7d9974dd301d
Opcode Fuzzy Hash: b26c6e1b81a30e317a44d228060503598a5088eae1661733875b877a16180f5e
Instruction Fuzzy Hash: B3619A70608312AFC710DF15D8A8B6AB7E8AF45744F00481FF9819B391DB78ED49CB9A

Function 004D5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 004D5793
inet_addr.WSOCK32(?,?,?), ref: 004D57D8
gethostbyname.WSOCK32(?), ref: 004D57E4
IcmpCreateFile.IPHLPAPI ref: 004D57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 004D5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 004D5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 004D58ED
WSACleanup.WSOCK32 ref: 004D58F3

Strings

Ping, xrefs: 004D5816

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 071247b9cef9783ffbf557ea6bcd1915cee0c4b8a1605ad4c6ccfcc30363c465
Instruction ID: 6f801974d1beb056ddb2298342dbd9554cb89a30b0372954162845aee955dcc8
Opcode Fuzzy Hash: 071247b9cef9783ffbf557ea6bcd1915cee0c4b8a1605ad4c6ccfcc30363c465
Instruction Fuzzy Hash: 1951BE716006009FDB20AF25DC95B2ABBE4EF48714F04492BF956DB3A1DB78EC14DB4A

Function 004CB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004CB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 004CB546
GetLastError.KERNEL32 ref: 004CB550
SetErrorMode.KERNEL32(00000000,READY), ref: 004CB5BD

Strings

INVALID, xrefs: 004CB58F
READONLY, xrefs: 004CB588
READY, xrefs: 004CB596
UNKNOWN, xrefs: 004CB575
NOTREADY, xrefs: 004CB57C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: f6b8b1c7a999d955708e5977c64ffb4a32e53dff0fd495b74d5fa84439d3b86a
Instruction ID: 5af2983a62e0bc92b2476c124deabd9095186ba6108a3cc0adee553702f995b0
Opcode Fuzzy Hash: f6b8b1c7a999d955708e5977c64ffb4a32e53dff0fd495b74d5fa84439d3b86a
Instruction Fuzzy Hash: 5A31C679A00205EFDB50DB58C886FBE7BB4FF04308F10816FE50197291DB799946CB85

Function 004B8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004BAA99: GetClassNameW.USER32(?,?,000000FF), ref: 004BAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 004B9014
GetDlgCtrlID.USER32 ref: 004B901F
GetParent.USER32 ref: 004B903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 004B903E
GetDlgCtrlID.USER32(?), ref: 004B9047
GetParent.USER32(?), ref: 004B9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 004B9066

Strings

ComboBox, xrefs: 004B8F9C
ListBox, xrefs: 004B8FD1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 178cbecbbcc89cf29abe89175b44f19e317883fda013ab617580d501392106ac
Instruction ID: 7958a7b3fd494a3cd0252b98d997a5c01fd47e2218b624701f10c8b51e2515ba
Opcode Fuzzy Hash: 178cbecbbcc89cf29abe89175b44f19e317883fda013ab617580d501392106ac
Instruction Fuzzy Hash: 76210670A00148BBDF00ABB5CC85EFEBB74EF59310F00012AF961972A2DB394819DB39

Function 004B907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004BAA99: GetClassNameW.USER32(?,?,000000FF), ref: 004BAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 004B90FD
GetDlgCtrlID.USER32 ref: 004B9108
GetParent.USER32 ref: 004B9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 004B9127
GetDlgCtrlID.USER32(?), ref: 004B9130
GetParent.USER32(?), ref: 004B914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 004B914F

Strings

ComboBox, xrefs: 004B9087
ListBox, xrefs: 004B90BC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ead2db11572b2d90d2bcda88a07e74a4f3e88c19317e0f0edf7260a86fe2a7f4
Instruction ID: 48ce97f17db30b46417b4b9af4f4575a45534cbb068171f21b02f2ff2c81281c
Opcode Fuzzy Hash: ead2db11572b2d90d2bcda88a07e74a4f3e88c19317e0f0edf7260a86fe2a7f4
Instruction Fuzzy Hash: D921F874A00148BBDF00ABB5CC85EFEBB74EF58300F50402AB551972A2DB794859DB35

Function 004B9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 004B916F
GetClassNameW.USER32(00000000,?,00000100), ref: 004B9184
_wcscmp.LIBCMT ref: 004B9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 004B9211

Strings

details, xrefs: 004B91BF
smallicons, xrefs: 004B91D9
SHELLDLL_DefView, xrefs: 004B9190
largeicons, xrefs: 004B91A5
list, xrefs: 004B91F3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: a32efaff777ecf688d4e658630ebade7a033e9384cfe0aa312c87d965bac9c44
Instruction ID: 67140439e7de0f177c06f194dead5d601dbeb1d9bb88e8f6e2a4f3588db52ff1
Opcode Fuzzy Hash: a32efaff777ecf688d4e658630ebade7a033e9384cfe0aa312c87d965bac9c44
Instruction Fuzzy Hash: 40110D3A54831776FA153639DC06DF73B9CAB15720B200467FE00A41D2EEA95C55566C

Function 004C7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 004C7A6C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 34b2efeb57b01feb127a87b313f0ded3c9800bac0f85861abb85ec37d09586aa
Instruction ID: 30dfc9bbf0da00e0238516de802f9a2b6bd70eb1108a9d8331c328936b780278
Opcode Fuzzy Hash: 34b2efeb57b01feb127a87b313f0ded3c9800bac0f85861abb85ec37d09586aa
Instruction Fuzzy Hash: 05B1807990420A9FDB80DFA5C884FBEB7B4FF09325F24442EE501A7251D738A945CF99

Function 004C11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004C11F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,004C0268,?,00000001), ref: 004C1204
GetWindowThreadProcessId.USER32(00000000), ref: 004C120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004C0268,?,00000001), ref: 004C121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 004C122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004C0268,?,00000001), ref: 004C1245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,004C0268,?,00000001), ref: 004C1257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,004C0268,?,00000001), ref: 004C129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,004C0268,?,00000001), ref: 004C12B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,004C0268,?,00000001), ref: 004C12BC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 2948dcb522766a861bededb8be1d7a1580e2aeeda7b2aae0caf1cfa026b60000
Instruction ID: dadb81f96672c57145e18a73cb8578be5e2585104e3bbfabd8a14cdf0d4a48ee
Opcode Fuzzy Hash: 2948dcb522766a861bededb8be1d7a1580e2aeeda7b2aae0caf1cfa026b60000
Instruction Fuzzy Hash: F031F77D600204FFDF209F60ED84F6A37A9EF66311F10816AF801EA2B6D7789D459B58

Function 0046FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0046FAA6
OleUninitialize.OLE32(?,00000000), ref: 0046FB45
UnregisterHotKey.USER32(?), ref: 0046FC9C
DestroyWindow.USER32(?), ref: 004A45D6
FreeLibrary.KERNEL32(?), ref: 004A463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004A4668

Strings

close all, xrefs: 0046FAA1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: a9934247c4f2d92dc3235b92ce7220ff82c7d90337b787ca88c0a40852b69ccd
Instruction ID: 99b219d851763ca558b0bb961073597169e9945183216019f57760a1bf124a42
Opcode Fuzzy Hash: a9934247c4f2d92dc3235b92ce7220ff82c7d90337b787ca88c0a40852b69ccd
Instruction Fuzzy Hash: 1FA19070701212CFCB18EF15C594A6DF364BF96704F1042AEE84AAB251EB38AD1ACF59

Function 004D9113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004D9167
VariantInit.OLEAUT32(?), ref: 004D9238
VariantInit.OLEAUT32(?), ref: 004D9339
VariantClear.OLEAUT32(?), ref: 004D9343
VariantClear.OLEAUT32(?), ref: 004D93A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 004D91C8, 004D92F6, 004D93AE
Incorrect Object type in FOR..IN loop, xrefs: 004D931C
,,O, xrefs: 004D91E5

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,O$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-475619936
Opcode ID: ac1eb467674b7bf390d133c421d1bdf9db40c6af33c7a0f91300c807ed9cf2ae
Instruction ID: f9eb0c9806e8ae196573b6013b24475b658e417db0e5ef1cac3d78e44c75f654
Opcode Fuzzy Hash: ac1eb467674b7bf390d133c421d1bdf9db40c6af33c7a0f91300c807ed9cf2ae
Instruction Fuzzy Hash: 98918B71A00209ABDB24DFA1C858FAFBBB8AF49714F10855BE905EB380D7749D45CBA4

Function 004BA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,004BA439), ref: 004BA377

Strings

TEXT, xrefs: 004BA2AE
NAME, xrefs: 004BA1A9
REGEXPCLASS, xrefs: 004BA13C
CLASSNN, xrefs: 004BA119
INSTANCE, xrefs: 004BA285
CLASS, xrefs: 004BA0F6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 51715d5c8c4e19ec3f4993ec5e828298079fadc5ef8b0a0a893a21849986045e
Instruction ID: ca264b1805ccbb75f036f2295245504d59be6ff4fc7108066398c370da92408c
Opcode Fuzzy Hash: 51715d5c8c4e19ec3f4993ec5e828298079fadc5ef8b0a0a893a21849986045e
Instruction Fuzzy Hash: 8A91B830900605AADB08EF65C442BEEFBB4BF04304F54851FD859A7341DB3969ADDBA9

Function 00462E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00462EAE

Part of subcall function 00461DB3: GetClientRect.USER32(?,?), ref: 00461DDC
Part of subcall function 00461DB3: GetWindowRect.USER32(?,?), ref: 00461E1D
Part of subcall function 00461DB3: ScreenToClient.USER32(?,?), ref: 00461E45

GetDC.USER32 ref: 0049CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0049CD45
SelectObject.GDI32(00000000,00000000), ref: 0049CD53
SelectObject.GDI32(00000000,00000000), ref: 0049CD68
ReleaseDC.USER32(?,00000000), ref: 0049CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0049CDFB

Strings

U, xrefs: 0049CCD0

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 23b2d21576f4a703c767d20c8dc8653392df6c3ffbd556743c09ef81bc956055
Instruction ID: 1cb5e34de6f19802530a6a0dc34a290893a4097bc4e471a587fb78fb4e03053e
Opcode Fuzzy Hash: 23b2d21576f4a703c767d20c8dc8653392df6c3ffbd556743c09ef81bc956055
Instruction Fuzzy Hash: DB71EE31500205EFCF218F64C8C4AAB3FB5FF49324F14427BED5A5A2A6D7398842DB69

Function 004D1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004D1A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004D1A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 004D1ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 004D1AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004D1AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 004D1B10
InternetCloseHandle.WININET(00000000), ref: 004D1B57

Part of subcall function 004D2483: GetLastError.KERNEL32(?,?,004D1817,00000000,00000000,00000001), ref: 004D2498
Part of subcall function 004D2483: SetEvent.KERNEL32(?,?,004D1817,00000000,00000000,00000001), ref: 004D24AD

Strings

, xrefs: 004D1B01

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 8bd652adec4fcf2c2f495477f641265a5ad8c3f0adcf186cd39b8b0b4c4d0ecd
Instruction ID: 43cdfd7191a2b170862046f10cb9a78b6685debb6db0e0c7e6a1af530da68295
Opcode Fuzzy Hash: 8bd652adec4fcf2c2f495477f641265a5ad8c3f0adcf186cd39b8b0b4c4d0ecd
Instruction Fuzzy Hash: 8A4140B1501219BFEB119F50CC99FBB77ACEB08354F00412BFE059A351E7789E449BA9

Function 004D8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,004EF910), ref: 004D8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,004EF910), ref: 004D8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 004D8ED6
SysFreeString.OLEAUT32(?), ref: 004D8F00

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 4a678f9bbeb7da6827eb7d42d734dcb14ad267f45b9d16396498522be0f33adc
Instruction ID: cec29a70368bc03f6551bcd00c4461924fe211928e5ff2f4496b5ab36a059b82
Opcode Fuzzy Hash: 4a678f9bbeb7da6827eb7d42d734dcb14ad267f45b9d16396498522be0f33adc
Instruction Fuzzy Hash: E3F16771A00209EFCF04DF94C894EAEB7B9FF49314F10809AF905AB251DB35AE46CB64

Function 004DF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004DF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004DF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 004DF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004DF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 004DF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004DFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 004DFA7C
CloseHandle.KERNEL32(?), ref: 004DFAAB
CloseHandle.KERNEL32(?), ref: 004DFB22

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: e843be3f9f0fb8ab69d2262eab090946cb0da32397a22b12d4983b5488c16de9
Instruction ID: ca928bb6e616c914caa2cda422a6ff86e71e7ff0425910b8878b33c268195cf1
Opcode Fuzzy Hash: e843be3f9f0fb8ab69d2262eab090946cb0da32397a22b12d4983b5488c16de9
Instruction Fuzzy Hash: 6FE1B3716042409FC724EF25C491B6ABBE4AF85314F14856FF8864B3A2DB78EC49CB5A

Function 004C4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004C466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,004C3697,?), ref: 004C468B

Part of subcall function 004C466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,004C3697,?), ref: 004C46A4

Part of subcall function 004C4A31: GetFileAttributesW.KERNEL32(?,004C370B), ref: 004C4A32

lstrcmpiW.KERNEL32(?,?), ref: 004C4D40
_wcscmp.LIBCMT ref: 004C4D5A
MoveFileW.KERNEL32(?,?), ref: 004C4D75

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 3d2a62df592a94028859127f3a3cf4e86dd24c2562aa126da425776a58e634b4
Instruction ID: 8aec150a139b1cccf84dd717242980c37940661679f729673e1e65e8c6c1d36a
Opcode Fuzzy Hash: 3d2a62df592a94028859127f3a3cf4e86dd24c2562aa126da425776a58e634b4
Instruction Fuzzy Hash: F95152B60083859BC764EB61D991EDF73ECAF84314F000D2FB585D3151EE78A588C76A

Function 004E8645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 004E86FF

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: ac21001e5715f63c5532d6fdfca05f354da5eb18a2bb9d5080e80b4a58e7b5f7
Instruction ID: 19f72f6f42a9f343b981142e2ba549fa9200d107f70c658a3178b1a0436139a3
Opcode Fuzzy Hash: ac21001e5715f63c5532d6fdfca05f354da5eb18a2bb9d5080e80b4a58e7b5f7
Instruction Fuzzy Hash: 9551A4305002C4BEDF209B268C85F6E7B64FB05316F60452FF959EA2E1DF79A980DB49

Function 00462B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0049C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0049C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0049C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0049C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0049C370
DestroyIcon.USER32(00000000), ref: 0049C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0049C39C
DestroyIcon.USER32(?), ref: 0049C3AB

Part of subcall function 004EA4AF: DeleteObject.GDI32(00000000), ref: 004EA4E8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ece7944026088de06ee52400c08240d0fdb7663d490c4a73f7844db0420ce9b1
Instruction ID: 59174bc02d8d0022afa0a996a05fc364d9ad76bf40eab92fcf7c06c63627278e
Opcode Fuzzy Hash: ece7944026088de06ee52400c08240d0fdb7663d490c4a73f7844db0420ce9b1
Instruction Fuzzy Hash: 3A517B70A00605AFDB20DF25CD85FAB3BA5EB58710F10452AF9029B290E7B8ED91DB59

Function 004B966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 004BA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 004BA84C
Part of subcall function 004BA82C: GetCurrentThreadId.KERNEL32 ref: 004BA853
Part of subcall function 004BA82C: AttachThreadInput.USER32(00000000,?,004B9683,?,00000001), ref: 004BA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 004B968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 004B96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 004B96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 004B96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 004B96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 004B96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 004B96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 004B96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 004B96FB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: f8239c44a7b78b83fd1e2ee85f1f8bce9745fa0c8e10359a068f31a2d7a9682c
Instruction ID: 4e9037ab311b376391186210ca018da55fd06c02d185e4e9e113121679c55ddf
Opcode Fuzzy Hash: f8239c44a7b78b83fd1e2ee85f1f8bce9745fa0c8e10359a068f31a2d7a9682c
Instruction Fuzzy Hash: AB11CEB1910618BFFA106B719C89FAA7F2DEB4C754F10042AF244AB0E1C9F25C119AB8

Function 004B8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,004B853C,00000B00,?,?), ref: 004B892A
HeapAlloc.KERNEL32(00000000,?,004B853C,00000B00,?,?), ref: 004B8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,004B853C,00000B00,?,?), ref: 004B8946
GetCurrentProcess.KERNEL32(?,00000000,?,004B853C,00000B00,?,?), ref: 004B894E
DuplicateHandle.KERNEL32(00000000,?,004B853C,00000B00,?,?), ref: 004B8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,004B853C,00000B00,?,?), ref: 004B8961
GetCurrentProcess.KERNEL32(004B853C,00000000,?,004B853C,00000B00,?,?), ref: 004B8969
DuplicateHandle.KERNEL32(00000000,?,004B853C,00000B00,?,?), ref: 004B896C
CreateThread.KERNEL32(00000000,00000000,004B8992,00000000,00000000,00000000), ref: 004B8986

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 38a3388b631956ea606f0a4d6107268ed7e5ada3f5fb0dc3ebc1bfe6c9418306
Instruction ID: 9a4603c75a27cb89b03f59356bbf49455d53a030c7b78e6938fd55696705ef5f
Opcode Fuzzy Hash: 38a3388b631956ea606f0a4d6107268ed7e5ada3f5fb0dc3ebc1bfe6c9418306
Instruction Fuzzy Hash: F601A8B5240348FFE610ABA5DC89F6B7BACEB89711F418421FA05DF1A2CA759C04CA24

Function 004D9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 004D9B7B
NULL Pointer assignment, xrefs: 004D9BA4, 004D9EC8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 176a6f8a4da9830a8c932789ca903394811dc2712c8501db6f5534b87b76e8fe
Instruction ID: a3da299d61862c3c19e2f14ccaee8af1dcd1907c38b0f60f21d9d701ff92de6d
Opcode Fuzzy Hash: 176a6f8a4da9830a8c932789ca903394811dc2712c8501db6f5534b87b76e8fe
Instruction Fuzzy Hash: 08C1A171A00219ABDF10DF98C894BAEB7F5FB48314F14842BE905EB381E774AD45CB94

Function 004D975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 004B710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?,?,004B7455), ref: 004B7127
Part of subcall function 004B710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?), ref: 004B7142
Part of subcall function 004B710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?), ref: 004B7150
Part of subcall function 004B710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?), ref: 004B7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 004D9806
_memset.LIBCMT ref: 004D9813
_memset.LIBCMT ref: 004D9956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 004D9982
CoTaskMemFree.OLE32(?), ref: 004D998D

Strings

NULL Pointer assignment, xrefs: 004D99DB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: a39f5e473b03ab863a640000b543364221a1b2c7a391a0566deff8327d66a41d
Instruction ID: 4659c35a4252643294526665b526813015be3e60022b1b5cfcdd1cb5a5fcd8bf
Opcode Fuzzy Hash: a39f5e473b03ab863a640000b543364221a1b2c7a391a0566deff8327d66a41d
Instruction Fuzzy Hash: 4A913871D00229EBDB10DFA5DC90EDEBBB9BF08314F10416AF419A7281EB759A44CFA5

Function 004E6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 004E6E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 004E6E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 004E6E52
_wcscat.LIBCMT ref: 004E6EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 004E6EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 004E6EF2

Strings

SysListView32, xrefs: 004E6DF6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: ed7ebedfc854c814c0d41cc6fccf94bf06892fc3356af21f678c750d86dfb11d
Instruction ID: 667a33198e76f11d1bb5db8dc67940fba9c26fd4406127b93c07996c0618eb44
Opcode Fuzzy Hash: ed7ebedfc854c814c0d41cc6fccf94bf06892fc3356af21f678c750d86dfb11d
Instruction Fuzzy Hash: DB41E470A00388ABDB219F65CC85FEF77E8EF18395F11042AF584E72D2D2759D848B58

Function 004DE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 004C3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 004C3C7A
Part of subcall function 004C3C55: Process32FirstW.KERNEL32(00000000,?), ref: 004C3C88
Part of subcall function 004C3C55: CloseHandle.KERNEL32(00000000), ref: 004C3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 004DE9A4
GetLastError.KERNEL32 ref: 004DE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004DE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 004DEA63
GetLastError.KERNEL32(00000000), ref: 004DEA6E
CloseHandle.KERNEL32(00000000), ref: 004DEAA3

Strings

SeDebugPrivilege, xrefs: 004DE9C2

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 3950df17753bc20fa21adfacaff545198025b5df933908ea884fdab4c460d8e5
Instruction ID: f53822e015ecca1dbc603d44142d6939ced26ab80c388c7e1162a18931533c9a
Opcode Fuzzy Hash: 3950df17753bc20fa21adfacaff545198025b5df933908ea884fdab4c460d8e5
Instruction Fuzzy Hash: 26417BB12002019FDB14EF55CCA5B6EB7A5AF40318F04845EF9065F3D2DBB8AC08CB9A

Function 004C2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 004C3033

Strings

warning, xrefs: 004C301C
blank, xrefs: 004C2FB5
info, xrefs: 004C2FD4
question, xrefs: 004C2FEC
stop, xrefs: 004C3004

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: c6576096792d67134ad24a751741b7caadf54c6910745277e76d988fa20461a4
Instruction ID: fb6fe63d9bfe88f51df3871d958b2cc8e9a4cb1af16601bd65057d55ac9253e9
Opcode Fuzzy Hash: c6576096792d67134ad24a751741b7caadf54c6910745277e76d988fa20461a4
Instruction Fuzzy Hash: 39116B3A248346BAE7545E16DC82EBF3B9CEF15321B10402FF90066281DAB85F4056AD

Function 004C42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 004C4312
LoadStringW.USER32(00000000), ref: 004C4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 004C432F
LoadStringW.USER32(00000000), ref: 004C4336
_wprintf.LIBCMT ref: 004C435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 004C437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 004C4357

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: df0999d7939969b76fe561a0426814fa3d86c758d03acca12279969198660491
Instruction ID: cf26045aaf2b18f558fe6fd7d2300972e07d903c8ddefb12d50671628f2feaa7
Opcode Fuzzy Hash: df0999d7939969b76fe561a0426814fa3d86c758d03acca12279969198660491
Instruction Fuzzy Hash: 200184F6900248BFE751ABA0DD89FE6776CE708301F0005B6BB45E6012EA345E894B78

Function 004ED43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

GetSystemMetrics.USER32(0000000F), ref: 004ED47C
GetSystemMetrics.USER32(0000000F), ref: 004ED49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 004ED6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 004ED6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 004ED716
ShowWindow.USER32(00000003,00000000), ref: 004ED735
InvalidateRect.USER32(?,00000000,00000001), ref: 004ED75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 004ED77D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 8e9b39f8046cbe4a90293556e65b669dfec64564b40322c099648af8a44d5425
Instruction ID: 5ea72ffe5b58ce2724af90143ed6829d40e378baa1061bdd106edbcd6d35f335
Opcode Fuzzy Hash: 8e9b39f8046cbe4a90293556e65b669dfec64564b40322c099648af8a44d5425
Instruction Fuzzy Hash: DFB18975A00265EBDF14CF6AC9C57AE7BB1BF04702F08806AEC489E295D738A954CB94

Function 00462A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0049C1C7,00000004,00000000,00000000,00000000), ref: 00462ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0049C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00462B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0049C1C7,00000004,00000000,00000000,00000000), ref: 0049C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0049C1C7,00000004,00000000,00000000,00000000), ref: 0049C286

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 536c7d909cf74f4cc4762b2804c889bc524a9c86462099b43d8d837be6cb247a
Instruction ID: 865a69dec0fd2d863402517c84289fe878549e1983cbdc489f5b40c4127ab694
Opcode Fuzzy Hash: 536c7d909cf74f4cc4762b2804c889bc524a9c86462099b43d8d837be6cb247a
Instruction Fuzzy Hash: 91412F30604FC0BACF758B688EC876B7B91AB45300F14852FE04746661E6FCA846E71F

Function 004C70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 004C70DD

Part of subcall function 00480DB6: std::exception::exception.LIBCMT ref: 00480DEC
Part of subcall function 00480DB6: __CxxThrowException@8.LIBCMT ref: 00480E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 004C7114
EnterCriticalSection.KERNEL32(?), ref: 004C7130
_memmove.LIBCMT ref: 004C717E
_memmove.LIBCMT ref: 004C719B
LeaveCriticalSection.KERNEL32(?), ref: 004C71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 004C71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 004C71DE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 373b22753d0b743ad665189db91fc8b1e1890a54f1c2ab27c07b4abd135e1ea5
Instruction ID: 7c3aeacf269e004d09cac0c2e06a8bab8493b19663bbf9e682b77556c169437b
Opcode Fuzzy Hash: 373b22753d0b743ad665189db91fc8b1e1890a54f1c2ab27c07b4abd135e1ea5
Instruction Fuzzy Hash: 80316F35900205EBCB40EFA5DC85AAFB7B8EF45310B1485BAE9049B256DB349E14CB68

Function 004E61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 004E61EB
GetDC.USER32(00000000), ref: 004E61F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004E61FE
ReleaseDC.USER32(00000000,00000000), ref: 004E620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 004E6246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 004E6257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,004E902A,?,?,000000FF,00000000,?,000000FF,?), ref: 004E6291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 004E62B1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d18bcd7e28ffba3e159ebc0599240f3163988a1baee02a6e61413c79bf147f56
Instruction ID: c0212cb30ceee024ac40717bb65a41e2886010fe5d7bdce18abae11f22d9c115
Opcode Fuzzy Hash: d18bcd7e28ffba3e159ebc0599240f3163988a1baee02a6e61413c79bf147f56
Instruction Fuzzy Hash: 15318D72101250BFEF118F61CC8AFEB3BA9EF59765F054065FE089E292C6759C41CB68

Function 004CEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

Part of subcall function 0047FC86: _wcscpy.LIBCMT ref: 0047FCA9

_wcstok.LIBCMT ref: 004CEC94
_wcscpy.LIBCMT ref: 004CED23
_memset.LIBCMT ref: 004CED56

Strings

X, xrefs: 004CED93

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: fedeaa3f954fa7a1fe721fb983898aa1b099bbba100ab2b79d8dc634d27a4936
Instruction ID: 21422584481da6e231704fff127195805f642d685a3c04902251e654a8b0bc67
Opcode Fuzzy Hash: fedeaa3f954fa7a1fe721fb983898aa1b099bbba100ab2b79d8dc634d27a4936
Instruction Fuzzy Hash: 7AC171755083419FC754EF25C481E6AB7E4BF45318F00492EF8999B2A2EB78EC45CB4B

Function 004D6B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 004D6C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 004D6C21
WSAGetLastError.WSOCK32(00000000), ref: 004D6C34
htons.WSOCK32(?,?,?,00000000,?), ref: 004D6CEA
inet_ntoa.WSOCK32(?), ref: 004D6CA7

Part of subcall function 004BA7E9: _strlen.LIBCMT ref: 004BA7F3
Part of subcall function 004BA7E9: _memmove.LIBCMT ref: 004BA815

_strlen.LIBCMT ref: 004D6D44
_memmove.LIBCMT ref: 004D6DAD

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: aefbd6f60e75b50a79578f452e7529ca0e921091b0a16ca7becac1bd43c5a66d
Instruction ID: d59626ef6a596fafd365ec94bf24dbbdb928d1b6efa79193eba72b1b6bb84865
Opcode Fuzzy Hash: aefbd6f60e75b50a79578f452e7529ca0e921091b0a16ca7becac1bd43c5a66d
Instruction Fuzzy Hash: 0C811271204300ABC710EB25DC92E6BB7A9AF94718F00491FF9459B392EB78ED05CB5A

Function 00461424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 037bbbf9fd922ab90dcc49dfe7972211a42a8e6631d2993b2aa6a8b80edabf6b
Instruction ID: 18e3549c3a2963fc66f67e66f1b5de31a07efad2648441500f0fe87b1ad82ff1
Opcode Fuzzy Hash: 037bbbf9fd922ab90dcc49dfe7972211a42a8e6631d2993b2aa6a8b80edabf6b
Instruction Fuzzy Hash: D2715E30900109EFDB04CF99CC85ABFBB75FF85314F14815AF915AB261D738AA51CBAA

Function 004EB351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01766658), ref: 004EB3EB
IsWindowEnabled.USER32(01766658), ref: 004EB3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 004EB4DB
SendMessageW.USER32(01766658,000000B0,?,?), ref: 004EB512
IsDlgButtonChecked.USER32(?,?), ref: 004EB54F
GetWindowLongW.USER32(01766658,000000EC), ref: 004EB571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 004EB589

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 0cb679290036472cd5c83ff2ef5c4328a729f3a5a2e83de7372452b7edcb8dd5
Instruction ID: 82f04fe36002c6ff85ad0b9ee657cc6e8d29976fda510668f07a6a25d0a99afa
Opcode Fuzzy Hash: 0cb679290036472cd5c83ff2ef5c4328a729f3a5a2e83de7372452b7edcb8dd5
Instruction Fuzzy Hash: C871BD34600684AFDB219F66C8D1FBB7BA9FF09301F14406AE941973A2C739AD41CB99

Function 004DF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004DF448
_memset.LIBCMT ref: 004DF511
ShellExecuteExW.SHELL32(?), ref: 004DF556

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

Part of subcall function 0047FC86: _wcscpy.LIBCMT ref: 0047FCA9

GetProcessId.KERNEL32(00000000), ref: 004DF5CD
CloseHandle.KERNEL32(00000000), ref: 004DF5FC

Strings

@, xrefs: 004DF525

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 4aed45671f14fe59b6619d3c862c0468466ff1ec6ada9b34b48f1efdeba2f88e
Instruction ID: 30c9272372f9cc46de85fb81808ce835f9f07d2f8907369b35a5991aebaeffec
Opcode Fuzzy Hash: 4aed45671f14fe59b6619d3c862c0468466ff1ec6ada9b34b48f1efdeba2f88e
Instruction Fuzzy Hash: 12619CB4A00619DFCB14EF95C4909AEBBB4FF49314F14806EE816AB351DB38AD45CB89

Function 004C0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 004C0F8C
GetKeyboardState.USER32(?), ref: 004C0FA1
SetKeyboardState.USER32(?), ref: 004C1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 004C1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 004C104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 004C1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 004C10B8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 08d4a35c794cdd16f8f38232b9f37bf2c5bd8d8d2019646ff9fb4ac2c4ce274c
Instruction ID: e10fd16a3bd0629a72287b871bcc09ef3cb64edc28ec423a389e6e18b9c78f5c
Opcode Fuzzy Hash: 08d4a35c794cdd16f8f38232b9f37bf2c5bd8d8d2019646ff9fb4ac2c4ce274c
Instruction Fuzzy Hash: 1F51FFA85046D179FB7242348C15FBBBEA96B07304F08858EE1D4869E3C2DCACC8D759

Function 004C0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 004C0DA5
GetKeyboardState.USER32(?), ref: 004C0DBA
SetKeyboardState.USER32(?), ref: 004C0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 004C0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 004C0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 004C0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 004C0EC9

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 70454d01ecf2926c44a49265120c5c16bf25cf1fb36737440eed1ff563591641
Instruction ID: 50c0f6dcf81d38d42e60060ab18ae20d1fe536ffe88da3b7b2f739d502e6af0e
Opcode Fuzzy Hash: 70454d01ecf2926c44a49265120c5c16bf25cf1fb36737440eed1ff563591641
Instruction Fuzzy Hash: E55126A85447D5BDFB7283748C55F7B7FA95B06300F08888EE1D55A9C3C399AC88D368

Function 004C55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 004C560A
_wcsncpy.LIBCMT ref: 004C563F
_wcsncpy.LIBCMT ref: 004C5671
_wcsncpy.LIBCMT ref: 004C56A4
_wcsncpy.LIBCMT ref: 004C56E6
_wcsncpy.LIBCMT ref: 004C5720
_wcsncpy.LIBCMT ref: 004C574F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 8a62223e72cc5c46d97dceaad8f0e806e744cb8d76f437a25a75b2ae0d7670f5
Instruction ID: ec53bfa4d84849d7c2be3fba0fc4e74ca893383005f397c0e42d7e11800e3e7e
Opcode Fuzzy Hash: 8a62223e72cc5c46d97dceaad8f0e806e744cb8d76f437a25a75b2ae0d7670f5
Instruction Fuzzy Hash: 55418165C1161476CB11FFB58846ACFB3B8AF05310F508D5BE908E3221EA38F685C7AE

Function 004BD56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 004BD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 004BD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 004BD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 004BD69D

Strings

DllGetClassObject, xrefs: 004BD610
,,O, xrefs: 004BD578

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,O$DllGetClassObject
API String ID: 753597075-4186158689
Opcode ID: 12dfb6ee88a68103f75e5d12f5098ef0114c23b53c2165b867b444a2e9c4a99d
Instruction ID: a2ce1d6e7254925a2827e5a7e61eb790c5e7b17065c94bcb08792ddad63ad43b
Opcode Fuzzy Hash: 12dfb6ee88a68103f75e5d12f5098ef0114c23b53c2165b867b444a2e9c4a99d
Instruction Fuzzy Hash: 7B4193B5A00204DFDB05CF54C884ADA7BA9EF44314F1181EEED099F205E7B9DD44CBA8

Function 004C3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 004C466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,004C3697,?), ref: 004C468B

Part of subcall function 004C466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,004C3697,?), ref: 004C46A4

lstrcmpiW.KERNEL32(?,?), ref: 004C36B7
_wcscmp.LIBCMT ref: 004C36D3
MoveFileW.KERNEL32(?,?), ref: 004C36EB
_wcscat.LIBCMT ref: 004C3733
SHFileOperationW.SHELL32(?), ref: 004C379F

Strings

\*.*, xrefs: 004C372D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a143678074e5af2f5743b635868232164338566aa120c390b9e3805ee3febb21
Instruction ID: 69710f22cfc6ae3b61c109427de20561095da5fe19b269f0ce93b817144f07d2
Opcode Fuzzy Hash: a143678074e5af2f5743b635868232164338566aa120c390b9e3805ee3febb21
Instruction Fuzzy Hash: 364191B5208344AEC7A1EF65C451EEF77E8AF88344F00482FB499C3251EA38D689C75A

Function 004E7291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004E72AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004E7351
IsMenu.USER32(?), ref: 004E7369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 004E73B1
DrawMenuBar.USER32 ref: 004E73C4

Strings

0, xrefs: 004E729E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 2f00d49de63a393f9636dfdb850f0a1a887284d30e862a13c933b705827ad0a4
Instruction ID: 41a463f57f096566a6c536413960c6035b4ca8bf739abfc97dc86440028bbc97
Opcode Fuzzy Hash: 2f00d49de63a393f9636dfdb850f0a1a887284d30e862a13c933b705827ad0a4
Instruction Fuzzy Hash: D0413575A00289EFDB20DF51D884AAABBF8FF05321F14846AFD05AB351D734AD14EB64

Function 004E0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 004E0FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004E0FFE
FreeLibrary.KERNEL32(00000000), ref: 004E10B5

Part of subcall function 004E0FA5: RegCloseKey.ADVAPI32(?), ref: 004E101B
Part of subcall function 004E0FA5: FreeLibrary.KERNEL32(?), ref: 004E106D
Part of subcall function 004E0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 004E1090

RegDeleteKeyW.ADVAPI32(?,?), ref: 004E1058

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: f723670ea567fcd6b66d8609b941dc39c16f6c6c27728fa4359e4cba31d1c275
Instruction ID: 26846fa2e8e862ae1891934fe88f365b03ed64dc570f10e119b814114527afb5
Opcode Fuzzy Hash: f723670ea567fcd6b66d8609b941dc39c16f6c6c27728fa4359e4cba31d1c275
Instruction Fuzzy Hash: 41314D71900149BFDB14DF91DC89EFFB7BCEF08311F00017AE512A2251EA749E899AA8

Function 004E62CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 004E62EC
GetWindowLongW.USER32(01766658,000000F0), ref: 004E631F
GetWindowLongW.USER32(01766658,000000F0), ref: 004E6354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 004E6386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 004E63B0
GetWindowLongW.USER32(00000000,000000F0), ref: 004E63C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 004E63DB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 78aebc452902f19e70e57c57a944deed78a2c1232331f539e6b27e2b62e4b64c
Instruction ID: 353d317c066699744574ad2ccd05b80cc5f265971dd76498e5fde2b872a6c800
Opcode Fuzzy Hash: 78aebc452902f19e70e57c57a944deed78a2c1232331f539e6b27e2b62e4b64c
Instruction Fuzzy Hash: DE3138306402809FDB20CF2ADC84F5937E1FB6A755F2A01A5F910CF2B2CB75AC459B59

Function 004BDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004BDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004BDB54
SysAllocString.OLEAUT32(00000000), ref: 004BDB57
SysAllocString.OLEAUT32(?), ref: 004BDB75
SysFreeString.OLEAUT32(?), ref: 004BDB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 004BDBA3
SysAllocString.OLEAUT32(?), ref: 004BDBB1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1c68cf58a3f648cbb6469c926a1f9e653fd26996558ced9211c681ff02ec240b
Instruction ID: 9657dbc38d73a21723333489fe8e63aad0ac44f89a40282e5496a55ee06d8a6d
Opcode Fuzzy Hash: 1c68cf58a3f648cbb6469c926a1f9e653fd26996558ced9211c681ff02ec240b
Instruction Fuzzy Hash: 82217136A04219AF9B10EFA9DC84CFB73ACEF09360B018576F914DB291E674AD458768

Function 004D6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004D7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 004D7DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 004D61C6
WSAGetLastError.WSOCK32(00000000), ref: 004D61D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 004D620E
connect.WSOCK32(00000000,?,00000010), ref: 004D6217
WSAGetLastError.WSOCK32 ref: 004D6221
closesocket.WSOCK32(00000000), ref: 004D624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 004D6263

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 1b0289f85ab178e8cb0828d5c5e4c135fbef07c4ec8e9215700bc8ee9b0f64c7
Instruction ID: 6a26d2e71c148f8270b211f73368e31eb00c44e8f1927248429ccf8fdcde244e
Opcode Fuzzy Hash: 1b0289f85ab178e8cb0828d5c5e4c135fbef07c4ec8e9215700bc8ee9b0f64c7
Instruction Fuzzy Hash: A231C471600104ABEF10AF64CC95BBE77ADEB45714F05406BFD059B392DB78AC088BAA

Function 004BF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 004BF671
__wcsnicmp.LIBCMT ref: 004BF692
__wcsnicmp.LIBCMT ref: 004BF6AC

Strings

#notrayicon, xrefs: 004BF669
#requireadmin, xrefs: 004BF68C
#OnAutoItStartRegister, xrefs: 004BF6A6

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: ff8c667362f388401b3a35698e753c7b4b5dc341be884f97465a54cb6c97a1a7
Instruction ID: 8d2568051f5a05be2ac379e4c0cddf0eea98f15afea5d05aafefa6190d6ee95f
Opcode Fuzzy Hash: ff8c667362f388401b3a35698e753c7b4b5dc341be884f97465a54cb6c97a1a7
Instruction Fuzzy Hash: 3121457220411166D220BA35AC02FFB7398EF55704B50443BFD4986151EB9C9E4BC3AE

Function 004BDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004BDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 004BDC2F
SysAllocString.OLEAUT32(00000000), ref: 004BDC32
SysAllocString.OLEAUT32 ref: 004BDC53
SysFreeString.OLEAUT32 ref: 004BDC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 004BDC76
SysAllocString.OLEAUT32(?), ref: 004BDC84

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c2f5cb5752e607bddf2e100210ecc1eacf17de776876df5315ae45e17cf0d81d
Instruction ID: a177ad721f1c794f22998d928cb0d6023ddf0f870c6810dc8894ea86bd05822a
Opcode Fuzzy Hash: c2f5cb5752e607bddf2e100210ecc1eacf17de776876df5315ae45e17cf0d81d
Instruction Fuzzy Hash: 4F214435604245AFAB10EFA8DC88DBB77ECEB09360B108576F914CB2A1E674ED45C778

Function 004E75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00461D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00461D73
Part of subcall function 00461D35: GetStockObject.GDI32(00000011), ref: 00461D87
Part of subcall function 00461D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00461D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 004E7632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 004E763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004E764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 004E7659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 004E7665

Strings

Msctls_Progress32, xrefs: 004E7603

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 54ffae8a088fd9bdc1b69eff689b544a5f182a3617160b91389f377c5483d420
Instruction ID: 1a7666b2f7e16839d2bb0043b20a72852a64f8463156df0c5945efd21670760c
Opcode Fuzzy Hash: 54ffae8a088fd9bdc1b69eff689b544a5f182a3617160b91389f377c5483d420
Instruction Fuzzy Hash: 4911B6B1150119BFEF118F65CC85EE77F5DEF087A8F014115F604A6060C7769C21DBA4

Function 00489AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00489AE6

Part of subcall function 00483187: EncodePointer.KERNEL32(00000000), ref: 0048318A
Part of subcall function 00483187: __initp_misc_winsig.LIBCMT ref: 004831A5
Part of subcall function 00483187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00489EA0
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00489EB4
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00489EC7
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00489EDA
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00489EED
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00489F00
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00489F13
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00489F26
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00489F39
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00489F4C
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00489F5F
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00489F72
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00489F85
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00489F98
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00489FAB
Part of subcall function 00483187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00489FBE

__mtinitlocks.LIBCMT ref: 00489AEB
__mtterm.LIBCMT ref: 00489AF4

Part of subcall function 00489B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00489AF9,00487CD0,0051A0B8,00000014), ref: 00489C56
Part of subcall function 00489B5C: _free.LIBCMT ref: 00489C5D
Part of subcall function 00489B5C: DeleteCriticalSection.KERNEL32(02R,?,?,00489AF9,00487CD0,0051A0B8,00000014), ref: 00489C7F

__calloc_crt.LIBCMT ref: 00489B19
__initptd.LIBCMT ref: 00489B3B
GetCurrentThreadId.KERNEL32 ref: 00489B42

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: a7143e476e2923641d5d9b0e04988a74cafb6a96292ad6ae06294d9f15118bc3
Instruction ID: 2ec730a81046df17897a4453a7f8534a018b12cc862970ce30e63cfa6c4cbd18
Opcode Fuzzy Hash: a7143e476e2923641d5d9b0e04988a74cafb6a96292ad6ae06294d9f15118bc3
Instruction Fuzzy Hash: 1DF06232519F515AE6647B767C076AF2690AB02738B284E1FF850961D2EE289C41536C

Function 004EB635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004EB644
_memset.LIBCMT ref: 004EB653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00526F20,00526F64), ref: 004EB682
CloseHandle.KERNEL32 ref: 004EB694

Strings

oR, xrefs: 004EB63E
doR, xrefs: 004EB64D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: oR$doR
API String ID: 3277943733-3996048355
Opcode ID: dff232706f15b89e70c39d204ee4028f9adf7b1a3f22f219357e52a762377a76
Instruction ID: 417c5ba6026f7d0dbab7cc5c8d29d09da18d05d41959bf6ff41394ef7d62cfb0
Opcode Fuzzy Hash: dff232706f15b89e70c39d204ee4028f9adf7b1a3f22f219357e52a762377a76
Instruction Fuzzy Hash: 2DF05EB2540350BAEA202761BD46FBB3EDCEF1A395F004431BA08E919AD7755C05D7AC

Function 0048406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00483F85), ref: 00484085
GetProcAddress.KERNEL32(00000000), ref: 0048408C
EncodePointer.KERNEL32(00000000), ref: 00484097
DecodePointer.KERNEL32(00483F85), ref: 004840B2

Strings

RoUninitialize, xrefs: 00484074
combase.dll, xrefs: 00484080

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: a65455f908b116bee389d4fd095fb88f36ca87715d79e7e429b7c4494754b9ed
Instruction ID: 273891770114f95f487afb2070187a96f40a06646400edfa633d569355ea6dd5
Opcode Fuzzy Hash: a65455f908b116bee389d4fd095fb88f36ca87715d79e7e429b7c4494754b9ed
Instruction Fuzzy Hash: 46E04F70641300DFDB20AF60ED4DB163AA4BB15742F104435F601D51A1CBBF461DEB0C

Function 004C64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004C660B
_memmove.LIBCMT ref: 004C6546

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

_memmove.LIBCMT ref: 004C65B9
_memmove.LIBCMT ref: 004C66A0
_memmove.LIBCMT ref: 004C66B9
_memmove.LIBCMT ref: 004C66D5

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
Instruction ID: a78142c6743131b3174a488ac6869760dcfd82321319f09ccf5f3c0922bca115
Opcode Fuzzy Hash: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
Instruction Fuzzy Hash: A5618D3460065A9BCF41FF61C881FFE37A9AF0530CF05491EF8555B292EA78AC06CB5A

Function 004E01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004E0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DFDAD,?,?), ref: 004E0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004E02BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004E02FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 004E0320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 004E0349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 004E038C
RegCloseKey.ADVAPI32(00000000), ref: 004E0399

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: c79bdb289674ad2963aac521d76326f0b7adfac401261225d68ff6ac868a0abe
Instruction ID: 4b9bae30ae88b8e4c728ec0aa4db892bb4f1a68e1090316550fd938c166fd775
Opcode Fuzzy Hash: c79bdb289674ad2963aac521d76326f0b7adfac401261225d68ff6ac868a0abe
Instruction Fuzzy Hash: 65517F711082409FC710EF55C885E6FBBE8FF84318F04491EF955872A2DB75D949CB56

Function 004E5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 004E57FB
GetMenuItemCount.USER32(00000000), ref: 004E5832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 004E585A
GetMenuItemID.USER32(?,?), ref: 004E58C9
GetSubMenu.USER32(?,?), ref: 004E58D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 004E5928

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: d342f187be09a8d3a3a6986d972ef4038da3bffd6ee2003f5db4c28451e635c0
Instruction ID: ef45db0524ccbd52a3f10caafee795ea4e81b1414b1816fc767f0d0d31ae4a1d
Opcode Fuzzy Hash: d342f187be09a8d3a3a6986d972ef4038da3bffd6ee2003f5db4c28451e635c0
Instruction Fuzzy Hash: 5D517D75E00615EFCF10EF66C845AAEB7B4FF48315F10406AE801BB352DB78AE418B99

Function 004BEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004BEF06
VariantClear.OLEAUT32(00000013), ref: 004BEF78
VariantClear.OLEAUT32(00000000), ref: 004BEFD3
_memmove.LIBCMT ref: 004BEFFD
VariantClear.OLEAUT32(?), ref: 004BF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 004BF078

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 005d4816e4014a7bac890011ecf89cfcde0bbfb70d8ea1b183369a0def3b8773
Instruction ID: 2380680fd9258b6b22d940fc9b98ed57af2ceeba7df1e64bff8ee53c2bc92aa3
Opcode Fuzzy Hash: 005d4816e4014a7bac890011ecf89cfcde0bbfb70d8ea1b183369a0def3b8773
Instruction Fuzzy Hash: A2516AB5A00209EFCB14DF58C880AAAB7B8FF4C314B15856AED59DB351E334E915CFA4

Function 004C220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 004C22A3
IsMenu.USER32(00000000), ref: 004C22C3
CreatePopupMenu.USER32 ref: 004C22F7
GetMenuItemCount.USER32(000000FF), ref: 004C2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 004C2386

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 419e321c12fee826ff1bbf17facac275f786a994546c96080c4403d6708172cc
Instruction ID: b31892c56a409502d2cb110cf2075e66a4c085f0a069d4661ef084e9ef12060b
Opcode Fuzzy Hash: 419e321c12fee826ff1bbf17facac275f786a994546c96080c4403d6708172cc
Instruction Fuzzy Hash: 4651B338600289EBDF61CF74CA84FAEBBF5AF45318F10416EE811972A1D3F88905CB55

Function 00461765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0046179A
GetWindowRect.USER32(?,?), ref: 004617FE
ScreenToClient.USER32(?,?), ref: 0046181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0046182C
EndPaint.USER32(?,?), ref: 00461876

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 209c0d06740550c905f8f68eb095dddcd1a0d873c905f0ee7fd172c5bf6d0a06
Instruction ID: 4a62f80b006e156b93a818acdd3010046587b7d8347b3294550f029372ff1f38
Opcode Fuzzy Hash: 209c0d06740550c905f8f68eb095dddcd1a0d873c905f0ee7fd172c5bf6d0a06
Instruction Fuzzy Hash: 4841D3301003009FD710EF25CC84F767BE8EF5A324F18466AF5948B2B1E774980ADB66

Function 004EB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(005257B0,00000000,01766658,?,?,005257B0,?,004EB5A8,?,?), ref: 004EB712
EnableWindow.USER32(00000000,00000000), ref: 004EB736
ShowWindow.USER32(005257B0,00000000,01766658,?,?,005257B0,?,004EB5A8,?,?), ref: 004EB796
ShowWindow.USER32(00000000,00000004,?,004EB5A8,?,?), ref: 004EB7A8
EnableWindow.USER32(00000000,00000001), ref: 004EB7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 004EB7EF

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: b2d00dc4f1f0a5d768f60ee629d3bea2abf2141b2ce93615f75bad9b4f78c7ab
Instruction ID: c20b7c81a65c512f9b289cb4a215f65f9674f9396ef300df964a9dac38acee10
Opcode Fuzzy Hash: b2d00dc4f1f0a5d768f60ee629d3bea2abf2141b2ce93615f75bad9b4f78c7ab
Instruction Fuzzy Hash: C6417434600280AFDB21CF25C499BA77BE1FF45315F1841BAE9488FBA2C735A856CB95

Function 004D709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,004D4E41,?,?,00000000,00000001), ref: 004D70AC

Part of subcall function 004D39A0: GetWindowRect.USER32(?,?), ref: 004D39B3

GetDesktopWindow.USER32 ref: 004D70D6
GetWindowRect.USER32(00000000), ref: 004D70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 004D710F

Part of subcall function 004C5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004C52BC

GetCursorPos.USER32(?), ref: 004D713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 004D7199

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: b3ae88368dcb63dcb35ad9ab312f8ba44465011d5ecb8e34766ac54d1346a57b
Instruction ID: df3bc42f9553c61bf9013370f2d6bb387fdc3b1a3f5f23f521bae3aec87a4309
Opcode Fuzzy Hash: b3ae88368dcb63dcb35ad9ab312f8ba44465011d5ecb8e34766ac54d1346a57b
Instruction Fuzzy Hash: D731C372505345ABD720DF14C849F5FB7E9FB88314F00052AF5859B292D734EA09CB9A

Function 004B8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 004B80C0
Part of subcall function 004B80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 004B80CA
Part of subcall function 004B80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 004B80D9
Part of subcall function 004B80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 004B80E0
Part of subcall function 004B80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 004B80F6

GetLengthSid.ADVAPI32(?,00000000,004B842F), ref: 004B88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 004B88D6
HeapAlloc.KERNEL32(00000000), ref: 004B88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 004B88F6
GetProcessHeap.KERNEL32(00000000,00000000,004B842F), ref: 004B890A
HeapFree.KERNEL32(00000000), ref: 004B8911

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: abe3a8602d5fabbca49cf00f921b3cec2c7ffc4cf6c0367807ade2c2b86c1fe8
Instruction ID: 1c8916977d5e974c5ea3956ec5ce936c90a8a9994a7fc1e9a1d4957cd1f6f81b
Opcode Fuzzy Hash: abe3a8602d5fabbca49cf00f921b3cec2c7ffc4cf6c0367807ade2c2b86c1fe8
Instruction Fuzzy Hash: 0311CD71501609FBDB119BA4CC49BFFBBACEF81311F10802EE84597211CB3A9E04CB68

Function 004B85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 004B85E2
OpenProcessToken.ADVAPI32(00000000), ref: 004B85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 004B85F8
CloseHandle.KERNEL32(00000004), ref: 004B8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 004B8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 004B8646

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 27175c5176e637dbdb5dcfc08814fa5dcb27d525fbaceb4fa912517ea8c2ea40
Instruction ID: 49ff9f9a4565c79af0077d5c7abf75d7c6ae31f3182db9974f7c8e2afed5e061
Opcode Fuzzy Hash: 27175c5176e637dbdb5dcfc08814fa5dcb27d525fbaceb4fa912517ea8c2ea40
Instruction Fuzzy Hash: 7A116A7250024DBBDF118FA4DC48FDE7BA8EF48304F044069FE00A6161C7769E65EB64

Function 004BB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004BB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 004BB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 004BB7CD
ReleaseDC.USER32(00000000,00000000), ref: 004BB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 004BB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 004BB7FE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 50a5a7320f5bb8d946dc3f09e9ea86ecc77bea027f10378d19df5a823c88f2c5
Instruction ID: 94e0d2555f0bc35307d781f736d47b8bc4f3e33a3942ffb5b20d60419f095d7b
Opcode Fuzzy Hash: 50a5a7320f5bb8d946dc3f09e9ea86ecc77bea027f10378d19df5a823c88f2c5
Instruction Fuzzy Hash: 22018875E00249BBEB105BF69C85A5EBFB8EB48311F004076FA04AB291D6709D01CFA5

Function 00480162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00480193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0048019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 004801A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 004801B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 004801B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 004801C1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 7570b784aab25758a2785a5337e2f044c30568aaff3740cccd182f5fecad3ea0
Instruction ID: daba059dcaa35dfc0ebdec66b1ec3118a30c389ad9b0e443d6910e4d7dcb5d12
Opcode Fuzzy Hash: 7570b784aab25758a2785a5337e2f044c30568aaff3740cccd182f5fecad3ea0
Instruction Fuzzy Hash: 2B016CB09017597DE3008F6A8C85B52FFA8FF19354F00411BA15C4B942C7F5A868CBE5

Function 004C53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 004C53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 004C540F
GetWindowThreadProcessId.USER32(?,?), ref: 004C541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004C542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004C5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 004C543E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: d19da38673854dd8109d3dbe188cee50b978ee2148335b854477a45dcc988d39
Instruction ID: 6c2baafde7ca4126cfe2930b73d779bd4839354105312bf470e805d8dcd68f28
Opcode Fuzzy Hash: d19da38673854dd8109d3dbe188cee50b978ee2148335b854477a45dcc988d39
Instruction Fuzzy Hash: 02F09631140598BBD7205B62DC4DEEF7B7CEFC6B11F000179F904D5092D7A01E0586B9

Function 004C7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 004C7243
EnterCriticalSection.KERNEL32(?,?,00470EE4,?,?), ref: 004C7254
TerminateThread.KERNEL32(00000000,000001F6,?,00470EE4,?,?), ref: 004C7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00470EE4,?,?), ref: 004C726E

Part of subcall function 004C6C35: CloseHandle.KERNEL32(00000000,?,004C727B,?,00470EE4,?,?), ref: 004C6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 004C7281
LeaveCriticalSection.KERNEL32(?,?,00470EE4,?,?), ref: 004C7288

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: f7f9225bc334aeefd5893ebf3ec6b26550ae4d44040a146374a8aef32fe64932
Instruction ID: aba9c8077a04f56a5acb039f469f1d0f3c5505b44316b5b348b272c378e5131c
Opcode Fuzzy Hash: f7f9225bc334aeefd5893ebf3ec6b26550ae4d44040a146374a8aef32fe64932
Instruction Fuzzy Hash: 8FF0E23A440602EBD7511B24ECCCEEB7739FF04302B0105B6F203980A2CB7B1804CB58

Function 004B8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 004B899D
UnloadUserProfile.USERENV(?,?), ref: 004B89A9
CloseHandle.KERNEL32(?), ref: 004B89B2
CloseHandle.KERNEL32(?), ref: 004B89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 004B89C3
HeapFree.KERNEL32(00000000), ref: 004B89CA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 3975e78c48ebe4c9a3192dbfbbcb435ae4b9d2c1a2acce8963ee7aefa5b1233a
Instruction ID: 9c0ff80119127fed19c8088554eb1cb889b0a511e99725226a6eb55f35f3c69c
Opcode Fuzzy Hash: 3975e78c48ebe4c9a3192dbfbbcb435ae4b9d2c1a2acce8963ee7aefa5b1233a
Instruction Fuzzy Hash: 7DE0C236004445FBDA011FE1EC4C90AFB69FF89322B108630F219890B1CB32A868DB58

Function 004B7530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,004F2C7C,?), ref: 004B76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,004F2C7C,?), ref: 004B7702
CLSIDFromProgID.OLE32(?,?,00000000,004EFB80,000000FF,?,00000000,00000800,00000000,?,004F2C7C,?), ref: 004B7727
_memcmp.LIBCMT ref: 004B7748

Strings

,,O, xrefs: 004B753D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,O
API String ID: 314563124-289689913
Opcode ID: a5630dbb680efb9a378daaabbdf0ab8651112c1f0401c2869f350cd9d90b1f3f
Instruction ID: 955c793f4328e53f42cc69de5e58881a8a00fdf6ca11e7cd467435b98c089628
Opcode Fuzzy Hash: a5630dbb680efb9a378daaabbdf0ab8651112c1f0401c2869f350cd9d90b1f3f
Instruction Fuzzy Hash: 23813C71A00109EFCB04DFA4C984EEEB7B9FF89315F204569F506AB250DB75AE06CB64

Function 004D85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004D8613
CharUpperBuffW.USER32(?,?), ref: 004D8722
VariantClear.OLEAUT32(?), ref: 004D889A

Part of subcall function 004C7562: VariantInit.OLEAUT32(00000000), ref: 004C75A2
Part of subcall function 004C7562: VariantCopy.OLEAUT32(00000000,?), ref: 004C75AB
Part of subcall function 004C7562: VariantClear.OLEAUT32(00000000), ref: 004C75B7

Strings

Incorrect Parameter format, xrefs: 004D864B, 004D880D
AUTOIT.ERROR, xrefs: 004D8728

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 92a48e6fb387c5d67ce6ceb563737786609e2b5cbcee682a58e5feea55c91bc9
Instruction ID: 72ea023af1bcf09806db8879ea75d750374d6c3d33c57d4f48d5aa70fbfa9b0b
Opcode Fuzzy Hash: 92a48e6fb387c5d67ce6ceb563737786609e2b5cbcee682a58e5feea55c91bc9
Instruction Fuzzy Hash: 62916C746043019FC710EF25C49496ABBE4EF89718F14896FF88A8B361DB35ED06CB56

Function 004C2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FC86: _wcscpy.LIBCMT ref: 0047FCA9

_memset.LIBCMT ref: 004C2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004C2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 004C2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 004C2C97

Strings

0, xrefs: 004C2B73

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 79598117c53689e4786afa0059c953b8550f3c8a846b3189119faa9d8c032b78
Instruction ID: 8aac417d55183f2d89d68ed57acb4dc7812d5552fb4d4bafcb703a6e751ba93b
Opcode Fuzzy Hash: 79598117c53689e4786afa0059c953b8550f3c8a846b3189119faa9d8c032b78
Instruction Fuzzy Hash: A751EF791083019AD7A49E28DA45F6F7BE4AF55314F040A2FF891D7291EBF8DC04875A

Function 00473137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00473277
_memmove.LIBCMT ref: 00473310
_free.LIBCMT ref: 00473336
_memmove.LIBCMT ref: 004733E9

Strings

_G, xrefs: 00473322
3cG, xrefs: 00473225

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove$_free
String ID: 3cG$_G
API String ID: 2620147621-1170781471
Opcode ID: d920c6421fb7e2e40c939ed10e0bcfc467acb62594c9ed7377a6cee6b65b36fd
Instruction ID: b49e6b52f443db5b588dac6c8cb864acb9c014b61d4948f17079ad8afe258fae
Opcode Fuzzy Hash: d920c6421fb7e2e40c939ed10e0bcfc467acb62594c9ed7377a6cee6b65b36fd
Instruction Fuzzy Hash: 37516B716047418FDB29CF29C540BAFBBE5AF85314F48882EE98987351EB39E905CB46

Function 00476192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00476248
_memmove.LIBCMT ref: 004762E4
_memset.LIBCMT ref: 00476308

Strings

ERCP, xrefs: 004761B3
3cG, xrefs: 004762AF

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3cG$ERCP
API String ID: 2532777613-2179953020
Opcode ID: 6b2e1e1ec80bdfdef13b665a879a4cbb4562c23c1fb1b384d1b8e8331ce40013
Instruction ID: 21f9597e16f10474f26b6e8dade60ba374e6770e2ae771367118b9aa3dfba498
Opcode Fuzzy Hash: 6b2e1e1ec80bdfdef13b665a879a4cbb4562c23c1fb1b384d1b8e8331ce40013
Instruction Fuzzy Hash: 6751C070900B05DBDB24DF65C9817EBBBE9EF04304F20896FE84AD7281E778AA44CB55

Function 004C2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 004C27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 004C2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00525890,00000000), ref: 004C286B

Strings

0, xrefs: 004C27B5

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: c72f5ee1f000de2e75686a255e28e3ced756daaa773d2a076d956a66761e43a7
Instruction ID: 6f544221fd6d962f2a637b0cb4d82c282d28a5caa11765e29bf0480c03edab52
Opcode Fuzzy Hash: c72f5ee1f000de2e75686a255e28e3ced756daaa773d2a076d956a66761e43a7
Instruction Fuzzy Hash: 5641D1741043419FDB60EF25C980F1BBBE4AF84314F044A2EF96597292D7B8A804CB6A

Function 004DD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 004DD7C5

Part of subcall function 0046784B: _memmove.LIBCMT ref: 00467899

Strings

winapi, xrefs: 004DD836
none, xrefs: 004DD8A0
cdecl, xrefs: 004DD81C
stdcall, xrefs: 004DD847

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: c7254621616ef45d2fef2e6c0d8cc6afe7c87cd1e9b5a72b0b6ab78c39e6217b
Instruction ID: 5bbd896160ba33e67b57c69cf63fc45c1bb692fa61d09cd5c36489e0c1bd049a
Opcode Fuzzy Hash: c7254621616ef45d2fef2e6c0d8cc6afe7c87cd1e9b5a72b0b6ab78c39e6217b
Instruction Fuzzy Hash: AF318B71904209ABDF00EF59C8619EEB7B4BF14324B008A2BE87597391DB35A909CB84

Function 004B8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004BAA99: GetClassNameW.USER32(?,?,000000FF), ref: 004BAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 004B8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 004B8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 004B8F57

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

Strings

ComboBox, xrefs: 004B8E9E
ListBox, xrefs: 004B8ED3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 051250597facb2b19ee06aaaf1d0aad5e4654722b77e0eaa046db352385fcd0c
Instruction ID: 3abfa262874f04800405bebe712cc0b20c9132d99489698cb05a68a718a50e65
Opcode Fuzzy Hash: 051250597facb2b19ee06aaaf1d0aad5e4654722b77e0eaa046db352385fcd0c
Instruction Fuzzy Hash: 4821F071A00108BADB14ABB5CC85DFFBB69DF15328B10462FF421972E1DE3D490AD628

Function 004D182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 004D184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004D1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 004D18A2
InternetCloseHandle.WININET(00000000), ref: 004D18E9

Part of subcall function 004D2483: GetLastError.KERNEL32(?,?,004D1817,00000000,00000000,00000001), ref: 004D2498
Part of subcall function 004D2483: SetEvent.KERNEL32(?,?,004D1817,00000000,00000000,00000001), ref: 004D24AD

Strings

, xrefs: 004D1893

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 64f29c19898d806b455d3f6108aeccd770402a25826aa3357b188c8352e1593a
Instruction ID: c237c8d887109486ef75fe2264ebe56fe985b4d4057653bc79d825475c18beb1
Opcode Fuzzy Hash: 64f29c19898d806b455d3f6108aeccd770402a25826aa3357b188c8352e1593a
Instruction Fuzzy Hash: 4221AFB1500208BFEB11EB61DC95EBB77ADEB48748F10412BF80596350DA788D05A7A9

Function 004E63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00461D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00461D73
Part of subcall function 00461D35: GetStockObject.GDI32(00000011), ref: 00461D87
Part of subcall function 00461D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00461D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 004E6461
LoadLibraryW.KERNEL32(?), ref: 004E6468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 004E647D
DestroyWindow.USER32(?), ref: 004E6485

Strings

SysAnimate32, xrefs: 004E643C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 09c85ba82d5d2b487f509b798cdd4291c52da5941ce9bbd295f7652905a4f2e4
Instruction ID: 66d12f878f11cfcf6429371923106a31b6b05eb12180dcef9928b9a1cd217081
Opcode Fuzzy Hash: 09c85ba82d5d2b487f509b798cdd4291c52da5941ce9bbd295f7652905a4f2e4
Instruction Fuzzy Hash: E921CF71100285BFEF108FA6DC80EBB37ACEF693A9F11462AF914962D1D739DC419728

Function 004C6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 004C6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 004C6DEF
GetStdHandle.KERNEL32(0000000C), ref: 004C6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 004C6E3B

Strings

nul, xrefs: 004C6E36

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 75278dfdfe1de72aa29dc361aab584312262e94d54be2d679468db1055aa0140
Instruction ID: d3bacb8d18e57da3b6f2a8c5ee6383712d951b5c3bc3176dd15ffdabb7a246bd
Opcode Fuzzy Hash: 75278dfdfe1de72aa29dc361aab584312262e94d54be2d679468db1055aa0140
Instruction Fuzzy Hash: BD21A378600209ABDB209F29DC44F9A77A4EF44720F218A2EFDA1D72D0D77598558B58

Function 004C6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 004C6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 004C6EBB
GetStdHandle.KERNEL32(000000F6), ref: 004C6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 004C6F06

Strings

nul, xrefs: 004C6F01

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 8fb1dc49e300965c532751be4427dcc0dfbc05301c41bd8e649ee70cdb48ca3e
Instruction ID: cabd9c66b8c24f3bc1e7091202d4c682f805b838a0d7b36c585554c881f5e853
Opcode Fuzzy Hash: 8fb1dc49e300965c532751be4427dcc0dfbc05301c41bd8e649ee70cdb48ca3e
Instruction Fuzzy Hash: A621AE7D5003059BDB609F69C844FAB77A8EF44720F218A2FF9A0D73D0D775A8418B19

Function 004CAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 004CAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 004CACA8
__swprintf.LIBCMT ref: 004CACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,004EF910), ref: 004CACFF

Strings

%lu, xrefs: 004CACBB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: e0b8c03c0b8f2253c7b0ac44f96c63751ed156b6a6769d32ee0d289ce3042c53
Instruction ID: 2e56e211f6693327b870341b93c69b8e2d9f2cb9b6eaa7e1e27d9e9702037348
Opcode Fuzzy Hash: e0b8c03c0b8f2253c7b0ac44f96c63751ed156b6a6769d32ee0d289ce3042c53
Instruction Fuzzy Hash: 8221C474A0010DAFCB10DF95C985EEE7BB8EF49308B00406EF8099B252DB35EE05CB25

Function 004C1142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,004BFCED,?,004C0D40,?,00008000), ref: 004C115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,004BFCED,?,004C0D40,?,00008000), ref: 004C1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,004BFCED,?,004C0D40,?,00008000), ref: 004C118E
Sleep.KERNEL32(?,?,?,?,?,?,?,004BFCED,?,004C0D40,?,00008000), ref: 004C11C1

Strings

@L, xrefs: 004C119D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @L
API String ID: 2875609808-1159669540
Opcode ID: c0cf4652dea7a61eddb384028b3dcd79d6f1845ee8812314d81780103b70709c
Instruction ID: 1401b03e1ddb9113808bd46227df3aed91fa85c7802ec40c34ec2bac49f385a9
Opcode Fuzzy Hash: c0cf4652dea7a61eddb384028b3dcd79d6f1845ee8812314d81780103b70709c
Instruction Fuzzy Hash: 5A115E35C0055CDBCF009FA5D894BEEBB78FF0A711F04405ADA41B6252CB389954CB99

Function 004C1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 004C1B19

Strings

APPEND, xrefs: 004C1B52
EXISTS, xrefs: 004C1B41
REMOVE, xrefs: 004C1B1F
KEYS, xrefs: 004C1B30

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: b5704925768d9e132fb120273aee11b50f2adc2ceab5eef1613679c05d4cb2dd
Instruction ID: 5fc9ed47a766108106fdc0b7a89f0831e84dbeec467e54771a9f8221b0117433
Opcode Fuzzy Hash: b5704925768d9e132fb120273aee11b50f2adc2ceab5eef1613679c05d4cb2dd
Instruction Fuzzy Hash: 79112A38D102089BCF44EF65D8529FEB7B5FF26308B10446AD814672A2FB366D0ACF58

Function 004DEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 004DEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 004DEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 004DED6A
CloseHandle.KERNEL32(?), ref: 004DEDEB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 7efd8fa89a90027fd50b351ce88f74f70aff435d3002f8ad3da0f5ae0d0f968d
Instruction ID: 2662548858cf3574fbcb4b2a1ee36b7da2ecf6586eec340051e041bbe947d2e5
Opcode Fuzzy Hash: 7efd8fa89a90027fd50b351ce88f74f70aff435d3002f8ad3da0f5ae0d0f968d
Instruction Fuzzy Hash: E28193B16003019FD720EF29C896F2AB7E5AF54714F04891FF9559B3D2EAB4AC04CB5A

Function 004E0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004E0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,004DFDAD,?,?), ref: 004E0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 004E00FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004E013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 004E0183
RegCloseKey.ADVAPI32(?,?), ref: 004E01AF
RegCloseKey.ADVAPI32(00000000), ref: 004E01BC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 0f85162a5380c817ea04ce33e5e389c40869ad4c89214e2e7754de78cca99aa2
Instruction ID: 11e93f6290aec1e91dd7772bbab284754a2f6f2a407b3d32f6ac3880601725cd
Opcode Fuzzy Hash: 0f85162a5380c817ea04ce33e5e389c40869ad4c89214e2e7754de78cca99aa2
Instruction Fuzzy Hash: 22519F71208244AFC704EF55C881E6BB7E8FF84318F00492EF4958B292EB79E949CB56

Function 004DD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 004DD927
GetProcAddress.KERNEL32(00000000,?), ref: 004DD9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 004DD9C6
GetProcAddress.KERNEL32(00000000,?), ref: 004DDA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 004DDA21

Part of subcall function 00465A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,004C7896,?,?,00000000), ref: 00465A2C
Part of subcall function 00465A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,004C7896,?,?,00000000,?,?), ref: 00465A50

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: f4447f38bf1ebab9cdceabd7f79895ee5f3c7642b4f40a56663835c0782b2603
Instruction ID: c7d51a4a8b0ff7a0b9e26ba884ef8e6dc0896d0390c32fcb557f28e01fa7ed99
Opcode Fuzzy Hash: f4447f38bf1ebab9cdceabd7f79895ee5f3c7642b4f40a56663835c0782b2603
Instruction Fuzzy Hash: BF512975A00209DFCB00EFA9C4949ADB7F4FF19314B04C0AAE855AB312D739AD45CF55

Function 004CE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 004CE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 004CE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 004CE687

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 004CE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 004CE6B4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: e7ad68bb401f0a6aec018af3a67dc431a27e97c4e59ed8b2202ee2efb3b36a09
Instruction ID: b94846cb6a276ec5e5e7f43438e153b13ffaa6d1c3afcc8cfc1d7be895785b59
Opcode Fuzzy Hash: e7ad68bb401f0a6aec018af3a67dc431a27e97c4e59ed8b2202ee2efb3b36a09
Instruction Fuzzy Hash: 1F514D35A10105DFCB00EF65C981AAEBBF5EF09314F1480AAE809AB362DB35ED15CF55

Function 004EA056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76ccd0aaa68515790a8eff6e2154b23407e9b982d31f5a0a901f90c311aafaff
Instruction ID: 3152e1856dac62d8f0aa2cc29b4ad9e25bfe37183720af886564672e970df157
Opcode Fuzzy Hash: 76ccd0aaa68515790a8eff6e2154b23407e9b982d31f5a0a901f90c311aafaff
Instruction Fuzzy Hash: 44412735904194AFC720CF35CC88FAAFBA4EB09312F144266F815A73E1C774BD25DA5A

Function 00462344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00462357
ScreenToClient.USER32(005257B0,?), ref: 00462374
GetAsyncKeyState.USER32(00000001), ref: 00462399
GetAsyncKeyState.USER32(00000002), ref: 004623A7

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: fe580303314dc35ed5dc558136b70d2eed4a9a0c9a6e70375c1e412e8bd65476
Instruction ID: 2971b99e767d669310cbcfbaa8cde6442c47b3fd5b950c89f4288ea81ade098a
Opcode Fuzzy Hash: fe580303314dc35ed5dc558136b70d2eed4a9a0c9a6e70375c1e412e8bd65476
Instruction Fuzzy Hash: 5941B235604605FBCF158F69C884AEEBB74FB05364F20432BF82496390D7789D90DB96

Function 004B63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004B63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 004B6433
TranslateMessage.USER32(?), ref: 004B645C
DispatchMessageW.USER32(?), ref: 004B6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004B6475

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 08b2344a980e767609b56069004b5723a96cdf0bf43e77c021a4ec7ec035a931
Instruction ID: d70a68e61e40e38033f87b0fd89ddcca2e4c4e74e38b00aeb7853639001ba3d1
Opcode Fuzzy Hash: 08b2344a980e767609b56069004b5723a96cdf0bf43e77c021a4ec7ec035a931
Instruction Fuzzy Hash: A231D431500A42AFDB24CF748C44BF77BA8AF11310F150176E825C62A1E73D984AEB79

Function 004B8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004B8A30
PostMessageW.USER32(?,00000201,00000001), ref: 004B8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 004B8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 004B8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 004B8AF8

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 764a0bde9d7652068c69a73e1951caee33f11ef27f38d2ca19faad73328f1855
Instruction ID: 7d1114430e144fb681b0325595f7a1413661ea018b331e2255365477ca166841
Opcode Fuzzy Hash: 764a0bde9d7652068c69a73e1951caee33f11ef27f38d2ca19faad73328f1855
Instruction Fuzzy Hash: 3C31E471500219EBDF14CF68DD8CADE7BB9FB48315F10422AF924DA2D1C7B49914DB64

Function 004BB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004BB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 004BB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 004BB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 004BB27F
_wcsstr.LIBCMT ref: 004BB289

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 023bb4b8711736de98856c55489a9926a6080f6b4719e30b6ae81a998474ee2b
Instruction ID: b251a8022b1da113bb46d3f6a16dfcd9de662ddb5c4e16ec5a00f909bf8cb65c
Opcode Fuzzy Hash: 023bb4b8711736de98856c55489a9926a6080f6b4719e30b6ae81a998474ee2b
Instruction Fuzzy Hash: AB21D6312042406BEB195B759C49ABF7B98DF45750F00417EF804DA161EBA9DC4197A8

Function 004EB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

GetWindowLongW.USER32(?,000000F0), ref: 004EB192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 004EB1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 004EB1CF
GetSystemMetrics.USER32(00000004), ref: 004EB1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,004D0E90,00000000), ref: 004EB216

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: d5461884a174781587521e82df589821236181a10adad45a9f527c220780ee30
Instruction ID: 38be260d328bf7fe3663140f4440b222f816212480cbf4a1a930a1c69120b92c
Opcode Fuzzy Hash: d5461884a174781587521e82df589821236181a10adad45a9f527c220780ee30
Instruction Fuzzy Hash: 7E21A2319106A1AFCB108F399C48A6B77A4FF16372F10473AF922D72E1E73498119BC4

Function 004B9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004B9320

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 004B9352
__itow.LIBCMT ref: 004B936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 004B9392
__itow.LIBCMT ref: 004B93A3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 1d0763c85936f3ea5ddf07395450b7b1e75a1af4879fe0e4aed9eec053e92bb1
Instruction ID: fdc5a55682e68f2872e0bab60e6c85581a7f23885cb063d0d3b66e318a6891ca
Opcode Fuzzy Hash: 1d0763c85936f3ea5ddf07395450b7b1e75a1af4879fe0e4aed9eec053e92bb1
Instruction Fuzzy Hash: E521F831700208BBDB10AB658CC5EEE3BE8EF4CB14F04502AFE04DB2C1D6748D4597AA

Function 004D5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 004D5A6E
GetForegroundWindow.USER32 ref: 004D5A85
GetDC.USER32(00000000), ref: 004D5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 004D5ACD
ReleaseDC.USER32(00000000,00000003), ref: 004D5B08

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: f7d1d6f86b0c0e663afbed8d217571429c4308931068d501f5180243f7888f37
Instruction ID: 7d26ec70d5a4acd1b42d2dccbf578780167f85c850bca8b90c386079fdd736cb
Opcode Fuzzy Hash: f7d1d6f86b0c0e663afbed8d217571429c4308931068d501f5180243f7888f37
Instruction Fuzzy Hash: 5F21A175A00114AFDB00EFA5DC84AAABBE9EF48310F14807EF80997362DA74AD05CB95

Function 004612F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0046134D
SelectObject.GDI32(?,00000000), ref: 0046135C
BeginPath.GDI32(?), ref: 00461373
SelectObject.GDI32(?,00000000), ref: 0046139C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 34bde428a7ca2883059536f2a17412b85d78d6e91e80b6a1605f3b7164d8aeba
Instruction ID: 194d1b5974cd6ed2791a340f7620c3230117e6458857807df27d98f4e62a0100
Opcode Fuzzy Hash: 34bde428a7ca2883059536f2a17412b85d78d6e91e80b6a1605f3b7164d8aeba
Instruction Fuzzy Hash: 6C217730800604DFEB208F25DD4576A7BA4FF11321F284227F811962B1F3B5999AEF96

Function 004C4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004C4ABA
__beginthreadex.LIBCMT ref: 004C4AD8
MessageBoxW.USER32(?,?,?,?), ref: 004C4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 004C4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004C4B0A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 5939623de2536a8e566a2c8fd8bfcaf8e2fdbebbb7d5c98f7fd8de7b7076ea76
Instruction ID: 420d2b79967cfd4216e58ef95c15dc9ee4716992ca7944f1e3e0b86d278dea65
Opcode Fuzzy Hash: 5939623de2536a8e566a2c8fd8bfcaf8e2fdbebbb7d5c98f7fd8de7b7076ea76
Instruction Fuzzy Hash: C211047A904248BBC7119FA8AC48F9B7FACEB85320F14426EF814D3391E675DD0987A4

Function 004B8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 004B821E
GetLastError.KERNEL32(?,004B7CE2,?,?,?), ref: 004B8228
GetProcessHeap.KERNEL32(00000008,?,?,004B7CE2,?,?,?), ref: 004B8237
HeapAlloc.KERNEL32(00000000,?,004B7CE2,?,?,?), ref: 004B823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 004B8255

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 0d0344e01c1747a812ea138b94045f826f1e99e5cff206ee6b463aeb398ed8a4
Instruction ID: 5de375a69dc002a7aa158f2a354b43817f1bd35b987088f0303391269b5ce32c
Opcode Fuzzy Hash: 0d0344e01c1747a812ea138b94045f826f1e99e5cff206ee6b463aeb398ed8a4
Instruction Fuzzy Hash: 60016971200649BFDB244FA6DC88DAB7BACEF8A754B50447EF809C6260DA318C04CA74

Function 004B710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?,?,004B7455), ref: 004B7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?), ref: 004B7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?), ref: 004B7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?), ref: 004B7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,004B7044,80070057,?,?), ref: 004B716C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: f5cc9ca8601f4d7bc67b8fb5942d3ee31317981d888d80436ddd138aaa16552e
Instruction ID: 707b34ae65040ae91bf344e442bad9714b9a39acf08d79171aabd6ec676d6a7a
Opcode Fuzzy Hash: f5cc9ca8601f4d7bc67b8fb5942d3ee31317981d888d80436ddd138aaa16552e
Instruction Fuzzy Hash: BF018FB2601204BBDB115F68DC84BAA7BADEF84791F144075FD04E6321D735DD419BB4

Function 004C5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004C5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 004C526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 004C5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 004C5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004C52BC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 6dbcf25e6837d54363898afdd58578d583f149579509f1fbb2623574fcdfd359
Instruction ID: 2fd5cb77ec495c4dd99c8c636252f514c7d79ba6d2d023e1434fe5a1c6c8e6b8
Opcode Fuzzy Hash: 6dbcf25e6837d54363898afdd58578d583f149579509f1fbb2623574fcdfd359
Instruction Fuzzy Hash: 8E016135D01A1DDBCF00DFE4D988AEDFBB8FF09311F4000AAE941B6141CB3469948BA9

Function 004B810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 004B8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 004B812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 004B8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B8157

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d27e6e933a04353507bfa27b681827b404ab90a28f145a121b859289b1f6720d
Instruction ID: 33af45371a0bcae093485e77e5a8e8b7b7b00b60a5e97797e0966f12c3d2a353
Opcode Fuzzy Hash: d27e6e933a04353507bfa27b681827b404ab90a28f145a121b859289b1f6720d
Instruction Fuzzy Hash: 7EF06271201344AFEB110FA9ECC8EA73BACFF8A754B00043AF945DA291CB659D45DA74

Function 004BC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004BC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 004BC20E
MessageBeep.USER32(00000000), ref: 004BC226
KillTimer.USER32(?,0000040A), ref: 004BC242
EndDialog.USER32(?,00000001), ref: 004BC25C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 994df21e668eeb96516928d30b5ea5a8ef3c6525aa35cf00e9e90459a11cd284
Instruction ID: f76c750b73ee1b8ef82d1f000dd4bb254b64d19d63a1238d03e25b5e34598284
Opcode Fuzzy Hash: 994df21e668eeb96516928d30b5ea5a8ef3c6525aa35cf00e9e90459a11cd284
Instruction Fuzzy Hash: 2701DB3080430497EB245B64DDCEFD67778FF00B06F0006BAF542954E1D7F469498B69

Function 004613B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 004613BF
StrokeAndFillPath.GDI32(?,?,0049B888,00000000,?), ref: 004613DB
SelectObject.GDI32(?,00000000), ref: 004613EE
DeleteObject.GDI32 ref: 00461401
StrokePath.GDI32(?), ref: 0046141C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 4cb04bf5ef725ce74c20c464247b7920cc039d00bc1279163c4a0bcd72dbac9d
Instruction ID: c0adfac3a21ea15da082cbd4446807b268e61507ad017a485b0e443fe5f63af2
Opcode Fuzzy Hash: 4cb04bf5ef725ce74c20c464247b7920cc039d00bc1279163c4a0bcd72dbac9d
Instruction Fuzzy Hash: E7F0E130004748DBDB215F26EC8D7693FA4AB12326F1C8235E429491F2E775499EEF59

Function 00472CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00480DB6: std::exception::exception.LIBCMT ref: 00480DEC
Part of subcall function 00480DB6: __CxxThrowException@8.LIBCMT ref: 00480E01

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 00467A51: _memmove.LIBCMT ref: 00467AAB

__swprintf.LIBCMT ref: 00472ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00472D66

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 6f69605b034748464f48a14edd70216b2ea2a7a1c6197475927926340e33e878
Instruction ID: 0a20234dfe1c3faf2b99641eb9b52f0634887fa336d386f86b0066ecfaff9cc9
Opcode Fuzzy Hash: 6f69605b034748464f48a14edd70216b2ea2a7a1c6197475927926340e33e878
Instruction Fuzzy Hash: 7991AD711082119FC714FF25C985CAFB7A8EF95318F04481FF4859B2A1EA78ED48CB6A

Function 004CB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00464750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00464743,?,?,004637AE,?), ref: 00464770

CoInitialize.OLE32(00000000), ref: 004CB9BB
CoCreateInstance.OLE32(004F2D6C,00000000,00000001,004F2BDC,?), ref: 004CB9D4
CoUninitialize.OLE32 ref: 004CB9F1

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

Strings

.lnk, xrefs: 004CB99D, 004CB9AB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 2010a4fd06e644b7e354c998dbea639970de655c25f0fcb1fbdfbb7c2d2cb03e
Instruction ID: 1c106869967ad620b2770b03b3257d4365e49fe4e535ef60a42566e113cb28e6
Opcode Fuzzy Hash: 2010a4fd06e644b7e354c998dbea639970de655c25f0fcb1fbdfbb7c2d2cb03e
Instruction Fuzzy Hash: C7A155746042019FCB00EF15C485E6ABBE5FF89318F00895EF8999B361DB35EC45CB96

Function 004BB2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 004BB4BE

Strings

AutoIt3GUI, xrefs: 004BB436
%O, xrefs: 004BB561
Container, xrefs: 004BB43B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%O
API String ID: 3565006973-335713367
Opcode ID: 7aae3ced9771dab10911b28c884b93a514ab645bb69a2b1b1590bc3af15e75cd
Instruction ID: c7eea761a16056ed14f8ab724b84c60f7382ada75b59ea565a2f0528590a23ac
Opcode Fuzzy Hash: 7aae3ced9771dab10911b28c884b93a514ab645bb69a2b1b1590bc3af15e75cd
Instruction Fuzzy Hash: E3913C70200601AFDB54DF64C884BAABBF5FF49714F10856EE946CB391DBB4E841CBA5

Function 0048501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 004850AD

Part of subcall function 004900F0: __87except.LIBCMT ref: 0049012B

Strings

pow, xrefs: 00485085, 004850A2

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: dde3cc88bb5adae3e18bf47e393781105ab370392a6109f5aab4cc1dbf161e11
Instruction ID: ba8b13332ec6c2eaffe9cee724cc57a2aa5d636e32c925bfea60c115172849e5
Opcode Fuzzy Hash: dde3cc88bb5adae3e18bf47e393781105ab370392a6109f5aab4cc1dbf161e11
Instruction Fuzzy Hash: 625118619086018ADF117724C90637F2F949B42710F208DBBE4D5863A9DF3D8DD9DB8E

Function 004A8584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004A862B
_memmove.LIBCMT ref: 004A8685

Strings

_G, xrefs: 004A86FF, 004ADFDC, 004ADFF8
3cG, xrefs: 004A860C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _memmove
String ID: 3cG$_G
API String ID: 4104443479-1170781471
Opcode ID: 0280ca308ea5145cfa2b5408c374495fe11346e407e9678be4e5e7dea5a47b9a
Instruction ID: 1227cc8cfcf23a61a8b40b1f8cc56635bec529d0ede622b5141af0d52455aa29
Opcode Fuzzy Hash: 0280ca308ea5145cfa2b5408c374495fe11346e407e9678be4e5e7dea5a47b9a
Instruction Fuzzy Hash: CA517AB0D006099FDF20CF68C880AAEBBB1FF55304F14852EE85AD7350EB38A955CB55

Function 004B97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004C14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004B9296,?,?,00000034,00000800,?,00000034), ref: 004C14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 004B983F

Part of subcall function 004C1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,004B92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 004C14B1

Part of subcall function 004C13DE: GetWindowThreadProcessId.USER32(?,?), ref: 004C1409
Part of subcall function 004C13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,004B925A,00000034,?,?,00001004,00000000,00000000), ref: 004C1419
Part of subcall function 004C13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,004B925A,00000034,?,?,00001004,00000000,00000000), ref: 004C142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004B98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 004B98F9

Strings

@, xrefs: 004B9911

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: b37362152333ab118437b802c4a35a95e5571989ab3a4c29f1290846ce6e6fb9
Instruction ID: 44f1de39aa0d39121b853159654d70f58b53b0e50940c5ed92bc80c0826064b1
Opcode Fuzzy Hash: b37362152333ab118437b802c4a35a95e5571989ab3a4c29f1290846ce6e6fb9
Instruction Fuzzy Hash: DE415076900118BFDB10DFA5CC85FDEBBB8EB05304F00405AFA45B7291DA746E45CBA4

Function 004E7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,004EF910,00000000,?,?,?,?), ref: 004E79DF
GetWindowLongW.USER32 ref: 004E79FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004E7A0C

Strings

SysTreeView32, xrefs: 004E79B1

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: f1b54f02c9ff15c2d83f0df2a88a3eddf61c7aae9914e73f2f6a3682d965eb4e
Instruction ID: 3f271f10e7d20ca81e4f389fb3534ac984e710ccbb6c1eee7cc1f5b388621b7a
Opcode Fuzzy Hash: f1b54f02c9ff15c2d83f0df2a88a3eddf61c7aae9914e73f2f6a3682d965eb4e
Instruction Fuzzy Hash: 5031E071204645ABEB108E35CC41BEB77A9EF05334F244726F875922E2D738E8518754

Function 004E73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 004E7461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 004E7475
SendMessageW.USER32(?,00001002,00000000,?), ref: 004E7499

Strings

SysMonthCal32, xrefs: 004E742C

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 72ef215b35ed9f97a80a643d95022fd2b4e4894ced850737c150f06633e4cddf
Instruction ID: 774a2639eb8e6a7b4b1a012ce3dbf0f58d7da5be591469820256103ef6e5da19
Opcode Fuzzy Hash: 72ef215b35ed9f97a80a643d95022fd2b4e4894ced850737c150f06633e4cddf
Instruction Fuzzy Hash: F321BF32500258BBDF218F65CC42FEB3B69EF48724F110215FE156B1D0DA79AC959BA4

Function 004E7B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 004E7C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 004E7C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 004E7C5F

Strings

msctls_updown32, xrefs: 004E7BC4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 6337e3291de79d1500919a9d9ce93b359bf512593899e6dc6108338487a30139
Instruction ID: 40cc8c859abc444d9bb0cc5eaaf7f020c3db32d010be56f7cd082bc180dce56c
Opcode Fuzzy Hash: 6337e3291de79d1500919a9d9ce93b359bf512593899e6dc6108338487a30139
Instruction Fuzzy Hash: 6D217CB1604249AFDB10DF25DCC1CA737ECEF5A368B24045AF9119B3A1DB75EC028BA4

Function 004E6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 004E6D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 004E6D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 004E6D70

Strings

Listbox, xrefs: 004E6D08

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 4444b9f305d68b77d5847c4bab5e703ea018c33cecd3193eb2d7e9fffc5469ec
Instruction ID: c73d6af563dd48a8ba16558621443351b50dd1e48ed8f0f37f96d4f5b831cf6a
Opcode Fuzzy Hash: 4444b9f305d68b77d5847c4bab5e703ea018c33cecd3193eb2d7e9fffc5469ec
Instruction Fuzzy Hash: F2210732600158BFDF118F55CC40FBB3BBAEF997A0F518129F9405B2A1C6759C5187A4

Function 004D39E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 004D3A66

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Strings

AUTOITCALLVARIABLE%d, xrefs: 004D3A58
, $, xrefs: 004D3AA6
%O, xrefs: 004D39F4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%O
API String ID: 3506404897-922001577
Opcode ID: 05be874adae01734647221ce3a1e42c12845f5bcfeaf3d01ca1c396947ce1caf
Instruction ID: f63703d89290a8a68c9d5d22f3e67d3d4f1d3850f4e40ad321231f1ab524f4df
Opcode Fuzzy Hash: 05be874adae01734647221ce3a1e42c12845f5bcfeaf3d01ca1c396947ce1caf
Instruction Fuzzy Hash: 50218171700219AACF10EF65CC92AEE77B5BF44704F40445BE455AB281EB38EA45CB6A

Function 004E770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 004E7772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 004E7787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 004E7794

Strings

msctls_trackbar32, xrefs: 004E7749

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: fc165d03d09cad50f943503b83a2d2d455985a0569bd8ad238fd00d0442a7a03
Instruction ID: abcc333ea9f4cf338066e3728169b0425a4e99a796ec198789baa8f64ffd48bc
Opcode Fuzzy Hash: fc165d03d09cad50f943503b83a2d2d455985a0569bd8ad238fd00d0442a7a03
Instruction Fuzzy Hash: 91113A72244248BFEF205F72CC41FD73768EF89B65F01052DF64196190D275E851CB14

Function 00486B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00486B93
__calloc_crt.LIBCMT ref: 00486BAC

Strings

Q, xrefs: 00486BD1
@BR, xrefs: 00486BC3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __calloc_crt
String ID: Q$@BR
API String ID: 3494438863-1408422063
Opcode ID: f4a6748e7e66613a7d5b3e8ceba522c9561620d53c5b3a5fbcce8b450cff9406
Instruction ID: eae6c705cc7825bc2f18240440df69b0987892f6ceeb01da511331c31cb73120
Opcode Fuzzy Hash: f4a6748e7e66613a7d5b3e8ceba522c9561620d53c5b3a5fbcce8b450cff9406
Instruction Fuzzy Hash: C8F0C875205622CBF7B5AF15BC52BAA27D5EB11338F51081FE504CE2C0FB38A88657C8

Function 00489B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00489B94

Part of subcall function 00489C0B: __mtinitlocknum.LIBCMT ref: 00489C1D
Part of subcall function 00489C0B: EnterCriticalSection.KERNEL32(00000000,?,00489A7C,0000000D), ref: 00489C36

__updatetlocinfoEx_nolock.LIBCMT ref: 00489BA4

Part of subcall function 00489100: ___addlocaleref.LIBCMT ref: 0048911C
Part of subcall function 00489100: ___removelocaleref.LIBCMT ref: 00489127
Part of subcall function 00489100: ___freetlocinfo.LIBCMT ref: 0048913B

Strings

8Q, xrefs: 00489B85
8Q, xrefs: 00489B8A, 00489B9F, 00489BAB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8Q$8Q
API String ID: 547918592-1614712515
Opcode ID: e6e2b98d76e6ee0ac5e1f5ed8602e47fcba42af621d1b33a7451df6fe58e5c7f
Instruction ID: 5c27dbf52633879bbdb8a859345272b825caaa7e85558ee025eed9078df176e1
Opcode Fuzzy Hash: e6e2b98d76e6ee0ac5e1f5ed8602e47fcba42af621d1b33a7451df6fe58e5c7f
Instruction Fuzzy Hash: A4E08C7198BB00BAFA10BBA56907FAD6A90BB00B29F64499FF855550C1CE7C1D80871F

Function 00464C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00464BD0,?,00464DEF,?,005252F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00464C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00464C23

Strings

kernel32.dll, xrefs: 00464C0C
Wow64DisableWow64FsRedirection, xrefs: 00464C1D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 6ec58ef165896aae452ffcd5e946d51799149ffae5cb6da7c81e16af0aad4aee
Instruction ID: 6fcedc529048c561a96cf2de61019e4893d0c36a2f23cdbe6e19029cdb678b34
Opcode Fuzzy Hash: 6ec58ef165896aae452ffcd5e946d51799149ffae5cb6da7c81e16af0aad4aee
Instruction Fuzzy Hash: 85D0C230500713CFDB205F71C848207BAD6EF48342B12CC3E9481CA650F6B4D880C615

Function 00464C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00464B83,?), ref: 00464C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00464C56

Strings

kernel32.dll, xrefs: 00464C3F
Wow64RevertWow64FsRedirection, xrefs: 00464C50

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 4bddcb4c56be96a46438da8afc4d0abe06ab1ec79cb1185727ab40ab47bf518f
Instruction ID: d6277ebf5e2c387645e97625d665e6c131f205c00c45a233649ac2e8d1cc6d86
Opcode Fuzzy Hash: 4bddcb4c56be96a46438da8afc4d0abe06ab1ec79cb1185727ab40ab47bf518f
Instruction Fuzzy Hash: A4D0C730500B13CFDB248F32C84820AB6E6AF40341B22C83E9492CA264F678DC80CA18

Function 004E0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,004E1039), ref: 004E0DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 004E0E07

Strings

advapi32.dll, xrefs: 004E0DF0
RegDeleteKeyExW, xrefs: 004E0E01

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 9929702f3c352a6bf99ad818b9cf6b060964c385646795f6dd6d72dbc8787ab0
Instruction ID: 709fd94ae8a9b1b633f73d51df586525bc2e87275ce6a5784f85fe33345d1f78
Opcode Fuzzy Hash: 9929702f3c352a6bf99ad818b9cf6b060964c385646795f6dd6d72dbc8787ab0
Instruction Fuzzy Hash: 8ED0C230400716CFD3204FB5C848283B6D6AF00342F018C3E9492D6250D6B4D8D0C609

Function 004D90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,004D8CF4,?,004EF910), ref: 004D90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 004D9100

Strings

kernel32.dll, xrefs: 004D90E9
GetModuleHandleExW, xrefs: 004D90FA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 28a667f55a401fb8022189349c1f25f27dc501428ce413181f1bc8a9ed178221
Instruction ID: b4b07e7ae552aa74b9e1a0b0013fc5bb8e5f60e954c5b2afa3a8d8ab6a90e5aa
Opcode Fuzzy Hash: 28a667f55a401fb8022189349c1f25f27dc501428ce413181f1bc8a9ed178221
Instruction Fuzzy Hash: D4D01234610723DFE7209F31D858647B6D4AF05351B11C93F9489DA650E674DC84C654

Function 004A1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 004A1718
__swprintf.LIBCMT ref: 004A1749

Strings

WIN_XPe, xrefs: 004A1788
%.3d, xrefs: 004A1723

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 8dfde985d691ef937a9f2caf8cc78889b642c4d20b2ae90b1c19d0e95b34e86b
Instruction ID: 9e4ce3dc4e1ee64169f1b9113cc749818cfed25f26a31d41addbbf58f1970272
Opcode Fuzzy Hash: 8dfde985d691ef937a9f2caf8cc78889b642c4d20b2ae90b1c19d0e95b34e86b
Instruction Fuzzy Hash: 4DD012B9844118FAC7119A90D8888F9777CA72A701F142463B506E2050E2299B96D62F

Function 004B717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831fcc731e9eecf636a32ae7898678acf793a237c17c453998403f85b0223d8f
Instruction ID: b9e5e3281d4e5f1d13e63146c671633ef7d9dcdf4559a9a7b3a6f501846a7272
Opcode Fuzzy Hash: 831fcc731e9eecf636a32ae7898678acf793a237c17c453998403f85b0223d8f
Instruction Fuzzy Hash: FFC15D74A04216EFCB14CFA4C884AAEBBB5FF88704B158599E805EB351D734ED81DBA4

Function 004DE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 004DE0BE
CharLowerBuffW.USER32(?,?), ref: 004DE101

Part of subcall function 004DD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 004DD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 004DE301
_memmove.LIBCMT ref: 004DE314

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 89e23218ec303459498e43170dd98566ce7efc18cefe885f3dbb98e22a92cd67
Instruction ID: f4b97e62ef050dd602613957a1eee1075bd47f8f9453011568180054e8b9e4df
Opcode Fuzzy Hash: 89e23218ec303459498e43170dd98566ce7efc18cefe885f3dbb98e22a92cd67
Instruction Fuzzy Hash: F4C158716043019FC704EF29C49096ABBE4FF89718F04896FF8999B351D739E946CB86

Function 004D8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 004D80C3
CoUninitialize.OLE32 ref: 004D80CE

Part of subcall function 004BD56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 004BD5D4

VariantInit.OLEAUT32(?), ref: 004D80D9
VariantClear.OLEAUT32(?), ref: 004D83AA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 92b16722b89671e96ba099cb534e7981b5eb5852331c444727259d8e96fc6ad5
Instruction ID: 14b05df8456bdc84cf03451f8393606efd2eaabc438142bf95318e51e7585bd8
Opcode Fuzzy Hash: 92b16722b89671e96ba099cb534e7981b5eb5852331c444727259d8e96fc6ad5
Instruction Fuzzy Hash: A8A168752047019FCB00EF55C891B2AB7E4BF89718F04445EF9999B3A1DB78EC05CB4A

Function 004B687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004B688E
SysAllocString.OLEAUT32(00000000), ref: 004B6937
VariantCopy.OLEAUT32 ref: 004B6966
VariantClear.OLEAUT32(?), ref: 004B698D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: f48e838bbde2d4d9ec3ebf2d56e8462830f93b485b6ce301406f81a9dab0dde1
Instruction ID: 7c2e8b5c9a1a9357c245b078b979310517867099364472f99e10e8c20d80664a
Opcode Fuzzy Hash: f48e838bbde2d4d9ec3ebf2d56e8462830f93b485b6ce301406f81a9dab0dde1
Instruction Fuzzy Hash: 4151D8747003019ADF20AF66D491ABAB3E9AF49314F21C81FE586DB291DA7CD845872D

Function 004E97F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0176EB00,?), ref: 004E9863
ScreenToClient.USER32(00000002,00000002), ref: 004E9896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 004E9903

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f279abffaf909b09b07ff5dff1a614e8d74f88881df2b3ce7bdc475ddec1cec1
Instruction ID: 548f641a781d1964b6ab15d2076ae9508058d4862b16437a258112913f13e8c6
Opcode Fuzzy Hash: f279abffaf909b09b07ff5dff1a614e8d74f88881df2b3ce7bdc475ddec1cec1
Instruction Fuzzy Hash: CE516C74A00248AFCF20DF25C880AAE7BB5FF56361F14816EF8559B3A1D774AD41CB94

Function 004B9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 004B9AD2
__itow.LIBCMT ref: 004B9B03

Part of subcall function 004B9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 004B9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 004B9B6C
__itow.LIBCMT ref: 004B9BC3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 4795dc6040aa622a8e58d9edc798941457bb305267358c78c8977225a548bf04
Instruction ID: 53ee6647f2f77638d55f89111754448dc6c135a986ced165ad3b2b7197c5fbeb
Opcode Fuzzy Hash: 4795dc6040aa622a8e58d9edc798941457bb305267358c78c8977225a548bf04
Instruction Fuzzy Hash: 7A419570A04208ABDF11DF55D845BEE7BB9EF44718F00005EFA05A7291DB78AE44CB66

Function 004D69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 004D69D1
WSAGetLastError.WSOCK32(00000000), ref: 004D69E1

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 004D6A45
WSAGetLastError.WSOCK32(00000000), ref: 004D6A51

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: db617cf7802f5f04916bb81ad5c1495d80195f96e58a84c2daac404e6c56c4a5
Instruction ID: b87f528d5308049dde6746ba3bed2cddd67e929a4971270573290805c0407b9e
Opcode Fuzzy Hash: db617cf7802f5f04916bb81ad5c1495d80195f96e58a84c2daac404e6c56c4a5
Instruction Fuzzy Hash: 2341C574740200AFEB60BF65CC86F3A77D89B15B18F04815EFA559F3C2EAB89D00875A

Function 004D641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,004EF910), ref: 004D64A7
_strlen.LIBCMT ref: 004D64D9

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 0342d2a04129d5576bc13de83c26830b61320dd751f9cb849df7cb8c81e76a8b
Instruction ID: 9b7f111b24af937ff28e3a29720b75d9c57c5250ae9827642f295d6c2a17bc86
Opcode Fuzzy Hash: 0342d2a04129d5576bc13de83c26830b61320dd751f9cb849df7cb8c81e76a8b
Instruction Fuzzy Hash: FE41E871500104ABCB14FBA5FCA5FAEB7A9AF04314F11815FF81597392EB38AD44CB59

Function 004CB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 004CB89E
GetLastError.KERNEL32(?,00000000), ref: 004CB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 004CB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 004CB915

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d86af6ca55c843504948e6653ecc7b957e5c1990f9ace272e2a2d304a066f251
Instruction ID: b65250970fe735f177e455f363cb63ff43c2ede95bb3c1c87f7c99dd856ae3d4
Opcode Fuzzy Hash: d86af6ca55c843504948e6653ecc7b957e5c1990f9ace272e2a2d304a066f251
Instruction Fuzzy Hash: A3415B39600610DFCB10EF56C485A59BBE5EF49314F08809EED4A9B362DB78FD05CB9A

Function 004E8851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 004E88DE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: c83804b3104aa2ac2545d82b8e27ba4e03ccccc69f377d0a74bbe1f7fc8cd516
Instruction ID: 9eafcb70ff8efc9c843c27f57e3c1c346474b71913b547ee9933d8ecb1a95408
Opcode Fuzzy Hash: c83804b3104aa2ac2545d82b8e27ba4e03ccccc69f377d0a74bbe1f7fc8cd516
Instruction Fuzzy Hash: D5312670A00188BFEF209B66CC44BBA37A0FF05312F54041BF919E62E2CE38D9419B4B

Function 004EAB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 004EAB60
GetWindowRect.USER32(?,?), ref: 004EABD6
PtInRect.USER32(?,?,004EC014), ref: 004EABE6
MessageBeep.USER32(00000000), ref: 004EAC57

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 00096e8d8b3f8b1c843fbe8e10fa4a507c31383a91345bdde0cbf4b300a00600
Instruction ID: a68184744a92fcd45033d754b154a824804502609b7acd1ba3c50046f6f50530
Opcode Fuzzy Hash: 00096e8d8b3f8b1c843fbe8e10fa4a507c31383a91345bdde0cbf4b300a00600
Instruction Fuzzy Hash: CC418F30600598DFCB21CF5AD884A697BF5FF49301F2880AAE514DF361D734B856DB56

Function 004C0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 004C0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 004C0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 004C0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 004C0BFB

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0f5f9e6cab7e3dac2ae8be210f6ac7e79167bccb0b2aefeb5750260bdbf446fc
Instruction ID: c6718b0efc742ff1d4b880544c86537ba0c45978f61f36b8f34d83ff9fe7e92a
Opcode Fuzzy Hash: 0f5f9e6cab7e3dac2ae8be210f6ac7e79167bccb0b2aefeb5750260bdbf446fc
Instruction Fuzzy Hash: 4F317934940608EEFB70CBA58C05FFBBBA9AB44318F04426FE484512D2E37CAD45976D

Function 004C0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 004C0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 004C0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 004C0CE1
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 004C0D33

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 043d19f70f97bd7bcd8c54115689acc430d2baf022aeadb9271c041412e347ad
Instruction ID: 300a3eaccf446a1c3b885a0db488b1f6f3e7158bfe3a0ac2cebc6441dc9d1f07
Opcode Fuzzy Hash: 043d19f70f97bd7bcd8c54115689acc430d2baf022aeadb9271c041412e347ad
Instruction Fuzzy Hash: 8A315538900708EEFF788A658C04FFFBB6AAB45310F04432FE485522D2C33C9949976A

Function 004961C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004961FB
__isleadbyte_l.LIBCMT ref: 00496229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00496257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0049628D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5b1020d9b52c8f8f3cd2c4b8f1cb5c7cd62f5776317647b46300aecde91cee33
Instruction ID: 902263b3ecb0128618ebe605dff47b2fcd982eafef1be59a6b3227fa20fde6e7
Opcode Fuzzy Hash: 5b1020d9b52c8f8f3cd2c4b8f1cb5c7cd62f5776317647b46300aecde91cee33
Instruction Fuzzy Hash: BA31D230604246AFDF21AF65CC49BBB7FA9FF41310F16447AE82487291DB34E950DB58

Function 004E4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 004E4F02

Part of subcall function 004C3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004C365B
Part of subcall function 004C3641: GetCurrentThreadId.KERNEL32 ref: 004C3662
Part of subcall function 004C3641: AttachThreadInput.USER32(00000000,?,004C5005), ref: 004C3669

GetCaretPos.USER32(?), ref: 004E4F13
ClientToScreen.USER32(00000000,?), ref: 004E4F4E
GetForegroundWindow.USER32 ref: 004E4F54

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 89897a1f949570ec3024ab22128c003be7146575dcadc12b300d0902d842b87f
Instruction ID: 25472840014034e8cb35fb364f02217fdb9f6e93335866a26382cec4d1722276
Opcode Fuzzy Hash: 89897a1f949570ec3024ab22128c003be7146575dcadc12b300d0902d842b87f
Instruction Fuzzy Hash: C3313EB1E00108AFCB10EFA6C885DEFB7FDEF98304F10406AE415E7241EA759E058BA5

Function 004EC498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

GetCursorPos.USER32(?), ref: 004EC4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0049B9AB,?,?,?,?,?), ref: 004EC4E7
GetCursorPos.USER32(?), ref: 004EC534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0049B9AB,?,?,?), ref: 004EC56E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: cb3f7f6b1e25afb14b81ae27645f30707b28069eb510ab99a75ca81f32beac81
Instruction ID: e1ed11531f31530379d328a5553b11c7d82fd1d2ed022ffa5c18ceea2ae72b25
Opcode Fuzzy Hash: cb3f7f6b1e25afb14b81ae27645f30707b28069eb510ab99a75ca81f32beac81
Instruction Fuzzy Hash: B231B1355000A8FFCB258F59C898EBB7BB5EF09311F44406AF9058B362C735A952DBA8

Function 004B8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 004B810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 004B8121
Part of subcall function 004B810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 004B812B
Part of subcall function 004B810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B813A
Part of subcall function 004B810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 004B8141
Part of subcall function 004B810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 004B8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 004B86A3
_memcmp.LIBCMT ref: 004B86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004B86FC
HeapFree.KERNEL32(00000000), ref: 004B8703

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 8a08f12800c99b2526a92c37f26f3fe0468110b7deba633c4b36190f4f8504b5
Instruction ID: 9295ee8fa91a11e16f873d206e4b91eb7fdcdcd426cdad9a6278aab46bb5ef67
Opcode Fuzzy Hash: 8a08f12800c99b2526a92c37f26f3fe0468110b7deba633c4b36190f4f8504b5
Instruction Fuzzy Hash: 4C219071E01108EFDB10DFA4C949BEEB7B8EF45304F15406EE444AB241DB34AE05CB68

Function 0048098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 004809AE

Part of subcall function 00465A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,004C7896,?,?,00000000), ref: 00465A2C
Part of subcall function 00465A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,004C7896,?,?,00000000,?,?), ref: 00465A50

_fprintf.LIBCMT ref: 004809E5
OutputDebugStringW.KERNEL32(?), ref: 004B5DBB

Part of subcall function 00484AAA: _flsall.LIBCMT ref: 00484AC3

__setmode.LIBCMT ref: 00480A1A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: f73da0e9d7156ba8d2b583abb5b2b14745b5c14a6d614c2b641be297eb5120b2
Instruction ID: c2d814ed1ffd0606b7c910d031dfaadd960e685867a8d60837d8852157b7d93f
Opcode Fuzzy Hash: f73da0e9d7156ba8d2b583abb5b2b14745b5c14a6d614c2b641be297eb5120b2
Instruction Fuzzy Hash: 1D115775904205BFD704B3B69C469BEB76C9F91328F20051FF20467182FE3C594647AE

Function 004D1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 004D17A3

Part of subcall function 004D182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 004D184C
Part of subcall function 004D182D: InternetCloseHandle.WININET(00000000), ref: 004D18E9

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 11675524aaa06b181925bcda8f7bc3ed3df84180016f4fffccef46f2dbc08705
Instruction ID: da26a54abf7607d4b39e945dae8d11afab26c3b044bc798fc6a771536d93f6b8
Opcode Fuzzy Hash: 11675524aaa06b181925bcda8f7bc3ed3df84180016f4fffccef46f2dbc08705
Instruction Fuzzy Hash: 8D21C235200601BFEB129F609C50FBBBBA9FF88710F10402FFD5196761D7759811A7A8

Function 004C3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,004EFAC0), ref: 004C3A64
GetLastError.KERNEL32 ref: 004C3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 004C3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,004EFAC0), ref: 004C3ADF

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 89c51b255192143133ad66c9211046e7e65379e56589fdc1641af51fe62064f2
Instruction ID: bd40430dfa3ae1fcad076f670188b033f2191eff9c9b4e3eec06ba8d03f7cac9
Opcode Fuzzy Hash: 89c51b255192143133ad66c9211046e7e65379e56589fdc1641af51fe62064f2
Instruction Fuzzy Hash: 0B21B6745082019F8340DF25C881D6B77E4AF59369F108A2FF499C7292E736DE1ACB4B

Function 004950E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00495101

Part of subcall function 0048571C: __FF_MSGBANNER.LIBCMT ref: 00485733
Part of subcall function 0048571C: __NMSG_WRITE.LIBCMT ref: 0048573A
Part of subcall function 0048571C: RtlAllocateHeap.NTDLL(01750000,00000000,00000001,00000000,?,?,?,00480DD3,?), ref: 0048575F

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 267551daae80a6613795a84cc295a056b07b77ea2b28a927269b2d2963a3a88b
Instruction ID: 0f7a8c4ff60231459b824fee5a3b3cf1c885be001cae18b7981b841cc7281e87
Opcode Fuzzy Hash: 267551daae80a6613795a84cc295a056b07b77ea2b28a927269b2d2963a3a88b
Instruction Fuzzy Hash: 0711C172900A11AACF323F75A84675E3F989F51365B20493FF9049A251DF3C8982979C

Function 004D6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00465A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,004C7896,?,?,00000000), ref: 00465A2C
Part of subcall function 00465A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,004C7896,?,?,00000000,?,?), ref: 00465A50

gethostbyname.WSOCK32(?,?,?), ref: 004D6399
WSAGetLastError.WSOCK32(00000000), ref: 004D63A4
_memmove.LIBCMT ref: 004D63D1
inet_ntoa.WSOCK32(?), ref: 004D63DC

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: e5cc867693a3f91390072d0b41ef1d4595f2204832fc7b8a6d90da332394d331
Instruction ID: 7898e91c1a2400849720298e029975ae61488d441ab46497110d7ac652bf202f
Opcode Fuzzy Hash: e5cc867693a3f91390072d0b41ef1d4595f2204832fc7b8a6d90da332394d331
Instruction Fuzzy Hash: 2E116371500109AFCB00FBA5DD96CEE77B8AF04314B14416FF505A7262EB349E18CB6A

Function 004B8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 004B8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004B8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004B8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 004B8BA4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8dbdbb8759a390a36b63ad5afcae3575b27ced0add9b908a005315f1d2fe4ec3
Instruction ID: 6b381e5b1e43f7624bb2694a4e9ef70e5c9e6e1371f8938ac0339647e3ad7ddd
Opcode Fuzzy Hash: 8dbdbb8759a390a36b63ad5afcae3575b27ced0add9b908a005315f1d2fe4ec3
Instruction Fuzzy Hash: D2110A79901218FFDB11DBA5C885E9EBB78EB48710F2040A6E900B7250DA716E11DBA4

Function 00461290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00462612: GetWindowLongW.USER32(?,000000EB), ref: 00462623

DefDlgProcW.USER32(?,00000020,?), ref: 004612D8
GetClientRect.USER32(?,?), ref: 0049B5FB
GetCursorPos.USER32(?), ref: 0049B605
ScreenToClient.USER32(?,?), ref: 0049B610

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 8e1fee2d27eaea7a7c51ad25dfda9eae869c940185daaacce24c4fbe1ed9017b
Instruction ID: 530f1006d9228d3dd95b39a9cacc8b25cd563ad03319560f55c502e08c6a569d
Opcode Fuzzy Hash: 8e1fee2d27eaea7a7c51ad25dfda9eae869c940185daaacce24c4fbe1ed9017b
Instruction Fuzzy Hash: 3D115B75500099FBCB00DFA9D8959BE77B8FB05300F4404A6F901E7251E734BA568BAA

Function 004BD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 004BD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 004BD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 004BD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 004BD897

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: bbad8cad402bd82398f83674b11a8fa6cc50d25531e936249f77991a43d8e85d
Instruction ID: 69960b09fc005a5ddba06b31176e4abde6648d58b81a967b4d0d4ac0432fc23f
Opcode Fuzzy Hash: bbad8cad402bd82398f83674b11a8fa6cc50d25531e936249f77991a43d8e85d
Instruction Fuzzy Hash: 09118E75A05704DBE3209F50DC48F93BBBCEF00B01F1085AAA926C6081E7B5E9099BB5

Function 00496FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00496FDB

Part of subcall function 004976C2: __fltout2.LIBCMT ref: 004976EB

__cftog_l.LIBCMT ref: 00497001
__cftoe_l.LIBCMT ref: 00497033

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 40b5d19dba4ea2a1e612779b3304ba739c6d86d8e6d68375702379c198b1f455
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: FF019E3205814EBBCF125F84CC02CEE3F62BB18354F498426FE1858130C33AC9B1AB89

Function 004EB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 004EB2E4
ScreenToClient.USER32(?,?), ref: 004EB2FC
ScreenToClient.USER32(?,?), ref: 004EB320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004EB33B

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 7ee3cf1c57fdc88a1e2b173877df77b6e67ddf1064ea63552d60eef75f6b0241
Instruction ID: d5771e25167c7be7be0295e964b58518e94e01c4cf3ba26d274f1a3b78f346ff
Opcode Fuzzy Hash: 7ee3cf1c57fdc88a1e2b173877df77b6e67ddf1064ea63552d60eef75f6b0241
Instruction Fuzzy Hash: B8117775D00249EFDB01CFA9C484AEEBBF5FF08310F108166E914E3221D735AA558F94

Function 004C6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 004C6BE6

Part of subcall function 004C76C4: _memset.LIBCMT ref: 004C76F9

_memmove.LIBCMT ref: 004C6C09
_memset.LIBCMT ref: 004C6C16
LeaveCriticalSection.KERNEL32(?), ref: 004C6C26

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 39cd9a0a5accee00308ef20add8d6da575c23489ac231be66c658c06e4566f30
Instruction ID: 84208ea5efea45f2a2603ed7c031f31644de9dc5c4d39d70cb49165b294c31f1
Opcode Fuzzy Hash: 39cd9a0a5accee00308ef20add8d6da575c23489ac231be66c658c06e4566f30
Instruction Fuzzy Hash: F1F0303A200100ABCF416F56DC85E8ABF69EF45324B0480A9FE085E227D735A915CBB8

Function 00462218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00462231
SetTextColor.GDI32(?,000000FF), ref: 0046223B
SetBkMode.GDI32(?,00000001), ref: 00462250
GetStockObject.GDI32(00000005), ref: 00462258
GetWindowDC.USER32(?,00000000), ref: 0049BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0049BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0049BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0049BEC2
GetPixel.GDI32(00000000,?,?), ref: 0049BEE2
ReleaseDC.USER32(?,00000000), ref: 0049BEED

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 4318122306131794e665770f64dee6e0df720370c73587ef84c8e008f83b521f
Instruction ID: f10f0544af91aea2b9bc7695412434bb7cf40b17f934480a6a86016ad28c6198
Opcode Fuzzy Hash: 4318122306131794e665770f64dee6e0df720370c73587ef84c8e008f83b521f
Instruction Fuzzy Hash: A3E03031104184AAEF215FA4FC4D7D97F15EB15332F008376FA69480E287754984DB16

Function 004B8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 004B871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,004B82E6), ref: 004B8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,004B82E6), ref: 004B872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,004B82E6), ref: 004B8736

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 3a6a348dc4db475639b1bfd928d4c6555d3bb322f75e297d6163dd00aaa07cc6
Instruction ID: 80c1a8e069614a5911dbda8bade4206320e08fb131e8fb58e5bb710d102d081e
Opcode Fuzzy Hash: 3a6a348dc4db475639b1bfd928d4c6555d3bb322f75e297d6163dd00aaa07cc6
Instruction Fuzzy Hash: 6BE086366122529BD7205FB46D4CB973BACEF50795F158838B645CD041DA388449C764

Function 00466240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%O, xrefs: 0046624E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID:
String ID: %O
API String ID: 0-3936426106
Opcode ID: 25b03602d2f18cf162a059bc99602843964fa2e54689e5f89c6df48b567a19c7
Instruction ID: 2fe1b571c1a78224a867a57cff686f430a645173499736346a3277e39e8baa05
Opcode Fuzzy Hash: 25b03602d2f18cf162a059bc99602843964fa2e54689e5f89c6df48b567a19c7
Instruction Fuzzy Hash: 77B18E719001099ACF14EF95C8859FEBBB5EF44314F11412BE906A7291FB389E86CB9F

Function 004DAEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 004DAFAE

Strings

xbR, xrefs: 004DB010
xbR, xrefs: 004DAFE4

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: __itow_s
String ID: xbR$xbR
API String ID: 3653519197-3793243060
Opcode ID: b3b068341d12179b9d34d056bbab01dcccdae9c0174820e542098d5c36b6824b
Instruction ID: 37dc571709c3bab647541c7f344343d875643f5e0b6f650cd0573c98ff4f4963
Opcode Fuzzy Hash: b3b068341d12179b9d34d056bbab01dcccdae9c0174820e542098d5c36b6824b
Instruction Fuzzy Hash: 5BB19C70A00109EBCB14DF55C8A0EAEBBB9EF58304F14805FF9459B391EB38D941CBA9

Function 004CAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FC86: _wcscpy.LIBCMT ref: 0047FCA9

Part of subcall function 00469837: __itow.LIBCMT ref: 00469862
Part of subcall function 00469837: __swprintf.LIBCMT ref: 004698AC

__wcsnicmp.LIBCMT ref: 004CB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 004CB0F6

Strings

LPT, xrefs: 004CB027

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: d482024e1605ecab7800b83c6c4e5beec83cdc60ec3e53e8f43a4c96c4287f06
Instruction ID: 199d34ee66726cbb12c9f27a2642e212ef98fe639246de1e7ca4d5528645b858
Opcode Fuzzy Hash: d482024e1605ecab7800b83c6c4e5beec83cdc60ec3e53e8f43a4c96c4287f06
Instruction Fuzzy Hash: B0618175A00214EFCB54DF95C892FAEB7B4EB08350F04405EF916AB351DB78AE44CB99

Function 00472957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00472968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00472981

Strings

@, xrefs: 00472975

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: a5ac8a21e38926d216e65ee8399ecd8d6736e2fe329c06e2d352ba63930f1cd3
Instruction ID: 1feb17087dd49e6c82bfbec323a1c1746531e0de43142381a35c6286d2286fe8
Opcode Fuzzy Hash: a5ac8a21e38926d216e65ee8399ecd8d6736e2fe329c06e2d352ba63930f1cd3
Instruction Fuzzy Hash: 855138B14187449BD320AF11D886BAFB7E8FB85344F41895DF2D8810A1EF75892DCB5B

Function 004C9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00464F0B: __fread_nolock.LIBCMT ref: 00464F29

_wcscmp.LIBCMT ref: 004C9824
_wcscmp.LIBCMT ref: 004C9837

Strings

FILE, xrefs: 004C9770

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: ef65af2b6814b169ec69d148089a77bbf6f49bf1e3a65acaf2ae1e240099e32a
Instruction ID: aabdc2330f752df4356fe7725f904d87aa15f5a883d58926a29683d04eccdf9d
Opcode Fuzzy Hash: ef65af2b6814b169ec69d148089a77bbf6f49bf1e3a65acaf2ae1e240099e32a
Instruction Fuzzy Hash: DF41DB75A00219BADF24AEA1CC45FEF77BDDF85714F00046FF904A7180DA759D048B69

Function 004A0574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 004A057F

Strings

DdR, xrefs: 0046A151
DdR, xrefs: 0046A317

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClearVariant
String ID: DdR$DdR
API String ID: 1473721057-548003069
Opcode ID: 9ec49ae600bf356b5796da66b0875929bcbd93ba244e14840225da53b310e2ca
Instruction ID: 98b63ffefcb6eb6cc70e4c0d3463206ba5d0ea54a32d6dd0ae0ebc361503eadc
Opcode Fuzzy Hash: 9ec49ae600bf356b5796da66b0875929bcbd93ba244e14840225da53b310e2ca
Instruction Fuzzy Hash: 515102786047418FDB54DF18C480A1ABBE1BF9A344F54485EE8859B361E339EC96CF87

Function 004D258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004D259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 004D25D4

Strings

|, xrefs: 004D25A5

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 23abd9fdbb3dfddcad798808471aac4f774f3a2d3b0d5291a2495788289c69d4
Instruction ID: dc1b2afbd590ca5a8aebac3f0f9b93820087ca003b967bbe980647b7c758d8fb
Opcode Fuzzy Hash: 23abd9fdbb3dfddcad798808471aac4f774f3a2d3b0d5291a2495788289c69d4
Instruction Fuzzy Hash: 96314C71800219EBCF01EFA1CC85EEEBFB8FF18304F10005AF914A6266EB359916DB65

Function 004E7A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 004E7B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 004E7B76

Strings

', xrefs: 004E7ACA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 55712b10053389f5e915e5345d86802d8e1a2c6aa58baf460649d2d40d2f9954
Instruction ID: 592b5a975ca25f6f54738cd5686b0cfd214a1cfe57ee409354b516663f87291a
Opcode Fuzzy Hash: 55712b10053389f5e915e5345d86802d8e1a2c6aa58baf460649d2d40d2f9954
Instruction Fuzzy Hash: A5413B74A042499FDB14CF65C880BEABBB5FF09315F10016AE904EB341E774A941CF94

Function 004E6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 004E6B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 004E6B53

Strings

static, xrefs: 004E6AB3

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 2831c768321fbc1dd669535af7378e5ca11781ce0938dd4dd04c18846a0c60e6
Instruction ID: eb4336b135a66ca8ef35a5f18b4c090f844742f8d1ed7897c7a48376ace482a3
Opcode Fuzzy Hash: 2831c768321fbc1dd669535af7378e5ca11781ce0938dd4dd04c18846a0c60e6
Instruction Fuzzy Hash: 6C31C471100244AEDB109F66CC80BFB73A9FF58764F11862EF9A5D7290DB34AC41CB68

Function 004C28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 004C294C

Strings

0, xrefs: 004C290A

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a6f8a6a2698ed2d4580ac2a3abf3fd1429375a2542ced468423d4eea57759d30
Instruction ID: aaae1da0226c190591b68f8cd592e65d4cd46bfb61ba917d8fe65b685e671dbd
Opcode Fuzzy Hash: a6f8a6a2698ed2d4580ac2a3abf3fd1429375a2542ced468423d4eea57759d30
Instruction Fuzzy Hash: C531D479600305EBDBA4DE48CA85FAFBBF4EF05350F14002EE885A62A1D7F89944CB19

Function 004E66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004E6761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004E676C

Strings

Combobox, xrefs: 004E672E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 4f8e755618a9be7a2e7213d0b9df71b2336c0c283bb827a48e6061fcbab02afa
Instruction ID: ef8c1baccda7f2beb7b1e6fb09ce67b3441edb05a5c0faebbd4d7f73c89f48cb
Opcode Fuzzy Hash: 4f8e755618a9be7a2e7213d0b9df71b2336c0c283bb827a48e6061fcbab02afa
Instruction Fuzzy Hash: 9311B6712002486FEF119F55CC80EAB376AEB543A9F11012AF91897290D6399C5187A4

Function 004E6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00461D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00461D73
Part of subcall function 00461D35: GetStockObject.GDI32(00000011), ref: 00461D87
Part of subcall function 00461D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00461D91

GetWindowRect.USER32(00000000,?), ref: 004E6C71
GetSysColor.USER32(00000012), ref: 004E6C8B

Strings

static, xrefs: 004E6C4E

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 36bc31a70243b21fd1be5a2d3d76b9ab5177b70de936b8e001df45dbf1c1057c
Instruction ID: cd091bc1cfef98515122a9afbeaebf11c6dd32d1a5e0fb0dcc8cc6c59a810ac9
Opcode Fuzzy Hash: 36bc31a70243b21fd1be5a2d3d76b9ab5177b70de936b8e001df45dbf1c1057c
Instruction Fuzzy Hash: 5821A972510249AFDF04CFB9CC45AEA7BB8FB08305F104629FD95D2240E738E850DB64

Function 004E6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 004E69A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 004E69B1

Strings

edit, xrefs: 004E6986

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 0da36f8a92d851111d274e345ecb90c4cdc0027e2a068c9400cb7d6cb282c2eb
Instruction ID: 5538d9fc0101f1743e67501a40c300efd86f1dedecc2fdaccd6065cc28949d6f
Opcode Fuzzy Hash: 0da36f8a92d851111d274e345ecb90c4cdc0027e2a068c9400cb7d6cb282c2eb
Instruction Fuzzy Hash: 3911D0B1000184ABEB104F359C40AAB3669EF253B9F110725F9A0962E1C739DC419768

Function 004C29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004C2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 004C2A41

Strings

0, xrefs: 004C2A18

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: b00e398e0a492c61efb2330c20ea220672234740d5c7869468edeb268aa214a1
Instruction ID: 1ad8e3ed5a733bbb727ab0a591c1fb8c800925b29590527106c802ef399e1823
Opcode Fuzzy Hash: b00e398e0a492c61efb2330c20ea220672234740d5c7869468edeb268aa214a1
Instruction Fuzzy Hash: 7C11263A900519ABCB70DB98DE44FAB77B8AB46300F14403BE815E7390D7F5AD0AC799

Function 004D21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 004D222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 004D2255

Strings

<local>, xrefs: 004D221D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: d15e5f1a530956c9314c498bb17de0fb841f8104d835338f00f2b48790b2d2a8
Instruction ID: 8cd6ee06d3dc00d69382a126126a2020b87c5c415879ac319fd91512819db017
Opcode Fuzzy Hash: d15e5f1a530956c9314c498bb17de0fb841f8104d835338f00f2b48790b2d2a8
Instruction Fuzzy Hash: 77110E70601266BEDB258F518DA8EFBFBA8FF26351F10826BF90486300D2B45985D6F5

Function 0047092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00463C14,005252F8,?,?,?), ref: 0047096E

Part of subcall function 00467BCC: _memmove.LIBCMT ref: 00467C06

_wcscat.LIBCMT ref: 004A4CB7

Strings

SR, xrefs: 004709AE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: SR
API String ID: 257928180-4039289555
Opcode ID: 68ed9b8eb6e90021ca2a3770d73a71a89e252405c00617d0820bf0b7982fc3dc
Instruction ID: daf948bd142e6622a95b489fda0748620af7ebccee88fceab5b373cbf80edb6c
Opcode Fuzzy Hash: 68ed9b8eb6e90021ca2a3770d73a71a89e252405c00617d0820bf0b7982fc3dc
Instruction Fuzzy Hash: 3311E9F19052089B8B00FF74C801EDE77E8FF18359B0084ABB64CD7281FAB8A6884719

Function 004B8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004BAA99: GetClassNameW.USER32(?,?,000000FF), ref: 004BAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 004B8E73

Strings

ComboBox, xrefs: 004B8E12
ListBox, xrefs: 004B8E3D

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 62707e7018054347f23034a105b15789966ef60637d4106eda95001bf5c86509
Instruction ID: 153a93db2d6a8bdf7bcd8702d677333a2e94dbb33d5085dce57acb665e2ce3d6
Opcode Fuzzy Hash: 62707e7018054347f23034a105b15789966ef60637d4106eda95001bf5c86509
Instruction Fuzzy Hash: 0801F5B1601218AB9B14EBA5CC418FE7768AF15320B000A1EB871972D2EE39580CC665

Function 004B8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004BAA99: GetClassNameW.USER32(?,?,000000FF), ref: 004BAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 004B8D6B

Strings

ComboBox, xrefs: 004B8D0A
ListBox, xrefs: 004B8D35

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 72fa31518d19a6a950fa0f19bbd6e6b5907d184e43d6eebd4cc820860b13ebbb
Instruction ID: e63e559145fec7120f7ee42bc3906f8bc15f48ffd4bba336c59debee2835e22c
Opcode Fuzzy Hash: 72fa31518d19a6a950fa0f19bbd6e6b5907d184e43d6eebd4cc820860b13ebbb
Instruction Fuzzy Hash: D401D4B1A41108BBDB15EBE1C992AFF77AC9F25300F10001FB801672D2EE185E0CD67A

Function 004B8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00467DE1: _memmove.LIBCMT ref: 00467E22

Part of subcall function 004BAA99: GetClassNameW.USER32(?,?,000000FF), ref: 004BAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 004B8DEE

Strings

ComboBox, xrefs: 004B8D8F
ListBox, xrefs: 004B8DBA

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 0d6b5870696f2c4a024b558f2f37578719ea82f8384c992e9c4130eec41faaa3
Instruction ID: 13a23865dda0617654434354f48dd2dfae4dcf1269576b2d2df1265404403914
Opcode Fuzzy Hash: 0d6b5870696f2c4a024b558f2f37578719ea82f8384c992e9c4130eec41faaa3
Instruction Fuzzy Hash: 2001A2B1A41109B7DB11EBA5C982AFF77AC9F25304F10041FB84563292EE294E1DD67A

Function 004BC4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 004BC534

Part of subcall function 004BC816: _memmove.LIBCMT ref: 004BC860
Part of subcall function 004BC816: VariantInit.OLEAUT32(00000000), ref: 004BC882
Part of subcall function 004BC816: VariantCopy.OLEAUT32(00000000,?), ref: 004BC88C

VariantClear.OLEAUT32(?), ref: 004BC556

Strings

d}Q, xrefs: 004BC517

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}Q
API String ID: 2932060187-912448567
Opcode ID: 105b7e451877bbd011169614eb3a34ea4095277f7d247cc2b02e0144e06e8ef7
Instruction ID: 8a4dd823f9596ab9d9c96aaf24b7921f9286ce9bccb9c010612ce709323569c2
Opcode Fuzzy Hash: 105b7e451877bbd011169614eb3a34ea4095277f7d247cc2b02e0144e06e8ef7
Instruction Fuzzy Hash: B311FEB19007089FC710DF9AD8C489AB7F8FF18314B50852FE58A97651E771AA48CB54

Function 004C4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 004C4F46
_wcscmp.LIBCMT ref: 004C4F58

Strings

#32770, xrefs: 004C4F52

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: e66776fc426a5d031c9a9767ca5273b719f5581b9c8080e3fd3116ce1e1fda91
Instruction ID: 272e03b550517ef9b944ffbb4bf3fa0c3581866d112e306a535ace8cc690a20a
Opcode Fuzzy Hash: e66776fc426a5d031c9a9767ca5273b719f5581b9c8080e3fd3116ce1e1fda91
Instruction Fuzzy Hash: 57E09B3660022826D7209A559C45FE7FBACEB55B61F01016BFD04D6151D5709A4587D4

Function 0049B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0049B314: _memset.LIBCMT ref: 0049B321

Part of subcall function 00480940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0049B2F0,?,?,?,0046100A), ref: 00480945

IsDebuggerPresent.KERNEL32(?,?,?,0046100A), ref: 0049B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0046100A), ref: 0049B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0049B2FE

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 2ac80b60398df5f4e8c81c6763f4c880ddad22eb185fd83b5a258f1ad7617bba
Instruction ID: 9a74a85ecd72e84993a886e9eb3c2e122eb92b37ddc73ca7c1b7a9ff971ec2ef
Opcode Fuzzy Hash: 2ac80b60398df5f4e8c81c6763f4c880ddad22eb185fd83b5a258f1ad7617bba
Instruction Fuzzy Hash: C4E039702007408ADB30DF29E5086567AE8EF00708F00897EE856CA381E7B89408CBA5

Function 004A1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 004A1775

Part of subcall function 004DBFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,004A195E,?), ref: 004DBFFE
Part of subcall function 004DBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 004DC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 004A196D

Strings

WIN_XPe, xrefs: 004A1788

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: b395a998c862b779fe26165f946f0b1d36d56ea3285f936128512e2ffd45b632
Instruction ID: d5d518f7dea45d459a77d4252ffec6d65b21b4ab9345262d50bfb4d5679c30c9
Opcode Fuzzy Hash: b395a998c862b779fe26165f946f0b1d36d56ea3285f936128512e2ffd45b632
Instruction Fuzzy Hash: 22F06DB0800008DFCB15DB91CAC4AECBBF8BB29300F10109BE002A61A1D7384F8ADF69

Function 004E5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004E596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 004E5981

Part of subcall function 004C5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004C52BC

Strings

Shell_TrayWnd, xrefs: 004E5967

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 481feacde648e229595f6abc7f2dc736d476f11a73f076050e676641ad9f536d
Instruction ID: 2c0ac730ce7d75c5ce85af41e7f0f0c5effea16249108c166dd2edf75b7233fb
Opcode Fuzzy Hash: 481feacde648e229595f6abc7f2dc736d476f11a73f076050e676641ad9f536d
Instruction Fuzzy Hash: 90D0C935384351B7E6A4AB709C8BFE66A55BB50B50F010839B249AE1D2D9E4A844CA58

Function 004E5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 004E59AE
PostMessageW.USER32(00000000), ref: 004E59B5

Part of subcall function 004C5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 004C52BC

Strings

Shell_TrayWnd, xrefs: 004E59A7

Memory Dump Source

Source File: 00000000.00000002.2114961828.0000000000461000.00000020.00000001.01000000.00000003.sdmp, Offset: 00460000, based on PE: true

Associated: 00000000.00000002.2114947709.0000000000460000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115040302.0000000000514000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115111955.000000000051E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2115154531.0000000000527000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_460000_Shipping Documents 72908672134.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: cbb4a5c64f14429f86d39a6dfdb1ff28c5ce381556a4724689ee4231b67d5f25
Instruction ID: 36ea77f4a18005680d33b0aeaf7b6a0c8862b2933153357323a436ed49bae95b
Opcode Fuzzy Hash: cbb4a5c64f14429f86d39a6dfdb1ff28c5ce381556a4724689ee4231b67d5f25
Instruction Fuzzy Hash: 3FD0C9313803517BE6A4AB709C8BFD66A55BB54B50F010839B245AE1D2D9E4A844CA58

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipping Documents 72908672134.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autCE59.tmp

C:\Users\user\AppData\Local\Temp\scroll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
Shipping Documents 72908672134.exe

Function 00463B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 004649A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00464E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 004C9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00463015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00463041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 0046708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00463633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00463A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00463766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 0046F76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 019B50E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 004639D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 019B4ED0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
fileCOMMON

Function 0046407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre