Edit tour

Windows Analysis Report
R55-RFQ.exe

Overview

General Information

Sample name:	R55-RFQ.exe
Analysis ID:	1571274
MD5:	152bed497cb453798846b46a9cbe8710
SHA1:	9948a22ad3b4f15f658a6c8ddbe34c99a485ec50
SHA256:	38100e0eb4432850500bed29244869b5e9b8d328e907352605b35f923ac903a9
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

R55-RFQ.exe (PID: 4184 cmdline: "C:\Users\user\Desktop\R55-RFQ.exe" MD5: 152BED497CB453798846B46A9CBE8710)

RegSvcs.exe (PID: 5412 cmdline: "C:\Users\user\Desktop\R55-RFQ.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.jeepcommerce.rs", "Username": "w133y@jeepcommerce.rs", "Password": "Q6]7rLSD*gU2"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3918436813.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3496d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x318f7:$s2: GetPrivateProfileString 0x30fd4:$s3: get_OSFullName 0x32638:$s5: remove_Key 0x3279b:$s5: remove_Key 0x336f3:$s6: FtpWebRequest 0x346e5:$s7: logins 0x34c57:$s7: logins 0x3795c:$s7: logins 0x37a1a:$s7: logins 0x3936d:$s7: logins 0x385b4:$s9: 1.85 (Hash, version 2, native byte-order)
Process Memory Space: R55-RFQ.exe PID: 4184	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: R55-RFQ.exe PID: 4184	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 5412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 5412	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3496d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x318f7:$s2: GetPrivateProfileString 0x30fd4:$s3: get_OSFullName 0x32638:$s5: remove_Key 0x3279b:$s5: remove_Key 0x336f3:$s6: FtpWebRequest 0x346e5:$s7: logins 0x34c57:$s7: logins 0x3795c:$s7: logins 0x37a1a:$s7: logins 0x3936d:$s7: logins 0x385b4:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.R55-RFQ.exe.3660000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.R55-RFQ.exe.3660000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.R55-RFQ.exe.3660000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.R55-RFQ.exe.3660000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34703:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34775:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x347ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34891:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x348fb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3496d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34a03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34a93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.R55-RFQ.exe.3660000.1.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x318f7:$s2: GetPrivateProfileString 0x30fd4:$s3: get_OSFullName 0x32638:$s5: remove_Key 0x3279b:$s5: remove_Key 0x336f3:$s6: FtpWebRequest 0x346e5:$s7: logins 0x34c57:$s7: logins 0x3795c:$s7: logins 0x37a1a:$s7: logins 0x3936d:$s7: logins 0x385b4:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.R55-RFQ.exe.3660000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.R55-RFQ.exe.3660000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.R55-RFQ.exe.3660000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32903:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32975:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x329ff:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32a91:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32afb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32b6d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32c03:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32c93:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.R55-RFQ.exe.3660000.1.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2faf7:$s2: GetPrivateProfileString 0x2f1d4:$s3: get_OSFullName 0x30838:$s5: remove_Key 0x3099b:$s5: remove_Key 0x318f3:$s6: FtpWebRequest 0x328e5:$s7: logins 0x32e57:$s7: logins 0x35b5c:$s7: logins 0x35c1a:$s7: logins 0x3756d:$s7: logins 0x367b4:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 9 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://ftp.jeepcommerce.rs

Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.jeepcommerce.rs", "Username": "w133y@jeepcommerce.rs", "Password": "Q6]7rLSD*gU2"}

Multi AV Scanner detection for submitted file

Source: R55-RFQ.exe

Virustotal: Detection: 37%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: R55-RFQ.exe

Joe Sandbox ML: detected

Source: R55-RFQ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: R55-RFQ.exe, 00000000.00000003.1495977819.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, R55-RFQ.exe, 00000000.00000003.1496110682.0000000003840000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: R55-RFQ.exe, 00000000.00000003.1495977819.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, R55-RFQ.exe, 00000000.00000003.1496110682.0000000003840000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_008B445A
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BC6D1 FindFirstFileW,FindClose,	0_2_008BC6D1
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_008BC75C
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008BEF95
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008BF0F2
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008BF3F3
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008B37EF
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008B3B12
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008BBCBC

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: unknown

DNS query: name: ip-api.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008C22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_008C22EE

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ftp.jeepcommerce.rs

Source: RegSvcs.exe, 00000002.00000002.3918436813.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.jeepcommerce.rs
Source: RegSvcs.exe, 00000002.00000002.3918436813.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: R55-RFQ.exe, 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3918436813.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.3918436813.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: R55-RFQ.exe, 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, NmHr1WHWKO.cs

.Net Code: _5X3Zzx6JgyO

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008C4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_008C4164

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008C4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_008C4164

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008C3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_008C3F66

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008B001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_008B001C

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008DCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_008DCABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00853B3A
Source: R55-RFQ.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: R55-RFQ.exe, 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_c08decdd-a
Source: R55-RFQ.exe, 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_adcd78ab-4
Source: R55-RFQ.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_97b3b301-a
Source: R55-RFQ.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_35bc566e-7

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: R55-RFQ.exe

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008BA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_008BA1EF

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008A8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_008A8310

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008B51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_008B51BD

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0085E6A0	0_2_0085E6A0
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0087D975	0_2_0087D975
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0085FCE0	0_2_0085FCE0
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008721C5	0_2_008721C5
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008862D2	0_2_008862D2
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008D03DA	0_2_008D03DA
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0088242E	0_2_0088242E
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008725FA	0_2_008725FA
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008666E1	0_2_008666E1
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008AE616	0_2_008AE616
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0088878F	0_2_0088878F
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B8889	0_2_008B8889
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00868808	0_2_00868808
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00886844	0_2_00886844
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008D0857	0_2_008D0857
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0087CB21	0_2_0087CB21
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00886DB6	0_2_00886DB6
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00866F9E	0_2_00866F9E
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00863030	0_2_00863030
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00873187	0_2_00873187
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0087F1D9	0_2_0087F1D9
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00851287	0_2_00851287
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00871484	0_2_00871484
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00865520	0_2_00865520
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00877696	0_2_00877696
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00865760	0_2_00865760
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00871978	0_2_00871978
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00889AB5	0_2_00889AB5
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00871D90	0_2_00871D90
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0087BDA6	0_2_0087BDA6
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008D7DDB	0_2_008D7DDB
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_00863FE0	0_2_00863FE0
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0085DF00	0_2_0085DF00
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_01056A28	0_2_01056A28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_011F4A88	2_2_011F4A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_011FADA8	2_2_011FADA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_011FECA8	2_2_011FECA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_011F3E70	2_2_011F3E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_011F41B8	2_2_011F41B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C7E68	2_2_067C7E68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C66E0	2_2_067C66E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C5268	2_2_067C5268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067CC290	2_2_067CC290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067CB328	2_2_067CB328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C2BB8	2_2_067C2BB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C7788	2_2_067C7788
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067CE4B8	2_2_067CE4B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C0040	2_2_067C0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C59D8	2_2_067C59D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_067C0014	2_2_067C0014

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: String function: 00857DE1 appears 35 times
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: String function: 00878900 appears 42 times
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: String function: 00870AE3 appears 70 times

Source: R55-RFQ.exe, 00000000.00000003.1496790668.00000000037C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs R55-RFQ.exe
Source: R55-RFQ.exe, 00000000.00000003.1497708685.00000000039BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs R55-RFQ.exe
Source: R55-RFQ.exe, 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename90cf818a-462d-43ad-9b06-442ae93cc408.exe4 vs R55-RFQ.exe

Source: R55-RFQ.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, ISZbPXDvPz.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, nAXAT51m.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, YpS.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@2/2

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008BA06A GetLastError,FormatMessageW,

0_2_008BA06A

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008A81CB AdjustTokenPrivileges,CloseHandle,		0_2_008A81CB
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008A87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_008A87E1

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008BB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_008BB3FB

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008CEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_008CEE0D

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008BC397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_008BC397

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00854E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00854E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\R55-RFQ.exe

File created: C:\Users\user\AppData\Local\Temp\aut46B.tmp

Jump to behavior

Source: R55-RFQ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: R55-RFQ.exe

Virustotal: Detection: 37%

Source: unknown	Process created: C:\Users\user\Desktop\R55-RFQ.exe "C:\Users\user\Desktop\R55-RFQ.exe"
Source: C:\Users\user\Desktop\R55-RFQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\R55-RFQ.exe"
Source: C:\Users\user\Desktop\R55-RFQ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\R55-RFQ.exe"	Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: R55-RFQ.exe

Static file information: File size 1070080 > 1048576

Source: R55-RFQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: R55-RFQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: R55-RFQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: R55-RFQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: R55-RFQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: R55-RFQ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: R55-RFQ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: R55-RFQ.exe, 00000000.00000003.1495977819.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, R55-RFQ.exe, 00000000.00000003.1496110682.0000000003840000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: R55-RFQ.exe, 00000000.00000003.1495977819.00000000036A0000.00000004.00001000.00020000.00000000.sdmp, R55-RFQ.exe, 00000000.00000003.1496110682.0000000003840000.00000004.00001000.00020000.00000000.sdmp

Source: R55-RFQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: R55-RFQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: R55-RFQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: R55-RFQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: R55-RFQ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00854B37 LoadLibraryA,GetProcAddress,

0_2_00854B37

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00878945 push ecx; ret

0_2_00878958

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_008548D7
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008D5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_008D5376

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00873187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00873187

Source: C:\Users\user\Desktop\R55-RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\R55-RFQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\R55-RFQ.exe

API/Special instruction interceptor: Address: 105664C

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegSvcs.exe, 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: R55-RFQ.exe, 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLESELECT * FROM WIN32_COMPUTERSYSTEM

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594406	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1067			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8785			Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-105219

Source: C:\Users\user\Desktop\R55-RFQ.exe

API coverage: 4.6 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_008B445A
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BC6D1 FindFirstFileW,FindClose,	0_2_008BC6D1
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_008BC75C
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008BEF95
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008BF0F2
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008BF3F3
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008B37EF
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008B3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008B3B12
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008BBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008BBCBC

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_008549A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596311	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594406	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox
Source: R55-RFQ.exe, 00000000.00000003.1461755208.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareworkstation.exe
Source: RegSvcs.exe, 00000002.00000002.3920328239.00000000062BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\R55-RFQ.exe

API call chain: ExitProcess graph end node

graph_0-104033

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_011F7078 CheckRemoteDebuggerPresent,

2_2_011F7078

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008C3F09 BlockInput,

0_2_008C3F09

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00853B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00853B3A

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00885A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00885A7C

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00854B37 LoadLibraryA,GetProcAddress,

0_2_00854B37

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_01055288 mov eax, dword ptr fs:[00000030h]	0_2_01055288
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_01056918 mov eax, dword ptr fs:[00000030h]	0_2_01056918
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_010568B8 mov eax, dword ptr fs:[00000030h]	0_2_010568B8

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008A80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_008A80A9

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0087A124 SetUnhandledExceptionFilter,		0_2_0087A124
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_0087A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0087A155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\R55-RFQ.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\R55-RFQ.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: D3A008

Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008A87B1 LogonUserW,

0_2_008A87B1

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00853B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00853B3A

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_008548D7

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008B4C27 mouse_event,

0_2_008B4C27

Source: C:\Users\user\Desktop\R55-RFQ.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\R55-RFQ.exe"

Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008A7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_008A7CAF

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008A874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_008A874B

Source: R55-RFQ.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: R55-RFQ.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_0087862B cpuid

0_2_0087862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00884E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00884E87

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00891E06 GetUserNameW,

0_2_00891E06

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_00883F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00883F3A

Source: C:\Users\user\Desktop\R55-RFQ.exe

Code function: 0_2_008549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_008549A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3918436813.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: R55-RFQ.exe PID: 4184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5412, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: R55-RFQ.exe	Binary or memory string: WIN_81
Source: R55-RFQ.exe	Binary or memory string: WIN_XP
Source: R55-RFQ.exe	Binary or memory string: WIN_XPe
Source: R55-RFQ.exe	Binary or memory string: WIN_VISTA
Source: R55-RFQ.exe	Binary or memory string: WIN_7
Source: R55-RFQ.exe	Binary or memory string: WIN_8
Source: R55-RFQ.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: R55-RFQ.exe PID: 4184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5412, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.R55-RFQ.exe.3660000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3918436813.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: R55-RFQ.exe PID: 4184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5412, type: MEMORYSTR

Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008C6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_008C6283
Source: C:\Users\user\Desktop\R55-RFQ.exe	Code function: 0_2_008C6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_008C6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	231 Virtualization/Sandbox Evasion	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
R55-RFQ.exe	38%	Virustotal		Browse
R55-RFQ.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://ftp.jeepcommerce.rs	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ftp.jeepcommerce.rs	195.252.110.253	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ftp.jeepcommerce.rs	RegSvcs.exe, 00000002.00000002.3918436813.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.dyn.com/	R55-RFQ.exe, 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.3918436813.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ip-api.com	RegSvcs.exe, 00000002.00000002.3918436813.0000000002F01000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	false
195.252.110.253	ftp.jeepcommerce.rs	Serbia		6700	BEOTEL-AShttpwwwbeotelnetRS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571274
Start date and time:	2024-12-09 08:30:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	R55-RFQ.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 274
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:31:47	API Interceptor	10058224x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	YXHoexbTFp.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/json/?fields=225545
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	ip-api.com/line/?fields=hosting
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	ip-api.com/line/?fields=hosting
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	ip-api.com/line?fields=query,country
	xooSsYaHN0.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	ip-api.com/json
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	ip-api.com/json/
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	ip-api.com/json/
	u7e3vb5dfk.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	YXHoexbTFp.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	file.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	208.95.112.1
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	208.95.112.1
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	xooSsYaHN0.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	208.95.112.1
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	208.95.112.1
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	u7e3vb5dfk.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
ftp.jeepcommerce.rs	2zaGROpmo0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	b83NG35487.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	INV & BANK DETAILS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	PO#150003191.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	dg4Bwri6Cy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	DHOYXfCAeB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	RgAm3scap8.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	EgjKf0gmd1.exe	Get hash	malicious	AgentTesla	Browse	195.252.110.253

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	YXHoexbTFp.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
	file.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	208.95.112.1
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	208.95.112.1
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	208.95.112.1
	xooSsYaHN0.exe	Get hash	malicious	Go Stealer, Skuld Stealer	Browse	208.95.112.1
	ea4LTmpMwl.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkTortilla, Discord Token Stealer, DotStealer, LummaC Stealer, Stealc	Browse	208.95.112.1
	file.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	208.95.112.1
	u7e3vb5dfk.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
BEOTEL-AShttpwwwbeotelnetRS	2zaGROpmo0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	Eemw0Iqp2J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	b83NG35487.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	arm.nn-20241201-1515.elf	Get hash	malicious	Mirai, Okiru	Browse	62.193.140.91
	[Purchase Order] PO2411024.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	INV & BANK DETAILS.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	PO#150003191.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	dg4Bwri6Cy.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	DHOYXfCAeB.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253
	RgAm3scap8.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	195.252.110.253

Process:	C:\Users\user\Desktop\R55-RFQ.exe
File Type:	data
Category:	dropped
Size (bytes):	145390
Entropy (8bit):	7.9304143760835295
Encrypted:	false
SSDEEP:	3072:8IoxUa8qdxuUZfxaGFHkrovYZ3aIVyssBv+d1KdQzzjAw1UtUVmTsaHGfRnzjWJ4:aUXUZf4lov23ayyB2nKyAw1UtIQXHGFF
MD5:	1D24235A8300D179BC629B5109282231
SHA1:	A306A832221F5D2CC3B693188A26E465FBAD6536
SHA-256:	20145FEE264D8E87FCD154C8DC097BC4E39ED0F36F721A7F7367E5E43C08C57D
SHA-512:	DFFD13F9EAEB4740B96472A457D8E85430AFF88AFD2581BA34D7D795A0C10287DC3BDA48C49F513DED52C5225BB45B2CB7CFDC1D8D66C3C61F3B99A72E88F607
Malicious:	false
Reputation:	low
Preview:	EA06.....Zu4.\|.C...N.g9.S..J=2...Tfs.`.ni...O..4.S.3zg.a....-..[.O.\.A>..n..^E#..d2+d.{8....E..c.H.R..r}3..'f1.....\|.#k..@....h.z...Q....../.9..l.44...r#3....J...R.4...sQ9.2.;...R.s.S)......4.fs....(....a.uh...Z..i ._="sU.....~....^.....H.F@..x..3...............'z.V.M...T.^...N[..B...\|i....X.D...2...G...@ ..U@'>..B..S..qt....q.Nk.8_B.H.Y&S.x.9B......%{...f..m.cr...V._.u1u.N&A..P....O.....L.'e...d.]....\..-]......8.ruF.pr.....G...1....).S7.h...x....:t..I.q..{_2SJ.do.\...o.m.P...-..h..>.jm...d...;j....W.....N:..........tj........5..ns.y\.5...1S .2j..O.4.0....4$`....t.. .p..>........{...B..hL...$.G.x.u.....#_v.H..C..s.[..3....(.n..e.^....<..&..l..........Ou.U".z..1..N)T..n.C.....7.....z.:.L..a.x>...m-]\|e.....}...B{....g9....NGZ....7 ..3..4l...d.MC...9.J. ..e..<.g;..h..d......I<........P.W..Z...P..+.......q.:=2.7..+.(..G..j....4D.t...H.K ....)UM\|..L.O.P.#.k7.4,.).h.PX..9..wL..m0.$..V...4.l..U..h.j.....S'5032.H.......qs....e.g9.S,........"r.m..

C:\Users\user\AppData\Local\Temp\phagocytosed

Download File

Process:	C:\Users\user\Desktop\R55-RFQ.exe
File Type:	data
Category:	dropped
Size (bytes):	245248
Entropy (8bit):	6.468793210984542
Encrypted:	false
SSDEEP:	6144:cvZ4Lufqp7UHAgnISQLti2skv7e38R2RDd6AzzP6Bh:cvZ+uSNWAMISQxip936ovP6Bh
MD5:	21C602C9666CAAF13BCE2F1B115D8400
SHA1:	CFF30497B627E5843E82EA0F1BEC4CEDDCBA5BD4
SHA-256:	23E94ECB309B55169422FDB59A15D839F6A26DA87593A3F89227B274ABE88743
SHA-512:	DF1F7E5A3B1AEF077A36273929C067635CAD95275EA66C09702474DB2DEA6AF13052680636044044368ED4DCEB1C6F5C70546032798453CBFEA864D94B5EB52C
Malicious:	false
Reputation:	low
Preview:	.i.LO9YCCLVH..39.L9YCGLV.VQ39LL9YCGLVHVQ39LL9YCGLVHVQ39LL9YC.LVHXN.7L.0.b.M..w.[P?lI+, >7%v2RW"#My!"l$=8qZWl.v.c#2-x\>3hL9YCGLV..Q3uMO9.k.)VHVQ39LL.YAFGWCVQ.:LL1YCGLVHx.09Ll9YC.OVHV.39lL9YAGLRHVQ39LL=YCGLVHVQ.=LL;YCGLVHTQs.LL)YCWLVHVA39\L9YCGLFHVQ39LL9YCG..KV.39LL.ZC.IVHVQ39LL9YCGLVHVQ39LH9UCGLVHVQ39LL9YCGLVHVQ39LL9YCGLVHVQ39LL9YCGLVHVQ39LL9YcGL^HVQ39LL9YCGDvHV.39LL9YCGLVHx%VA8L9Yw.OVHvQ39.O9YAGLVHVQ39LL9YCGlVH6.AJ>/9YC.IVHV.09LJ9YC.OVHVQ39LL9YCGL.HV..K) V:CG@VHVQ3=LL;YCG.UHVQ39LL9YCGLV.VQq9LL9YCGLVHVQ39LL).@GLVHV.39LN9\C..TH.d29OL9YBGLPHVQ39LL9YCGLVHVQ39LL9YCGLVHVQ39LL9YCGLVHVQ39LL9Y^.....q1r3;D.j./.R._. ..C.].'....T....q$5..L.Vs..A...9.1\:F......YG=71.0cY).L.....x7...N8.I...Gk.)Jr.....jo...C"....M..Z6.i-&8:4.j-X+.N.IVQ39........!..i.OC'mQ?.....+4....2VHV539L>9YC&LVH.Q39#L9Y-GLV6VQ3GLL9.CGL.HVQ.9LL.YCG!VHVu39L29YC.1YG...P?..YCGLV}....!....{..gB.2.[a...2...i<..61.0.....=..'u.T.'Pk..48JH<[DCOZuX....m;]GBNQLU].7....b.j.o..=..=.*HVQ39L.9Y.GLV..Q.9LL.Y.G..HVQ..L.9.C...H

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.020176195953405
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	R55-RFQ.exe
File size:	1'070'080 bytes
MD5:	152bed497cb453798846b46a9cbe8710
SHA1:	9948a22ad3b4f15f658a6c8ddbe34c99a485ec50
SHA256:	38100e0eb4432850500bed29244869b5e9b8d328e907352605b35f923ac903a9
SHA512:	ccfa46a0dc4a3a4600629d685a3b024541bfa991dfad0b865055ba677a44d33e636dadaf667cade2fb88bdc3eb807b27438402185f390d94a20be504bfbe8c2b
SSDEEP:	24576:2u6J33O0c+JY5UZ+XC0kGso6FarYQT0Xk8cWeoi3XuWY:Yu0c++OCvkGs9FarF8wpdY
TLSH:	6E35BE2273DDC360CB669173BF6AB7016EBF7C614630B85B2F880D7DA950162162D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675636F8 [Mon Dec 9 00:16:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FAE70DC916Ah
jmp 00007FAE70DBBF34h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FAE70DBC0BAh
cmp edi, eax
jc 00007FAE70DBC41Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FAE70DBC0B9h
rep movsb
jmp 00007FAE70DBC3CCh
cmp ecx, 00000080h
jc 00007FAE70DBC284h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FAE70DBC0C0h
bt dword ptr [004BE324h], 01h
jc 00007FAE70DBC590h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FAE70DBC25Dh
test edi, 00000003h
jne 00007FAE70DBC26Eh
test esi, 00000003h
jne 00007FAE70DBC24Dh
bt edi, 02h
jnc 00007FAE70DBC0BFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FAE70DBC0C3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FAE70DBC115h
bt esi, 03h
jnc 00007FAE70DBC168h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x3ca48	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x104000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x3ca48	0x3cc00	61743ebf04f5603270b005fc4ea0bac5	False	0.8908741640946503	data	7.806858156797682	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x104000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x33d0d	data			1.0003345316792076
RT_GROUP_ICON	0x1034c8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x103540	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x103554	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x103568	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10357c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x103658	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 08:31:45.762655973 CET	49701	80	192.168.2.11	208.95.112.1
Dec 9, 2024 08:31:45.881937981 CET	80	49701	208.95.112.1	192.168.2.11
Dec 9, 2024 08:31:45.882020950 CET	49701	80	192.168.2.11	208.95.112.1
Dec 9, 2024 08:31:45.882925034 CET	49701	80	192.168.2.11	208.95.112.1
Dec 9, 2024 08:31:46.002176046 CET	80	49701	208.95.112.1	192.168.2.11
Dec 9, 2024 08:31:47.053378105 CET	80	49701	208.95.112.1	192.168.2.11
Dec 9, 2024 08:31:47.104617119 CET	49701	80	192.168.2.11	208.95.112.1
Dec 9, 2024 08:31:48.202969074 CET	49702	21	192.168.2.11	195.252.110.253
Dec 9, 2024 08:31:48.322297096 CET	21	49702	195.252.110.253	192.168.2.11
Dec 9, 2024 08:31:48.322402954 CET	49702	21	192.168.2.11	195.252.110.253
Dec 9, 2024 08:31:48.326360941 CET	49702	21	192.168.2.11	195.252.110.253
Dec 9, 2024 08:31:48.445700884 CET	21	49702	195.252.110.253	192.168.2.11
Dec 9, 2024 08:31:48.445760012 CET	49702	21	192.168.2.11	195.252.110.253
Dec 9, 2024 08:32:20.689589977 CET	80	49701	208.95.112.1	192.168.2.11
Dec 9, 2024 08:32:20.689697027 CET	49701	80	192.168.2.11	208.95.112.1
Dec 9, 2024 08:32:37.651855946 CET	49701	80	192.168.2.11	208.95.112.1
Dec 9, 2024 08:32:37.771177053 CET	80	49701	208.95.112.1	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 08:31:45.619590044 CET	57256	53	192.168.2.11	1.1.1.1
Dec 9, 2024 08:31:45.756495953 CET	53	57256	1.1.1.1	192.168.2.11
Dec 9, 2024 08:31:47.638202906 CET	60296	53	192.168.2.11	1.1.1.1
Dec 9, 2024 08:31:48.201992035 CET	53	60296	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 08:31:45.619590044 CET	192.168.2.11	1.1.1.1	0xc4d1	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:31:47.638202906 CET	192.168.2.11	1.1.1.1	0x9bf1	Standard query (0)	ftp.jeepcommerce.rs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 08:31:45.756495953 CET	1.1.1.1	192.168.2.11	0xc4d1	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 9, 2024 08:31:48.201992035 CET	1.1.1.1	192.168.2.11	0x9bf1	No error (0)	ftp.jeepcommerce.rs		195.252.110.253	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49701	208.95.112.1	80	5412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 08:31:45.882925034 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Dec 9, 2024 08:31:47.053378105 CET	175	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 07:31:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	02:31:40
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\R55-RFQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R55-RFQ.exe"
Imagebase:	0x850000
File size:	1'070'080 bytes
MD5 hash:	152BED497CB453798846B46A9CBE8710
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: MALWARE_Win_AgentTeslaV2, Description: AgenetTesla Type 2 Keylogger payload, Source: 00000000.00000002.1500596372.0000000003660000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:31:44
Start date:	09/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\R55-RFQ.exe"
Imagebase:	0xba0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3917611574.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3918436813.0000000002F31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3918436813.0000000002F5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	188

Executed Functions

Function 00853B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00853B68
IsDebuggerPresent.KERNEL32 ref: 00853B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,009152F8,009152E0,?,?), ref: 00853BEB

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

Part of subcall function 0086092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00853C14,009152F8,?,?,?), ref: 0086096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00853C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00907770,00000010), ref: 0088D281
SetCurrentDirectoryW.KERNEL32(?,009152F8,?,?,?), ref: 0088D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00904260,009152F8,?,?,?), ref: 0088D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0088D346

Part of subcall function 00853A46: GetSysColorBrush.USER32(0000000F), ref: 00853A50
Part of subcall function 00853A46: LoadCursorW.USER32(00000000,00007F00), ref: 00853A5F
Part of subcall function 00853A46: LoadIconW.USER32(00000063), ref: 00853A76
Part of subcall function 00853A46: LoadIconW.USER32(000000A4), ref: 00853A88
Part of subcall function 00853A46: LoadIconW.USER32(000000A2), ref: 00853A9A
Part of subcall function 00853A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00853AC0
Part of subcall function 00853A46: RegisterClassExW.USER32(?), ref: 00853B16

Part of subcall function 008539D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00853A03
Part of subcall function 008539D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00853A24
Part of subcall function 008539D5: ShowWindow.USER32(00000000,?,?), ref: 00853A38
Part of subcall function 008539D5: ShowWindow.USER32(00000000,?,?), ref: 00853A41

Part of subcall function 0085434A: _memset.LIBCMT ref: 00854370
Part of subcall function 0085434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00854415

Strings

runas, xrefs: 0088D33A
This is a third-party compiled AutoIt script., xrefs: 0088D279

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 0272efdf7d8cca7f8e2609a52f765fbf4b6ad5230b073dfad289b7abbf2f1ffa
Instruction ID: c26f4a3fda3bf77092455d16a1211a33b8fd2cf7a26522d55fdec00a36bc4ccf
Opcode Fuzzy Hash: 0272efdf7d8cca7f8e2609a52f765fbf4b6ad5230b073dfad289b7abbf2f1ffa
Instruction Fuzzy Hash: 9F51E631E08208EEDF11EBB8EC059ED7B74FF85755F018565F822E21A2CA705A49DB22

Function 008549A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 008549CD

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

GetCurrentProcess.KERNEL32(?,008DFAEC,00000000,00000000,?), ref: 00854A9A
IsWow64Process.KERNEL32(00000000), ref: 00854AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00854AE7
FreeLibrary.KERNEL32(00000000), ref: 00854AF2
GetSystemInfo.KERNEL32(00000000), ref: 00854B23
GetSystemInfo.KERNEL32(00000000), ref: 00854B2F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: b6c4a1a3528a5cbf46841785ed65e848f206b757db19d71bda349c56361c14d0
Instruction ID: 31ec195e35aeb4933b371b580c489382851cd87850e511efdd29b13ae85af0aa
Opcode Fuzzy Hash: b6c4a1a3528a5cbf46841785ed65e848f206b757db19d71bda349c56361c14d0
Instruction Fuzzy Hash: FE91053198A7C4DECB32DB6894501AABFF5FF29305B044E6ED4C7C3A42D220A54CD75A

Function 00854E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00854D8E,?,?,00000000,00000000), ref: 00854E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00854D8E,?,?,00000000,00000000), ref: 00854EB0
LoadResource.KERNEL32(?,00000000,?,?,00854D8E,?,?,00000000,00000000,?,?,?,?,?,?,00854E2F), ref: 0088D937
SizeofResource.KERNEL32(?,00000000,?,?,00854D8E,?,?,00000000,00000000,?,?,?,?,?,?,00854E2F), ref: 0088D94C
LockResource.KERNEL32(00854D8E,?,?,00854D8E,?,?,00000000,00000000,?,?,?,?,?,?,00854E2F,00000000), ref: 0088D95F

Strings

SCRIPT, xrefs: 00854EA6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 02ba91814ec38e0b870c26c47da4160dd6d05a218ab51b5b6d5876a306a5128d
Instruction ID: 36358aff0d65e3296dcade8f138473e8a0eea4f5ca289039613c4651e9c11d17
Opcode Fuzzy Hash: 02ba91814ec38e0b870c26c47da4160dd6d05a218ab51b5b6d5876a306a5128d
Instruction Fuzzy Hash: 05119A71200301BFD7218BA5EC49F277BBAFBC5B26F24826DF906C6250DB61E8449A60

Function 0085FCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 28dc009beb6a259f6f3edef88dfef9d7991eb7e9ae61a5f624dca881591bbf90
Instruction ID: 3c5322a17703bc0e11b2c3eff20dec7f68676147b94d5db94d1f067f8d0637c7
Opcode Fuzzy Hash: 28dc009beb6a259f6f3edef88dfef9d7991eb7e9ae61a5f624dca881591bbf90
Instruction Fuzzy Hash: A59236706083459FDB20DF18C480B2BBBE1FB85308F15896DE99ADB362D771E845CB96

Function 008B445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0088E398), ref: 008B446A
FindFirstFileW.KERNELBASE(?,?), ref: 008B447B
FindClose.KERNEL32(00000000), ref: 008B448B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 3caf002c6a04d948880f884cf21846b5fce67cff00c660eeba7eaa92c53b96da
Instruction ID: bf5c7e676459863a90b8fdfa55307dca99fc0408e8f2f56b6cfda975230e974c
Opcode Fuzzy Hash: 3caf002c6a04d948880f884cf21846b5fce67cff00c660eeba7eaa92c53b96da
Instruction Fuzzy Hash: F0E020334125046B42106B38EC0E8E9775CFF05335F100717F936D12D1E7745D10A5D9

Function 0085E6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00893E62

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: dbc53c5f13bba6065e64e3da574eb543bbff2f85ec114d16fc2415a1b4034096
Instruction ID: 520ba0adaaeef0b7b8cc70a0bae85dd351b4e1397e3bf1bdd64c140e8ca3ad99
Opcode Fuzzy Hash: dbc53c5f13bba6065e64e3da574eb543bbff2f85ec114d16fc2415a1b4034096
Instruction Fuzzy Hash: A9A27D75A00219CFCB28CF58C880AA9B7B2FF58315F688469DD15EB351D734EE4ACB91

Function 008609D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00860A5B
timeGetTime.WINMM ref: 00860D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00860E53
Sleep.KERNEL32(0000000A), ref: 00860E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00860EFA
DestroyWindow.USER32 ref: 00860F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00860F20
Sleep.KERNEL32(0000000A,?,?), ref: 00894E83
TranslateMessage.USER32(?), ref: 00895C60
DispatchMessageW.USER32(?), ref: 00895C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00895C82

Strings

@COM_EVENTOBJ, xrefs: 008954F0
@GUI_CTRLID, xrefs: 00894F3A
@GUI_CTRLHANDLE, xrefs: 00894FE4
@TRAY_ID, xrefs: 0089578F
@GUI_WINHANDLE, xrefs: 00894F8F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: b2c329d5a48599f399f9294e1746c0b00e878bc3e80cbf696042b1a3d9dd6bb1
Instruction ID: 01d37bd4584d5e5b28e598b7dc6aa80cee32e54fbc8e6f0ce550cdda2f5189be
Opcode Fuzzy Hash: b2c329d5a48599f399f9294e1746c0b00e878bc3e80cbf696042b1a3d9dd6bb1
Instruction Fuzzy Hash: ECB2B270608741DFDB25EF28C884BAAB7E4FF84304F19891DE59AD72A1DB71E844CB46

Function 008B9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008B8F5F: __time64.LIBCMT ref: 008B8F69

Part of subcall function 00854EE5: _fseek.LIBCMT ref: 00854EFD

__wsplitpath.LIBCMT ref: 008B9234

Part of subcall function 008740FB: __wsplitpath_helper.LIBCMT ref: 0087413B

_wcscpy.LIBCMT ref: 008B9247
_wcscat.LIBCMT ref: 008B925A
__wsplitpath.LIBCMT ref: 008B927F
_wcscat.LIBCMT ref: 008B9295
_wcscat.LIBCMT ref: 008B92A8

Part of subcall function 008B8FA5: _memmove.LIBCMT ref: 008B8FDE
Part of subcall function 008B8FA5: _memmove.LIBCMT ref: 008B8FED

_wcscmp.LIBCMT ref: 008B91EF

Part of subcall function 008B9734: _wcscmp.LIBCMT ref: 008B9824
Part of subcall function 008B9734: _wcscmp.LIBCMT ref: 008B9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008B9452
_wcsncpy.LIBCMT ref: 008B94C5
DeleteFileW.KERNEL32(?,?), ref: 008B94FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 008B9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008B9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008B9534

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 5352087500cc84e0d75f03c0378e6965e6c31a0b3f845123c1902433a9663c50
Instruction ID: 8fbf1b8b202d8bcacc8097a11c502439a8150fa11947bd01710113ef17315438
Opcode Fuzzy Hash: 5352087500cc84e0d75f03c0378e6965e6c31a0b3f845123c1902433a9663c50
Instruction Fuzzy Hash: 91C13DB1D00219AADF21DF99CC85ADEBBBDFF45314F0040A6F649E7251DB309A848F65

Function 0085301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00853074
RegisterClassExW.USER32(00000030), ref: 0085309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008530AF
InitCommonControlsEx.COMCTL32(?), ref: 008530CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008530DC
LoadIconW.USER32(000000A9), ref: 008530F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00853101

Strings

AutoIt v3 GUI, xrefs: 00853090
0, xrefs: 00853056
TaskbarCreated, xrefs: 008530A4
+, xrefs: 0085305D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: e54b10407dd7e1f3ba2cf90808fb7b3ad08fb072bf5d3b9b439398b9ae31a6a3
Instruction ID: 8494be01ab15af52f9ff02f8c428013403b2d033b3c0ec6c4edaba05fd5fd17c
Opcode Fuzzy Hash: e54b10407dd7e1f3ba2cf90808fb7b3ad08fb072bf5d3b9b439398b9ae31a6a3
Instruction Fuzzy Hash: 9C3167B1955349EFDB00CFA4E884ACDBBF0FB09310F15826AF691E62A1D3B40585DF90

Function 00853041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00853074
RegisterClassExW.USER32(00000030), ref: 0085309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008530AF
InitCommonControlsEx.COMCTL32(?), ref: 008530CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008530DC
LoadIconW.USER32(000000A9), ref: 008530F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00853101

Strings

AutoIt v3 GUI, xrefs: 00853090
0, xrefs: 00853056
TaskbarCreated, xrefs: 008530A4
+, xrefs: 0085305D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 2cd1aa7087d271477b2aa0a9b4b4baa59ff515d60e251cec733fcbaf3c2e162a
Instruction ID: f4b6607bb7dc25cd26a93a103f4625a819c1bca1c32b964242a4df5d22e880ab
Opcode Fuzzy Hash: 2cd1aa7087d271477b2aa0a9b4b4baa59ff515d60e251cec733fcbaf3c2e162a
Instruction Fuzzy Hash: AA21E8B1A55618EFDB00DF94E848BDDBBF4FB08710F01822AF611A62A1D7B14544EF91

Function 0085708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00854706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,009152F8,?,008537AE,?), ref: 00854724

Part of subcall function 0087050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00857165), ref: 0087052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008571A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0088E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0088E909
RegCloseKey.ADVAPI32(?), ref: 0088E947
_wcscat.LIBCMT ref: 0088E9A0

Strings

\Include\, xrefs: 00857165
Include, xrefs: 0088E8BF, 0088E900
Software\AutoIt v3\AutoIt, xrefs: 0085719E
\, xrefs: 0088E9C3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 3d97c71d9ba30e1bb4c9872c0e41076c239284c528fcb2a026919e11e134fa5e
Instruction ID: 1b3ff6e5eecb2a847244fc0b600cf8e05a1865cbd8f8c994722f9cf322139199
Opcode Fuzzy Hash: 3d97c71d9ba30e1bb4c9872c0e41076c239284c528fcb2a026919e11e134fa5e
Instruction Fuzzy Hash: 4D719071A193019EC310EF29EC419ABBBF8FF85350F40892EF565C72A1DB709948DB52

Function 00853A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00853A50
LoadCursorW.USER32(00000000,00007F00), ref: 00853A5F
LoadIconW.USER32(00000063), ref: 00853A76
LoadIconW.USER32(000000A4), ref: 00853A88
LoadIconW.USER32(000000A2), ref: 00853A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00853AC0
RegisterClassExW.USER32(?), ref: 00853B16

Part of subcall function 00853041: GetSysColorBrush.USER32(0000000F), ref: 00853074
Part of subcall function 00853041: RegisterClassExW.USER32(00000030), ref: 0085309E
Part of subcall function 00853041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 008530AF
Part of subcall function 00853041: InitCommonControlsEx.COMCTL32(?), ref: 008530CC
Part of subcall function 00853041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 008530DC
Part of subcall function 00853041: LoadIconW.USER32(000000A9), ref: 008530F2
Part of subcall function 00853041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00853101

Strings

AutoIt v3, xrefs: 00853B05
0, xrefs: 00853AF4
#, xrefs: 00853AFB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 8f38198f364a4b971de07ca85294d9ba3102e0ba5bb8d6eeebf31062f842097e
Instruction ID: 0a66f74005dcb43d2fa90b04d61d7de3354f319c284c320c722a1e6ba586053a
Opcode Fuzzy Hash: 8f38198f364a4b971de07ca85294d9ba3102e0ba5bb8d6eeebf31062f842097e
Instruction Fuzzy Hash: 87212A72E55308EFEB10DFA4EC09BDD7BB0FB48711F02851AE610A62A1D3B55644EF84

Function 00853633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 008536D2
KillTimer.USER32(?,00000001), ref: 008536FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0085371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0085372A
CreatePopupMenu.USER32 ref: 0085373E
PostQuitMessage.USER32(00000000), ref: 0085374D

Strings

TaskbarCreated, xrefs: 00853725

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 4d884978cef8376e3c2bc043d13f60186a26b0900c876f0828c5cce92b134b8a
Instruction ID: cc63baaf7f8020f624019f4f641b856d992b3e190757c83252ae425cfd791e3c
Opcode Fuzzy Hash: 4d884978cef8376e3c2bc043d13f60186a26b0900c876f0828c5cce92b134b8a
Instruction Fuzzy Hash: 9A411872714609EBDB206F68DC09BF93794FB54382F150529FA02C62A2CB609949B362

Function 00853766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 008538A7
/AutoIt3OutputDebug, xrefs: 00853892
CMDLINE, xrefs: 00853822
/AutoIt3ExecuteScript, xrefs: 008538BC
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 008537AE
CMDLINERAW, xrefs: 008537FB
/ErrorStdOut, xrefs: 0085387D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 39f3ce3fb66c36c1d58438943ff8a08b721e12c75a3e1c30552d3c81861c7680
Instruction ID: 8b9d7a6d3dd201e6bcc2875e479d54480f014a48449471c68a8ca91917272f2f
Opcode Fuzzy Hash: 39f3ce3fb66c36c1d58438943ff8a08b721e12c75a3e1c30552d3c81861c7680
Instruction Fuzzy Hash: B4A15F7291022D9ACB05EBA8DC55AEEBBB8FF14341F40452AF816F7191DF745A0CCB61

Function 01055A08 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01055AD9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01055CFF

Memory Dump Source

Source File: 00000000.00000002.1500463347.0000000001053000.00000040.00000020.00020000.00000000.sdmp, Offset: 01053000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1053000_R55-RFQ.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction ID: b276df0ce00735a3e36e6094afe7831dc57400207c6f180c7ffb70874073c934
Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
Instruction Fuzzy Hash: 41A10670E0020DEFEB54CFA4C998BEEBBB5BF48304F208199E541AB281D7759A81CF54

Function 008539D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00853A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00853A24
ShowWindow.USER32(00000000,?,?), ref: 00853A38
ShowWindow.USER32(00000000,?,?), ref: 00853A41

Strings

edit, xrefs: 00853A1E
AutoIt v3, xrefs: 008539FB, 00853A00, 00853A01

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 9e2970af94f2432236a4232972a46a03719d718ef5e5656e21ddc1a2e66c8715
Instruction ID: 54e4d84e77115f2a23c0e3d247cf45ab9344993821b761a076f428827d6e3f3e
Opcode Fuzzy Hash: 9e2970af94f2432236a4232972a46a03719d718ef5e5656e21ddc1a2e66c8715
Instruction Fuzzy Hash: DBF03072655290BEEA306713AC08EAB3F7DE7C6F50F02852ABA10A2271C2710801EA70

Function 010557C8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010556B8: Sleep.KERNELBASE(000001F4), ref: 010556C9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 010558F8

Strings

Q39LL9YCGLVHV, xrefs: 0105595B, 0105595E

Memory Dump Source

Source File: 00000000.00000002.1500463347.0000000001053000.00000040.00000020.00020000.00000000.sdmp, Offset: 01053000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1053000_R55-RFQ.jbxd

Similarity

API ID: CreateFileSleep
String ID: Q39LL9YCGLVHV
API String ID: 2694422964-458470084
Opcode ID: bb6b9760c92c097b689da2a534c557ef626796ad2c763593c6edf64213b242dd
Instruction ID: 44366b33919f08d720e0554427db22133a4a4957caf0e2e89c98d8a02b80419d
Opcode Fuzzy Hash: bb6b9760c92c097b689da2a534c557ef626796ad2c763593c6edf64213b242dd
Instruction Fuzzy Hash: 54519E30D14249EBEF11DBE4D854BEFBB79AF18310F004199E649BB2C0DBB91A44CBA5

Function 0085407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0088D3D7

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

_memset.LIBCMT ref: 008540FC
_wcscpy.LIBCMT ref: 00854150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00854160

Strings

Line: , xrefs: 0088D400

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: a0ba08090bef884f0d43e2e4706020bbc28575e4fce60082fab88944c601eb21
Instruction ID: 38424c60498d1296e45013c8f81e7ec5703dfc23e70b98908e36bc323dfc6b65
Opcode Fuzzy Hash: a0ba08090bef884f0d43e2e4706020bbc28575e4fce60082fab88944c601eb21
Instruction Fuzzy Hash: C831CE72108704AAD761EB64EC45BDB77D8FB80319F20891AB985D21E1EB70968CC783

Function 0087541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0087547B
_memcpy_s.LIBCMT ref: 008754ED
__read_nolock.LIBCMT ref: 0087554B
__filbuf.LIBCMT ref: 0087556E
_memset.LIBCMT ref: 008755B2

Part of subcall function 00878B28: __getptd_noexit.LIBCMT ref: 00878B28

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 5c9068e03a01191e052322d61dc9ef55719721e91c96e86d644d22d0284fddda
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: C651A370A00B09DBDB249F69D88066E77A6FF40325F24C729F82DD62D8D7B0DD909B45

Function 0085686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00854DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,009152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00854E0F

_free.LIBCMT ref: 0088E263
_free.LIBCMT ref: 0088E2AA

Part of subcall function 00856A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00856BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0088E039
Bad directive syntax error, xrefs: 0088E292

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 43f419727cb43e4691116e87f21ef9e279f6bacea8b187561e54594dbd8ce337
Instruction ID: 02fcbf874823fdd90c09b3bebb9b8426bfee819fe22484a0e9284e2a962b9c4b
Opcode Fuzzy Hash: 43f419727cb43e4691116e87f21ef9e279f6bacea8b187561e54594dbd8ce337
Instruction Fuzzy Hash: 58918D71900219EFCF14EFA8CC919EDB7B8FF09315B10852AF816EB2A1DB70A955CB51

Function 008535B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,008535A1,SwapMouseButtons,00000004,?), ref: 008535D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,008535A1,SwapMouseButtons,00000004,?,?,?,?,00852754), ref: 008535F5
RegCloseKey.KERNELBASE(00000000,?,?,008535A1,SwapMouseButtons,00000004,?,?,?,?,00852754), ref: 00853617

Strings

Control Panel\Mouse, xrefs: 008535D2

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 04e585ea05e70cbdcaa269a60e24b42445678019f792c11ac88982792ade0e40
Instruction ID: 9d2f050c36cffd8ed07fd9730895fc95edfd75cf2e13a28fcef46cb0b582c19d
Opcode Fuzzy Hash: 04e585ea05e70cbdcaa269a60e24b42445678019f792c11ac88982792ade0e40
Instruction Fuzzy Hash: D5114871511208BFDF218FA4DC40AAEB7F8FF14781F00856AF905E7210D2719E54A760

Function 010546B8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01054EE5
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01054F09
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01054F2B

Memory Dump Source

Source File: 00000000.00000002.1500463347.0000000001053000.00000040.00000020.00020000.00000000.sdmp, Offset: 01053000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1053000_R55-RFQ.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
Instruction ID: df9b5ec4d9c4d14daf746dbb3bb53531d3b3bdb274cba1eae1b77e0b507f104d
Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
Instruction Fuzzy Hash: 43621B30A14218DBEB64CFA4CC40BDEB776EF58300F1091A9E54DEB294E7769E81CB59

Function 008B955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00854EE5: _fseek.LIBCMT ref: 00854EFD

Part of subcall function 008B9734: _wcscmp.LIBCMT ref: 008B9824
Part of subcall function 008B9734: _wcscmp.LIBCMT ref: 008B9837

_free.LIBCMT ref: 008B96A2
_free.LIBCMT ref: 008B96A9
_free.LIBCMT ref: 008B9714

Part of subcall function 00872D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00879A24), ref: 00872D69
Part of subcall function 00872D55: GetLastError.KERNEL32(00000000,?,00879A24), ref: 00872D7B

_free.LIBCMT ref: 008B971C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction ID: 8e25e60c7cdb4f48a45dd4311686c4d20da492f101f5f33b478f6a11dada63d4
Opcode Fuzzy Hash: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction Fuzzy Hash: 43513AB1904218ABDF249F68CC85AAEBBB9FF48304F10449EF649E3351DB715A81CF59

Function 0087470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008747A0
__flush.LIBCMT ref: 008747C0
__write.LIBCMT ref: 008747F3
__flsbuf.LIBCMT ref: 00874821

Part of subcall function 00878B28: __getptd_noexit.LIBCMT ref: 00878B28

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: b9dc8781d08cc3bc41f93eaabcd6323c16dc36e531bef861cd175b45f2ffead5
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: F341B675A0074E9BDB1CCEA9C8809AE7BA5FF463A4B24D53DE81DCB648DB70DD408B41

Function 008544A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008544CF

Part of subcall function 0085407C: _memset.LIBCMT ref: 008540FC
Part of subcall function 0085407C: _wcscpy.LIBCMT ref: 00854150
Part of subcall function 0085407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00854160

KillTimer.USER32(?,00000001,?,?), ref: 00854524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00854533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0088D4B9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: ab0e0571bf809751fe9c6114422f85b0ce7e4b3d529decaa142ebc0959768818
Instruction ID: 07756c63d5698e69c320964dc1306c01a8247eaa6261d889cb2555e26eee68a5
Opcode Fuzzy Hash: ab0e0571bf809751fe9c6114422f85b0ce7e4b3d529decaa142ebc0959768818
Instruction Fuzzy Hash: 22210774908788AFE7329B248845BE6BBECFF01319F04009EE79ED6182D3742988DB45

Function 00857285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0088EA39
GetOpenFileNameW.COMDLG32(?), ref: 0088EA83

Part of subcall function 00854750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00854743,?,?,008537AE,?), ref: 00854770

Part of subcall function 00870791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008707B0

Strings

X, xrefs: 0088EA51

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 16fb354aeca0fd9675b27c14a94131db20fe94ddff91903046a8615f679d002c
Instruction ID: 3bc50a32cb06f779b0dfa837a8a508a7b4863e0a5fa32cda97e0acf3c0115f2f
Opcode Fuzzy Hash: 16fb354aeca0fd9675b27c14a94131db20fe94ddff91903046a8615f679d002c
Instruction Fuzzy Hash: 7921D130A102489BCB119F98D845AEE7BFCFF48715F00805AE848E7281DBB4598D8FA2

Function 008B8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008B8DAC
__fread_nolock.LIBCMT ref: 008B8DC1

Strings

EA06, xrefs: 008B8DF3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: ab236ade746cb4da6d13bdc0be0b6ee1ece90359f73054a519ed583fd26213e6
Instruction ID: c444d7ed01df3bcadcf5ec97d6f988e04a0db1b8140c0525c65952121b398aac
Opcode Fuzzy Hash: ab236ade746cb4da6d13bdc0be0b6ee1ece90359f73054a519ed583fd26213e6
Instruction Fuzzy Hash: A701F972904218BEDB18CAA8C816EEE7BFCDB11301F00419FF596D6281E9B5E6088B60

Function 008B98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 008B98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 008B990F

Strings

aut, xrefs: 008B9909

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 3635ee42c9efee2271f02e4a706c21675c1ff2d98b953b76808ef6f9758f6fb4
Instruction ID: 9587384e1188469f10971faae945ce49bb83a7dba2b9403511afea4b7ab71e4d
Opcode Fuzzy Hash: 3635ee42c9efee2271f02e4a706c21675c1ff2d98b953b76808ef6f9758f6fb4
Instruction Fuzzy Hash: DFD05E7954130DABDB50DBA0DC0EF9A773CE704704F0043B2BF95911A2EAB095989B95

Function 008CCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae640020c3c0efbfa03bbf02ffa06623ea555a979eab44e20a6d7977d587cde
Instruction ID: 64193f830e3fae3bb31c0bb27dd019778708e03edffb9b3748366838f055d8cb
Opcode Fuzzy Hash: eae640020c3c0efbfa03bbf02ffa06623ea555a979eab44e20a6d7977d587cde
Instruction Fuzzy Hash: 17F116716083059FCB14DF28C480A6ABBE5FF89314F14896EF99ADB251DB70E945CF82

Function 0085F76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00870162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00870193
Part of subcall function 00870162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0087019B
Part of subcall function 00870162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008701A6
Part of subcall function 00870162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008701B1
Part of subcall function 00870162: MapVirtualKeyW.USER32(00000011,00000000), ref: 008701B9
Part of subcall function 00870162: MapVirtualKeyW.USER32(00000012,00000000), ref: 008701C1

Part of subcall function 008660F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0085F930), ref: 00866154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0085F9CD
OleInitialize.OLE32(00000000), ref: 0085FA4A
CloseHandle.KERNEL32(00000000), ref: 008945C8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 08ca8687f01704049dc45a0e55ef8b416a6999eb9d77321326055e3fe5fdbb70
Instruction ID: ba012a76cc64058c38d8a20cbe457dd79c789f4f7939ad926ffe7975113d002f
Opcode Fuzzy Hash: 08ca8687f01704049dc45a0e55ef8b416a6999eb9d77321326055e3fe5fdbb70
Instruction Fuzzy Hash: 2581CEB0B29B40CF9384DF69E8456987BE5FBD8306793C12A9119CB2B2E7704485EF12

Function 0085434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00854370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00854415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00854432

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 4a8529584db1a4edd1f83a9ba7ebbd3a55ec9aa5a422fcd7db1a92785afa7d69
Instruction ID: 21c7cd9e57d7fcd6d4adaf1f42394cc0a0ddadafe32a53a49738abfed2e07f33
Opcode Fuzzy Hash: 4a8529584db1a4edd1f83a9ba7ebbd3a55ec9aa5a422fcd7db1a92785afa7d69
Instruction Fuzzy Hash: 12318071609701DFC720DF24D884ADBBBF8FB48309F00492EEA9AC6251D771A988CB56

Function 0087571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00875733

Part of subcall function 0087A16B: __NMSG_WRITE.LIBCMT ref: 0087A192
Part of subcall function 0087A16B: __NMSG_WRITE.LIBCMT ref: 0087A19C

__NMSG_WRITE.LIBCMT ref: 0087573A

Part of subcall function 0087A1C8: GetModuleFileNameW.KERNEL32(00000000,009133BA,00000104,?,00000001,00000000), ref: 0087A25A
Part of subcall function 0087A1C8: ___crtMessageBoxW.LIBCMT ref: 0087A308

Part of subcall function 0087309F: ___crtCorExitProcess.LIBCMT ref: 008730A5
Part of subcall function 0087309F: ExitProcess.KERNEL32 ref: 008730AE

Part of subcall function 00878B28: __getptd_noexit.LIBCMT ref: 00878B28

RtlAllocateHeap.NTDLL(00E90000,00000000,00000001,00000000,?,?,?,00870DD3,?), ref: 0087575F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 4795213d3a4b6cd4f79aef7dc59f34dfd687481a3f1de4ce319248662beff646
Instruction ID: 489fe8b3122830bba18148f5d6eafc9ea76fc4c29d823889b9d487b743fda183
Opcode Fuzzy Hash: 4795213d3a4b6cd4f79aef7dc59f34dfd687481a3f1de4ce319248662beff646
Instruction Fuzzy Hash: 6D01D231340A01DAE719673CAC82A6E7398FB823A2F50C525F40DEA189DEB0DC40A662

Function 008B98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,008B9548,?,?,?,?,?,00000004), ref: 008B98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,008B9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 008B98D1
CloseHandle.KERNEL32(00000000,?,008B9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008B98D8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: ad6defb695ea357f4d5f9e0477a09642418a8a4a1c0f26e365d14a7758353b42
Instruction ID: 292e217f27f9cd1d9b69d5e641f643cf332a108986220f831d5bdd74074afea9
Opcode Fuzzy Hash: ad6defb695ea357f4d5f9e0477a09642418a8a4a1c0f26e365d14a7758353b42
Instruction Fuzzy Hash: F7E08632141224B7DB321B54EC09FCA7F19FF06760F104221FB55A91E187B11611A798

Function 008B8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 008B8D1B

Part of subcall function 00872D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00879A24), ref: 00872D69
Part of subcall function 00872D55: GetLastError.KERNEL32(00000000,?,00879A24), ref: 00872D7B

_free.LIBCMT ref: 008B8D2C
_free.LIBCMT ref: 008B8D3E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction ID: abd6881cf1a8f9371a8fa78fe7d5f945947fb83c5df2462d11606407928ff265
Opcode Fuzzy Hash: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction Fuzzy Hash: ACE012A160260586DB34E57DA940AD717DCEF58352718491EB40DD728ACE64F842C124

Function 0085A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0088FC01

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 3ec40f399d768a004f146c303daeb39cc7a09d509ef7a4575a64158229d0325b
Instruction ID: d4ac49a38770c845f4b7d49c09a9693d2339e468850bea46ce1c6ed3e32bd921
Opcode Fuzzy Hash: 3ec40f399d768a004f146c303daeb39cc7a09d509ef7a4575a64158229d0325b
Instruction Fuzzy Hash: 11224A70608205DFDB28DF18C490A6ABBE1FF44315F15896DE98ADB362D731EC49CB82

Function 00854C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00854CBA

Strings

EA06, xrefs: 0088D8CC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: ffc623cb6a3a4e7358352651f8d66312062bfc1aca5741233de42dfebf84f796
Instruction ID: 7e134594d3d62db2f942184b2a1f54ab6c23a117b206e6c3ec21870751c9007c
Opcode Fuzzy Hash: ffc623cb6a3a4e7358352651f8d66312062bfc1aca5741233de42dfebf84f796
Instruction Fuzzy Hash: 97417F21A0425C57CF219B6888517BE7F72FB4530EF686474FC82DB286D6349DCC83A2

Function 00857A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00857AAB
_memmove.LIBCMT ref: 00857B16

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8787708196ce45b0a8645caae1a99237cce191730ca2271c137f8889e79cc621
Instruction ID: da0b3cb9342bba271a7191a2164f7f9c55f13acd901e624ff0feb7e2e85cbbed
Opcode Fuzzy Hash: 8787708196ce45b0a8645caae1a99237cce191730ca2271c137f8889e79cc621
Instruction Fuzzy Hash: B731D4B2604616AFC704DF68D8D1E69F7A9FF48320714C629F819CB391EB30E924CB90

Function 008547D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00854834

Part of subcall function 0087336C: __lock.LIBCMT ref: 00873372
Part of subcall function 0087336C: DecodePointer.KERNEL32(00000001,?,00854849,008A7C74), ref: 0087337E
Part of subcall function 0087336C: EncodePointer.KERNEL32(?,?,00854849,008A7C74), ref: 00873389

Part of subcall function 008548FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00854915
Part of subcall function 008548FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0085492A

Part of subcall function 00853B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00853B68
Part of subcall function 00853B3A: IsDebuggerPresent.KERNEL32 ref: 00853B7A
Part of subcall function 00853B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,009152F8,009152E0,?,?), ref: 00853BEB
Part of subcall function 00853B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00853C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00854874

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: ac8c7d8e0453d9f9b370ce30f0174f0d81274f39d9f41882fcf844eb1eec08c9
Instruction ID: 37d3ec598be48f7a3fc3c7fe0c28153ce346ff2593bb082f87dff29c661fa1b6
Opcode Fuzzy Hash: ac8c7d8e0453d9f9b370ce30f0174f0d81274f39d9f41882fcf844eb1eec08c9
Instruction Fuzzy Hash: CE11CD72A18341DBC700DF68E80594ABFE8FF95750F01892EF494C72B1DBB08648DB82

Function 00870DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0087571C: __FF_MSGBANNER.LIBCMT ref: 00875733
Part of subcall function 0087571C: __NMSG_WRITE.LIBCMT ref: 0087573A
Part of subcall function 0087571C: RtlAllocateHeap.NTDLL(00E90000,00000000,00000001,00000000,?,?,?,00870DD3,?), ref: 0087575F

std::exception::exception.LIBCMT ref: 00870DEC
__CxxThrowException@8.LIBCMT ref: 00870E01

Part of subcall function 0087859B: RaiseException.KERNEL32(?,?,?,00909E78,00000000,?,?,?,?,00870E06,?,00909E78,?,00000001), ref: 008785F0

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 7a2cd545b7dc0453603c9a7deea7b8bf3fb8234625642d961e795fd6a0973094
Instruction ID: aab72ebfada8c32af40357806c0a0019a11944187f9e1d6f2bf4ee0139822d60
Opcode Fuzzy Hash: 7a2cd545b7dc0453603c9a7deea7b8bf3fb8234625642d961e795fd6a0973094
Instruction Fuzzy Hash: 5CF0D63150031DA6CB20AA98EC055DE7BACFF01354F008415FA0CD6185DFF0DA8495D2

Function 008755FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0087562C
__lock_file.LIBCMT ref: 0087564D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 06f468e03d84fef532d0a44742b7f6a2820daad9aa1fa231dbf09dacab567a48
Instruction ID: ecf26ceccba694e9d113daf66763956df549e33ca3d510f4300e0881dc7694e7
Opcode Fuzzy Hash: 06f468e03d84fef532d0a44742b7f6a2820daad9aa1fa231dbf09dacab567a48
Instruction Fuzzy Hash: 8E019E71800A08EACF22AF688C0649E7B61FFA1321F40C115B82C9A199DB71CA51DB92

Function 008753A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00878B28: __getptd_noexit.LIBCMT ref: 00878B28

__lock_file.LIBCMT ref: 008753EB

Part of subcall function 00876C11: __lock.LIBCMT ref: 00876C34

__fclose_nolock.LIBCMT ref: 008753F6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: ed41f3ee9a35511c3d7fa5ac778db722c1ffc711559395c787f0de33a4d3369b
Instruction ID: 93a648030e980e4a7a3bd36aed5eb2d6c9549a418d59b2f8f32e1ad5f9e75658
Opcode Fuzzy Hash: ed41f3ee9a35511c3d7fa5ac778db722c1ffc711559395c787f0de33a4d3369b
Instruction Fuzzy Hash: B5F09671800B04DAD7116B6D98057AD7AA0FF42374F20C208A42CEB2D9CFFCC9415B53

Function 010546B5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01054EE5
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01054F09
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01054F2B

Memory Dump Source

Source File: 00000000.00000002.1500463347.0000000001053000.00000040.00000020.00020000.00000000.sdmp, Offset: 01053000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1053000_R55-RFQ.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction ID: 24512b91002cde6293b95fda11913a13e268a82d7d4cc6b318a2ba50949c07db
Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
Instruction Fuzzy Hash: 8612DF24E24658C6EB24DF64D8507DEB272EF68300F1090E9910DEB7A5E77A4F81CF5A

Function 00870C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00870CB7

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: a2cd10710ee3cf73fb5786ad1ee14d3b20840f58f6b99d9b23e60359096ae5e0
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 2F31A270A00109DBC71ADF58C484A69FBA6FB99304B64C6A5E80ACB359D631EEC1DF80

Function 0088FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0088FCB7

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2e7e971dba54e8186faa4a8461d6f3558596ec9574b4f21ba46e5cf503cd3c2b
Instruction ID: f5a2f34488e3350fd99075b0931b5784bff84c7ef488cd3ceb2e27048f03b524
Opcode Fuzzy Hash: 2e7e971dba54e8186faa4a8461d6f3558596ec9574b4f21ba46e5cf503cd3c2b
Instruction Fuzzy Hash: 1A41D474504341CFDB14DF18C484B1ABBE1FF45319F1989ACE99A8B362C732E849CB52

Function 00857B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00857BB3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1c2203da2a02359585f090f97ea94e22528cfeb0f3bfc41a6940f8f0d9273e0f
Instruction ID: 615e6ccfaf349f2275877ec2928eb8f4a8db1c22f4cbbbc685d0dbe3af10e6df
Opcode Fuzzy Hash: 1c2203da2a02359585f090f97ea94e22528cfeb0f3bfc41a6940f8f0d9273e0f
Instruction Fuzzy Hash: 2B213672A28A09EBDB109F15F8417AA7BB5FF14361F21C42DE88AC51A0EB30D5D0D702

Function 00854DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00854BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00854BEF

Part of subcall function 0087525B: __wfsopen.LIBCMT ref: 00875266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,009152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00854E0F

Part of subcall function 00854B6A: FreeLibrary.KERNEL32(00000000), ref: 00854BA4

Part of subcall function 00854C70: _memmove.LIBCMT ref: 00854CBA

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 9bcf9db1a52d52fbea67667ca24beb621f3f2c252da4f4082e4308950c69c536
Instruction ID: db8ec848c27594decd9d15af6a89fbe4721cdde28e982b5ef770b85823320d3f
Opcode Fuzzy Hash: 9bcf9db1a52d52fbea67667ca24beb621f3f2c252da4f4082e4308950c69c536
Instruction Fuzzy Hash: C611E731600305ABCF14FFB8C817FAD77A5FF44729F108829F942E7182DA719A489B52

Function 0088FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0088FD91

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 41c2973076c7902f9673fb8eb365aba8aeb9d6eafc55f530a6a81fc1ed450249
Instruction ID: 4ab745f5083d145067faa58f7d69eccc62424ff8ec9d7eca59b767f2a798d6eb
Opcode Fuzzy Hash: 41c2973076c7902f9673fb8eb365aba8aeb9d6eafc55f530a6a81fc1ed450249
Instruction Fuzzy Hash: AD21D0B4508341DFCB19DF64C484A1ABBE1FF88315F058A68F98A97722D731E849CB93

Function 0087072A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008707B0

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 39039deafad59f984a5a4ac7e57e1ab82722266bee19f5693342fbee7f0a2444
Instruction ID: 87a66e0e409f9ceab5c676e394ade06e730e36f813223439b0e4155184157380
Opcode Fuzzy Hash: 39039deafad59f984a5a4ac7e57e1ab82722266bee19f5693342fbee7f0a2444
Instruction Fuzzy Hash: 2E01D6794042945FC7134B3868019F47FF8EF4B620B0441E6E8948BA65D9201C45EBE1

Function 00874863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 008748A6

Part of subcall function 00878B28: __getptd_noexit.LIBCMT ref: 00878B28

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 823c5d0fe5ad043319725a64939ed0a4b7f2dcbc51759d4c4f8c0a5079892486
Instruction ID: 0d98a20418368f67faf6aaedca8664983bf34799715a42b5389a9034a3a02247
Opcode Fuzzy Hash: 823c5d0fe5ad043319725a64939ed0a4b7f2dcbc51759d4c4f8c0a5079892486
Instruction Fuzzy Hash: D1F0A43194060DEBDF11AFA88C0979E3AA0FF10325F15D524F42CD6199DB78C951DB53

Function 00854E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,009152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00854E7E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f648d0d00fe8cc4cfc07315f7a08434b92ab90fded53d0657e7afb8747fae120
Instruction ID: 76ffe98fe4db5904dcf16214444135d247169f2bbb24d9a58c7e05dcb207bb2d
Opcode Fuzzy Hash: f648d0d00fe8cc4cfc07315f7a08434b92ab90fded53d0657e7afb8747fae120
Instruction Fuzzy Hash: D5F01C71501751CFCB349F64E495816B7E1FF1433E3209A3EE5D6C2621C771A888DB40

Function 00870791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008707B0

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 62615d75fa408398a57e6dbd0f1a43b2b544672b1b44d5db411367777f1e7114
Instruction ID: fc1fdeee81f25bd487b687e303aa1515e8cd1c39e09cc0369b5ad9c3e6b9309f
Opcode Fuzzy Hash: 62615d75fa408398a57e6dbd0f1a43b2b544672b1b44d5db411367777f1e7114
Instruction Fuzzy Hash: C9E0CD3694512857C720E65C9C05FEA77DDEF887A1F0441F6FD0CD7245DD609C8086D1

Function 008B8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 008B8EC1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 9b50e3ad931c7769e47011036eff88a4015faad75f0bdf79adaa116c8d8ab8fb
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 76E092B0104B049FD7388A24D841BE373E5FB05304F00081DF2AAC3341EBA3B841CB59

Function 0087525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00875266

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ab7e37ac5fea9826c214b8285a4ffbea889a75aa7985baffcbfc8994f1f1935a
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: E2B0927644020C77CF012A86EC02A493B1AAB41B64F448020FB0C18162A6B3E6649A8A

Function 010556B8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 010556C9

Memory Dump Source

Source File: 00000000.00000002.1500463347.0000000001053000.00000040.00000020.00020000.00000000.sdmp, Offset: 01053000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1053000_R55-RFQ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 556eaa66fea6ae23757b1dacc09b9e3864483cd344d47dd560881a06510cbf56
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 1AE0E67494110DDFDB00DFB4D9496DE7BB4EF04302F100161FD01D2280D6309D508A72

Non-executed Functions

Function 008DCABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 008DCB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 008DCB95
GetWindowLongW.USER32(?,000000F0), ref: 008DCBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008DCC00
SendMessageW.USER32 ref: 008DCC29
_wcsncpy.LIBCMT ref: 008DCC95
GetKeyState.USER32(00000011), ref: 008DCCB6
GetKeyState.USER32(00000009), ref: 008DCCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 008DCCD9
GetKeyState.USER32(00000010), ref: 008DCCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 008DCD0C
SendMessageW.USER32 ref: 008DCD33
SendMessageW.USER32(?,00001030,?,008DB348), ref: 008DCE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 008DCE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 008DCE60
SetCapture.USER32(?), ref: 008DCE69
ClientToScreen.USER32(?,?), ref: 008DCECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 008DCEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008DCEF5
ReleaseCapture.USER32 ref: 008DCF00
GetCursorPos.USER32(?), ref: 008DCF3A
ScreenToClient.USER32(?,?), ref: 008DCF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 008DCFA3
SendMessageW.USER32 ref: 008DCFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 008DD00E
SendMessageW.USER32 ref: 008DD03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 008DD05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 008DD06D
GetCursorPos.USER32(?), ref: 008DD08D
ScreenToClient.USER32(?,?), ref: 008DD09A
GetParent.USER32(?), ref: 008DD0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 008DD123
SendMessageW.USER32 ref: 008DD154
ClientToScreen.USER32(?,?), ref: 008DD1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 008DD1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 008DD20C
SendMessageW.USER32 ref: 008DD22F
ClientToScreen.USER32(?,?), ref: 008DD281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 008DD2B5

Part of subcall function 008525DB: GetWindowLongW.USER32(?,000000EB), ref: 008525EC

GetWindowLongW.USER32(?,000000F0), ref: 008DD351

Strings

F, xrefs: 008DD235
@GUI_DRAGID, xrefs: 008DCE9C
V, xrefs: 008DCC5F, 008DCDBA, 008DCDDD, 008DCE0F, 008DCF5F, 008DD0E0, 008DD18C, 008DD1BC, 008DD25F, 008DD28B, 008DD2DB, 008DD33E, 008DD362, 008DD38C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$V
API String ID: 3977979337-1052069573
Opcode ID: 207c9673ba1f543849f6953aba7086bb4344e32071ca3c9e074c550f87db9bed
Instruction ID: 941962c07c9fb0a0e739dc4a196bbbe4084f197368072f7ee802d26d25307799
Opcode Fuzzy Hash: 207c9673ba1f543849f6953aba7086bb4344e32071ca3c9e074c550f87db9bed
Instruction Fuzzy Hash: 06429B74205342EFDB24CF28D845AAABBE5FF49320F14461AF696C73A1D731E844EB52

Function 00866F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008671C3
_memset.LIBCMT ref: 00867539
_memmove.LIBCMT ref: 008676AC

Strings

DEFINE, xrefs: 008A2103
[:>:]], xrefs: 00867492
Q\E, xrefs: 00867FCB
\b(?<=\w), xrefs: 008A3773
[:<:]], xrefs: 00867479
\b(?=\w), xrefs: 008A3769

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 1162b2cf0dd6ee2425d713dbc8dda05a4c6b8acb17f6417466b6492e4008cf85
Instruction ID: 5ac1388e3550015a672d540feb9e3a88d4119f1aa4140e0b1ecdee1d5d6e6c20
Opcode Fuzzy Hash: 1162b2cf0dd6ee2425d713dbc8dda05a4c6b8acb17f6417466b6492e4008cf85
Instruction Fuzzy Hash: A8938171A04219DFEF24CF98C881BADB7B1FF49714F25816AE945EB681E7709D81CB80

Function 008548D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 008548DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0088D665
IsIconic.USER32(?), ref: 0088D66E
ShowWindow.USER32(?,00000009), ref: 0088D67B
SetForegroundWindow.USER32(?), ref: 0088D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0088D69B
GetCurrentThreadId.KERNEL32 ref: 0088D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0088D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0088D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0088D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0088D6CF
SetForegroundWindow.USER32(?), ref: 0088D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0088D6E7
keybd_event.USER32(00000012,00000000), ref: 0088D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0088D6FC
keybd_event.USER32(00000012,00000000), ref: 0088D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0088D70A
keybd_event.USER32(00000012,00000000), ref: 0088D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0088D719
keybd_event.USER32(00000012,00000000), ref: 0088D71E
SetForegroundWindow.USER32(?), ref: 0088D721
AttachThreadInput.USER32(?,?,00000000), ref: 0088D748

Strings

Shell_TrayWnd, xrefs: 0088D660

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 7cebc68820c7658629d23491712bae7210fc1756427057e067490cb34f841871
Instruction ID: 57fe49f87d1b6719314978e2d0c52a26e67c3e7890a7711d319b3aafa4bf46ee
Opcode Fuzzy Hash: 7cebc68820c7658629d23491712bae7210fc1756427057e067490cb34f841871
Instruction Fuzzy Hash: A7317371A4131CBBEB206B619C49F7F7F6CFB44B50F104166FB05EA1D2D6B05900ABA0

Function 008A8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 008A87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008A882B
Part of subcall function 008A87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 008A8858
Part of subcall function 008A87E1: GetLastError.KERNEL32 ref: 008A8865

_memset.LIBCMT ref: 008A8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 008A83A5
CloseHandle.KERNEL32(?), ref: 008A83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 008A83CD
GetProcessWindowStation.USER32 ref: 008A83E6
SetProcessWindowStation.USER32(00000000), ref: 008A83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 008A840A

Part of subcall function 008A81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008A8309), ref: 008A81E0
Part of subcall function 008A81CB: CloseHandle.KERNEL32(?,?,008A8309), ref: 008A81F2

Strings

winsta0, xrefs: 008A83C8
default, xrefs: 008A8405
, xrefs: 008A8362

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: b4157e2c52d16c823b1768f50a4b3dce4e901ace9cf851fdbb832cf7b865d59a
Instruction ID: c6bb67ae118ef4b8a42ecb44ced446c82dfbf2592a0a2869758f4a68afaabea5
Opcode Fuzzy Hash: b4157e2c52d16c823b1768f50a4b3dce4e901ace9cf851fdbb832cf7b865d59a
Instruction Fuzzy Hash: C1814571C01209EFEF119FA4DC45AEEBBB9FF05304F14816AF915E2661DB318A14AB21

Function 008BC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008BC78D
FindClose.KERNEL32(00000000), ref: 008BC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 008BC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 008BC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 008BC844
__swprintf.LIBCMT ref: 008BC890
__swprintf.LIBCMT ref: 008BC8D3

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

__swprintf.LIBCMT ref: 008BC927

Part of subcall function 00873698: __woutput_l.LIBCMT ref: 008736F1

__swprintf.LIBCMT ref: 008BC975

Part of subcall function 00873698: __flsbuf.LIBCMT ref: 00873713
Part of subcall function 00873698: __flsbuf.LIBCMT ref: 0087372B

__swprintf.LIBCMT ref: 008BC9C4
__swprintf.LIBCMT ref: 008BCA13
__swprintf.LIBCMT ref: 008BCA62

Strings

%02d, xrefs: 008BC91B, 008BC925, 008BC973, 008BC9C2, 008BCA11, 008BCA60
%4d, xrefs: 008BC8CD
%4d%02d%02d%02d%02d%02d, xrefs: 008BC88A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 7a47beb0635977be0d57d0100b391e2bff66fbce5b744aca8ffadf15cecda289
Instruction ID: 4164296767ddf324a699c2c3e20915746ccc49e36425a4837d2c134b7f90a66e
Opcode Fuzzy Hash: 7a47beb0635977be0d57d0100b391e2bff66fbce5b744aca8ffadf15cecda289
Instruction Fuzzy Hash: 3FA10EB1504344ABC750EB98D885DAFB7ECFF94705F404929F995C6291EB34DA08CB63

Function 008BEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,756E8FB0,?,00000000), ref: 008BEFB6
_wcscmp.LIBCMT ref: 008BEFCB
_wcscmp.LIBCMT ref: 008BEFE2
GetFileAttributesW.KERNEL32(?), ref: 008BEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 008BF00E
FindNextFileW.KERNEL32(00000000,?), ref: 008BF026
FindClose.KERNEL32(00000000), ref: 008BF031
FindFirstFileW.KERNEL32(*.*,?), ref: 008BF04D
_wcscmp.LIBCMT ref: 008BF074
_wcscmp.LIBCMT ref: 008BF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 008BF09D
SetCurrentDirectoryW.KERNEL32(00908920), ref: 008BF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 008BF0C5
FindClose.KERNEL32(00000000), ref: 008BF0D2
FindClose.KERNEL32(00000000), ref: 008BF0E4

Strings

*.*, xrefs: 008BF048

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 9c4f5f42cefbb08b5eff1ab99669bb643fac1b7ee536bb3f2e43232df30f1e42
Instruction ID: 2c2c93a040c962848e8b24b0f8e7debfb0d157e7adfd8080777b18b5827f2a0f
Opcode Fuzzy Hash: 9c4f5f42cefbb08b5eff1ab99669bb643fac1b7ee536bb3f2e43232df30f1e42
Instruction Fuzzy Hash: 4331E332501A086FCB14ABB4DC48AEE77ACFF48360F144276FA55D22A3DB70DA45DE61

Function 008D0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008D0953
RegCreateKeyExW.ADVAPI32(?,?,00000000,008DF910,00000000,?,00000000,?,?), ref: 008D09C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 008D0A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 008D0A92
RegCloseKey.ADVAPI32(?), ref: 008D0DB2
RegCloseKey.ADVAPI32(00000000), ref: 008D0DBF

Strings

REG_BINARY, xrefs: 008D0D4D
REG_EXPAND_SZ, xrefs: 008D0A2F
REG_DWORD, xrefs: 008D0C83
REG_SZ, xrefs: 008D0AD0
REG_QWORD, xrefs: 008D0D00
REG_MULTI_SZ, xrefs: 008D0B7A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 18e0d4f72bd7e2dba11679df349398b10dae4a8e6508ba75114127b885fdfccf
Instruction ID: 366f37e272117cafcc16b74167262a4c6929193578fb63b22bd6a9766c4e3d05
Opcode Fuzzy Hash: 18e0d4f72bd7e2dba11679df349398b10dae4a8e6508ba75114127b885fdfccf
Instruction Fuzzy Hash: AC0237756046119FCB14EF28C851E2AB7E5FF89314F048569F98ADB3A2DB30ED45CB82

Function 008BF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,756E8FB0,?,00000000), ref: 008BF113
_wcscmp.LIBCMT ref: 008BF128
_wcscmp.LIBCMT ref: 008BF13F

Part of subcall function 008B4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 008B43A0

FindNextFileW.KERNEL32(00000000,?), ref: 008BF16E
FindClose.KERNEL32(00000000), ref: 008BF179
FindFirstFileW.KERNEL32(*.*,?), ref: 008BF195
_wcscmp.LIBCMT ref: 008BF1BC
_wcscmp.LIBCMT ref: 008BF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 008BF1E5
SetCurrentDirectoryW.KERNEL32(00908920), ref: 008BF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 008BF20D
FindClose.KERNEL32(00000000), ref: 008BF21A
FindClose.KERNEL32(00000000), ref: 008BF22C

Strings

*.*, xrefs: 008BF190

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: dc801715ee565a577d77e4c8f16b1694a2f0f93e5f0693e74a75e8c15d757665
Instruction ID: fae51e82e0786884f8a232c5f5341cbb82153f7ceeb48af11bd73f918847dcac
Opcode Fuzzy Hash: dc801715ee565a577d77e4c8f16b1694a2f0f93e5f0693e74a75e8c15d757665
Instruction Fuzzy Hash: 0B3116365012197ACB14AFB8EC49EEE77ACFF45320F104272FA54E22A2DB30DE45DA55

Function 008BA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 008BA20F
__swprintf.LIBCMT ref: 008BA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 008BA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 008BA293
_memset.LIBCMT ref: 008BA2B2
_wcsncpy.LIBCMT ref: 008BA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 008BA323
CloseHandle.KERNEL32(00000000), ref: 008BA32E
RemoveDirectoryW.KERNEL32(?), ref: 008BA337
CloseHandle.KERNEL32(00000000), ref: 008BA341

Strings

\??\%s, xrefs: 008BA22B
\, xrefs: 008BA247
:, xrefs: 008BA252

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: afb347b68d865d375ee5976d07f61dd73f8b99433398fce321ba66565b0ad831
Instruction ID: 7b6a94cfc731ff37fa573e6788f84f25fcdb85cdb5d7bad1ef33d08028101f0c
Opcode Fuzzy Hash: afb347b68d865d375ee5976d07f61dd73f8b99433398fce321ba66565b0ad831
Instruction Fuzzy Hash: 5131AFB590010AABDB21DFA4DC49FEB77BCFF89740F1041B6F609D2261EB7096448B25

Function 008A7CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008A8202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 008A821E
Part of subcall function 008A8202: GetLastError.KERNEL32(?,008A7CE2,?,?,?), ref: 008A8228
Part of subcall function 008A8202: GetProcessHeap.KERNEL32(00000008,?,?,008A7CE2,?,?,?), ref: 008A8237
Part of subcall function 008A8202: HeapAlloc.KERNEL32(00000000,?,008A7CE2,?,?,?), ref: 008A823E
Part of subcall function 008A8202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 008A8255

Part of subcall function 008A829F: GetProcessHeap.KERNEL32(00000008,008A7CF8,00000000,00000000,?,008A7CF8,?), ref: 008A82AB
Part of subcall function 008A829F: HeapAlloc.KERNEL32(00000000,?,008A7CF8,?), ref: 008A82B2
Part of subcall function 008A829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,008A7CF8,?), ref: 008A82C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 008A7D13
_memset.LIBCMT ref: 008A7D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 008A7D47
GetLengthSid.ADVAPI32(?), ref: 008A7D58
GetAce.ADVAPI32(?,00000000,?), ref: 008A7D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008A7DB1
GetLengthSid.ADVAPI32(?), ref: 008A7DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 008A7DDD
HeapAlloc.KERNEL32(00000000), ref: 008A7DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 008A7E05
CopySid.ADVAPI32(00000000), ref: 008A7E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 008A7E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 008A7E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 008A7E77

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 682737d12c51cf540aee9c2ba2187550270fc54c3af8969e72e837f8f7c5301b
Instruction ID: a1282c4ed7dc4073f63bde1df3247fcd41a79f62ab2d5bd9182802c1a74a1c6a
Opcode Fuzzy Hash: 682737d12c51cf540aee9c2ba2187550270fc54c3af8969e72e837f8f7c5301b
Instruction Fuzzy Hash: 19614A71904609EFEF01DFA4DC84AAEBB79FF05700F04826AE916E7291DB319E15DB60

Function 008666E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 008A114F
NO_AUTO_POSSESS), xrefs: 008A112E
CRLF), xrefs: 008A12C1
LIMIT_RECURSION=, xrefs: 008A11FC
BSR_UNICODE), xrefs: 008A1338
LF), xrefs: 008A12A4
BSR_ANYCRLF), xrefs: 008A131E
UTF), xrefs: 008A10FA
CR), xrefs: 008A1287
UCP), xrefs: 008A110D
ANYCRLF), xrefs: 008A12FB
LIMIT_MATCH=, xrefs: 008A1170
UTF16), xrefs: 008A10CF
ANY), xrefs: 008A12DE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 3022f9995bc7132aa23e0ba7e63c4ae625967db2ed467ca96c945ecf67be4a18
Instruction ID: 69a21955f68b299de5197db805f226bd4006f363b8ba2e3837fa3903bb3504e0
Opcode Fuzzy Hash: 3022f9995bc7132aa23e0ba7e63c4ae625967db2ed467ca96c945ecf67be4a18
Instruction Fuzzy Hash: 00729171E00219DBEF24CF58C8847AEB7B5FF49314F15816AE949EB681EB349D81CB90

Function 008B001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008B0097
SetKeyboardState.USER32(?), ref: 008B0102
GetAsyncKeyState.USER32(000000A0), ref: 008B0122
GetKeyState.USER32(000000A0), ref: 008B0139
GetAsyncKeyState.USER32(000000A1), ref: 008B0168
GetKeyState.USER32(000000A1), ref: 008B0179
GetAsyncKeyState.USER32(00000011), ref: 008B01A5
GetKeyState.USER32(00000011), ref: 008B01B3
GetAsyncKeyState.USER32(00000012), ref: 008B01DC
GetKeyState.USER32(00000012), ref: 008B01EA
GetAsyncKeyState.USER32(0000005B), ref: 008B0213
GetKeyState.USER32(0000005B), ref: 008B0221

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 821b08392ff77c657fa927ca857bd3920d8584a6e52cf49aac43402008d1dfd0
Instruction ID: 19a600b834fd87725018d773511c01d37d0439d1aedd831c744306ee7e08a239
Opcode Fuzzy Hash: 821b08392ff77c657fa927ca857bd3920d8584a6e52cf49aac43402008d1dfd0
Instruction Fuzzy Hash: 2A51CE2090478819FB35EB6488547EBBFF4FF11380F48459995C29A7C3DA549B8CCF52

Function 008D03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008D0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008CFDAD,?,?), ref: 008D0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008D04AC

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 008D054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 008D05E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 008D0822
RegCloseKey.ADVAPI32(00000000), ref: 008D082F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 1f24432f044b4f4fd48874a692924c0f47ee7148b70716762c9c2c1f453cd02b
Instruction ID: b62b8dedffeb362b0514060ac08df8ee9f0bf7b1c8ca61fdd9488d956aeb2aa8
Opcode Fuzzy Hash: 1f24432f044b4f4fd48874a692924c0f47ee7148b70716762c9c2c1f453cd02b
Instruction Fuzzy Hash: 13E13B71604204AFCB14DF28C895E2ABBE5FF89314F04856DF94ADB262DA31E905CF92

Function 008C4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 008C418B
EmptyClipboard.USER32 ref: 008C4191
GlobalAlloc.KERNEL32(00000002,?), ref: 008C41A6
CloseClipboard.USER32 ref: 008C4245

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 12d00af6de23f926fb915399873fc214ec71274cf11c47e68e8717d5de8226b5
Instruction ID: 01ea87085f7ea2eecc015ecc28d2900dc30394aa8875cd17a5a1cde6e890817b
Opcode Fuzzy Hash: 12d00af6de23f926fb915399873fc214ec71274cf11c47e68e8717d5de8226b5
Instruction Fuzzy Hash: 44218D352012149FDB10AF24EC19F697BA8FF55711F14812AFA86DB2A2DB30E940DB55

Function 008B37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00854750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00854743,?,?,008537AE,?), ref: 00854770

Part of subcall function 008B4A31: GetFileAttributesW.KERNEL32(?,008B370B), ref: 008B4A32

FindFirstFileW.KERNEL32(?,?), ref: 008B38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 008B394B
MoveFileW.KERNEL32(?,?), ref: 008B395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 008B397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 008B399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 008B39B9

Strings

\*.*, xrefs: 008B384E, 008B3857, 008B386C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: d8b2ca7eef9fca1b8494676aeb420dba4ecb9b7480a59872731c36401d7900b0
Instruction ID: b4e4693d149e494ae3de4586c1d8fe105b3a301e963f601e40444a4d9f811c56
Opcode Fuzzy Hash: d8b2ca7eef9fca1b8494676aeb420dba4ecb9b7480a59872731c36401d7900b0
Instruction Fuzzy Hash: AE51523180514CAACF05EBA4D9529EDBB79FF15301F604169E806F62A2EB316F0DCB62

Function 008BF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 008BF440
Sleep.KERNEL32(0000000A), ref: 008BF470
_wcscmp.LIBCMT ref: 008BF484
_wcscmp.LIBCMT ref: 008BF49F
FindNextFileW.KERNEL32(?,?), ref: 008BF53D
FindClose.KERNEL32(00000000), ref: 008BF553

Strings

*.*, xrefs: 008BF425

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: adf72360ebc0b9c807be7a96e84c34323491a68f125c72c574fef5d3845b6810
Instruction ID: ba01859414810dcc96d2fa423b17752c90603a3c2faa8ad0eef21bd2a42dcafd
Opcode Fuzzy Hash: adf72360ebc0b9c807be7a96e84c34323491a68f125c72c574fef5d3845b6810
Instruction Fuzzy Hash: 8B417B7190021AAFCF24EF68DC45AEEBBB4FF05314F144566E915E3292EB309E58CB51

Function 00865760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008658A5
_memmove.LIBCMT ref: 008658F5
_memmove.LIBCMT ref: 0086595B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3f7abf7a32b3ce5a94d26a53e70dafa9b9d0d42d5cc0e865f4457d39b23d52c8
Instruction ID: c1c66d36dbc5303cd360866430b30d07d45d09ee862de03569fd7c8d5faf115a
Opcode Fuzzy Hash: 3f7abf7a32b3ce5a94d26a53e70dafa9b9d0d42d5cc0e865f4457d39b23d52c8
Instruction Fuzzy Hash: D2128970A00A09DFDF14DFA9D981AAEB7F5FF48304F108529E806E7691EB36AD14CB51

Function 008B3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00854750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00854743,?,?,008537AE,?), ref: 00854770

Part of subcall function 008B4A31: GetFileAttributesW.KERNEL32(?,008B370B), ref: 008B4A32

FindFirstFileW.KERNEL32(?,?), ref: 008B3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 008B3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 008B3BEA
FindClose.KERNEL32(00000000), ref: 008B3C01
FindClose.KERNEL32(00000000), ref: 008B3C0A

Strings

\*.*, xrefs: 008B3B5B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 8dcea8aa0187c528fec76d5a578061410367aa868bc0e63a4dbda5f02fde972c
Instruction ID: 7611439ee47de73def9ff5f964c65b53b0a725f01cdf4a08cb515aaf5c84b505
Opcode Fuzzy Hash: 8dcea8aa0187c528fec76d5a578061410367aa868bc0e63a4dbda5f02fde972c
Instruction Fuzzy Hash: 613150310093859BC301EB68D8918EFBBA8FE95315F404E2DF8D6D22A1EB219A0CD753

Function 008B51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 008A87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008A882B
Part of subcall function 008A87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 008A8858
Part of subcall function 008A87E1: GetLastError.KERNEL32 ref: 008A8865

ExitWindowsEx.USER32(?,00000000), ref: 008B51F9

Strings

@, xrefs: 008B51EC
, xrefs: 008B51E7
SeShutdownPrivilege, xrefs: 008B51C9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 0bfab42616403ef4291f9b1ab5aebdd27208e92746c1fa49797df82f52d38b47
Instruction ID: 439df5a529bae25ddb9c456b9adc10b35c6a2f150fa2130cac236c1b042c4ab9
Opcode Fuzzy Hash: 0bfab42616403ef4291f9b1ab5aebdd27208e92746c1fa49797df82f52d38b47
Instruction Fuzzy Hash: 7C0126317D36156FF7286268AC8BFFB7398FB05344F240521FA63E22D2DA511C0085A0

Function 008C6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 008C62DC
WSAGetLastError.WSOCK32(00000000), ref: 008C62EB
bind.WSOCK32(00000000,?,00000010), ref: 008C6307
listen.WSOCK32(00000000,00000005), ref: 008C6316
WSAGetLastError.WSOCK32(00000000), ref: 008C6330
closesocket.WSOCK32(00000000,00000000), ref: 008C6344

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 820e836407aed9cf4cde3ed72820c11d6740439d9e2f0cd2ef605416d544fba3
Instruction ID: 8c6765a45887306dc5e89a3c3a57b27a55b0c4136a15170067173a20085aa8ed
Opcode Fuzzy Hash: 820e836407aed9cf4cde3ed72820c11d6740439d9e2f0cd2ef605416d544fba3
Instruction Fuzzy Hash: 9521BD306002049FDB00EF68C845F6EB7B9FF49720F148269E956E7392DB70AD15DB52

Function 00865520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00870DB6: std::exception::exception.LIBCMT ref: 00870DEC
Part of subcall function 00870DB6: __CxxThrowException@8.LIBCMT ref: 00870E01

_memmove.LIBCMT ref: 008A0258
_memmove.LIBCMT ref: 008A036D
_memmove.LIBCMT ref: 008A0414

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 531ab24ea29683e84f449b26d008fb086e5f96a634b9b4a3de5da546a4be58d4
Instruction ID: cd8f1f798ab385b7082e610d1190ab3bd1f2e32cbe273b382a4e0a64e7b9c6a7
Opcode Fuzzy Hash: 531ab24ea29683e84f449b26d008fb086e5f96a634b9b4a3de5da546a4be58d4
Instruction Fuzzy Hash: C002CDB0A00209DFDF04DF68D981AAEBBB5FF45304F158069E80ADB295EB35D954CF92

Function 00851287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

DefDlgProcW.USER32(?,?,?,?,?), ref: 008519FA
GetSysColor.USER32(0000000F), ref: 00851A4E
SetBkColor.GDI32(?,00000000), ref: 00851A61

Part of subcall function 00851290: DefDlgProcW.USER32(?,00000020,?), ref: 008512D8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 27c3ee59308b2b7d54f61b931bd94d94ab9a576e1e18fa2a5bdf5569ddc31ece
Instruction ID: 517ed483a51e365a1be136c6742c0af67f986aad614a533bb38e0a97d3f69375
Opcode Fuzzy Hash: 27c3ee59308b2b7d54f61b931bd94d94ab9a576e1e18fa2a5bdf5569ddc31ece
Instruction Fuzzy Hash: 74A15B741165A9BADE2BAB2C4C4CFBF3A5DFB82747B15021AFD02D1192DA209D05D373

Function 008BBCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008BBCE6
_wcscmp.LIBCMT ref: 008BBD16
_wcscmp.LIBCMT ref: 008BBD2B
FindNextFileW.KERNEL32(00000000,?), ref: 008BBD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 008BBD6C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: bd9c7c9023af2626cd673321a3dd7ea5dac3e911fd0de089a62852c0c74c15d2
Instruction ID: 58ddc60697a18d3c6896db16cdfcc1c8e0d682e830b188dcce10437b94c60ac1
Opcode Fuzzy Hash: bd9c7c9023af2626cd673321a3dd7ea5dac3e911fd0de089a62852c0c74c15d2
Instruction Fuzzy Hash: AC518D356046029FD714DF68C490E9AB7E4FF49324F18462DE95ACB3A1DB74ED04CB92

Function 008C6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008C7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008C7DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 008C679E
WSAGetLastError.WSOCK32(00000000), ref: 008C67C7
bind.WSOCK32(00000000,?,00000010), ref: 008C6800
WSAGetLastError.WSOCK32(00000000), ref: 008C680D
closesocket.WSOCK32(00000000,00000000), ref: 008C6821

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: c1ab70995073b8303cac2942b91f2de90aaa072acd8827b9c47cc1d3adab87ed
Instruction ID: 264a8e4420331ee268fac70890790d0725106abb06c14587a054926f2e02d035
Opcode Fuzzy Hash: c1ab70995073b8303cac2942b91f2de90aaa072acd8827b9c47cc1d3adab87ed
Instruction Fuzzy Hash: 8241D575600214AFDB10AF288C86F2E77A4FF05714F04456DFD5AEB2D2DA709D048B92

Function 008D5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 008D53C5
IsWindowEnabled.USER32 ref: 008D53D3
GetForegroundWindow.USER32(?,?,00000001), ref: 008D53E0
IsIconic.USER32 ref: 008D53EE
IsZoomed.USER32 ref: 008D53FC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 84d614b5a6a9c5b7c88e2d50d45b33d20439d09497aeb33cdeeb5ea7da332089
Instruction ID: ae84fc7bd324ecc9aff9b2782bd0ee5df642b5b86f7ec7cd6c4b81044a777610
Opcode Fuzzy Hash: 84d614b5a6a9c5b7c88e2d50d45b33d20439d09497aeb33cdeeb5ea7da332089
Instruction Fuzzy Hash: E1112731301911AFEB205F2ADC44A6E7B99FF453A1B00423BF946D7342CB70DD01CAA5

Function 008A80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 008A80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 008A80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 008A80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 008A80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 008A80F6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 7aadf63651c9aefe7c0acb4746aaa0e6c68ed929a24399bff09c88eb68c473ec
Instruction ID: 4ce9b11032c4591482b0fbcf2e1a250fcfd0edfd829d2e57e1deb589f0aac084
Opcode Fuzzy Hash: 7aadf63651c9aefe7c0acb4746aaa0e6c68ed929a24399bff09c88eb68c473ec
Instruction Fuzzy Hash: 5EF04F31241204EFEB114FA5EC8DE673BACFF4A755F040126FA46C6151CB659D41EA70

Function 008BC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008BC432
CoCreateInstance.OLE32(008E2D6C,00000000,00000001,008E2BDC,?), ref: 008BC44A

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

CoUninitialize.OLE32 ref: 008BC6B7

Strings

.lnk, xrefs: 008BC3C6, 008BC3EE, 008BC3F8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: c9e7e4de6ae04c6b71118a9ca838b44eb18493b967ee28ced57e52d5894d0256
Instruction ID: 089123daf38dc2e1c43bae88bec252c99159fa1a2a4c4770ff89e663c1400cf5
Opcode Fuzzy Hash: c9e7e4de6ae04c6b71118a9ca838b44eb18493b967ee28ced57e52d5894d0256
Instruction Fuzzy Hash: FBA14B71104205AFD300EF58C891EABB7E8FF95355F00492DF595DB2A2EB71EA09CB62

Function 00854B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00854AD0), ref: 00854B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00854B57

Strings

GetNativeSystemInfo, xrefs: 00854B51
kernel32.dll, xrefs: 00854B40

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 2b7d76875886dc593fa4b45f48d751be8cc19a327e4b0458b4cda9512ca00fd2
Instruction ID: 02d06edf537336057df6ef41ecf8106446118de39c1596d3b3d49f4ee74f2e9e
Opcode Fuzzy Hash: 2b7d76875886dc593fa4b45f48d751be8cc19a327e4b0458b4cda9512ca00fd2
Instruction Fuzzy Hash: 9ED0C730A00313CFCB208F72E828B0273E4FF013A2B14893BA9A3D2250E774E8C0DA14

Function 00863030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: c39eca13d38656afd6116e5ea498ce405d2b6408342a28c42ffde65600cbc593
Instruction ID: ac2b3ae33c220fe33742a22b782a88a9452731fa35d81049dcfb1a6d95c8c876
Opcode Fuzzy Hash: c39eca13d38656afd6116e5ea498ce405d2b6408342a28c42ffde65600cbc593
Instruction Fuzzy Hash: DB2257716083019FDB24DF28C891B6AB7E4FF84314F15492DF99AD7291EB71E908CB92

Function 008CEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 008CEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 008CEE4B

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Process32NextW.KERNEL32(00000000,?), ref: 008CEF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 008CEF1A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 8cefac661d5587b8c7229fae670b26ac1cfafd217b9ea3dd11a9dd7cdcf33472
Instruction ID: e467608debdd1573d03debb84b34a05235189eb6eb1589fff51aa80c77f19046
Opcode Fuzzy Hash: 8cefac661d5587b8c7229fae670b26ac1cfafd217b9ea3dd11a9dd7cdcf33472
Instruction Fuzzy Hash: 86517B71104311AFD310EF28D885E6BBBE8FF94750F50482DF995D62A2EB70E908CB92

Function 008AE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 008AE628

Strings

|, xrefs: 008AE658
(, xrefs: 008AE66E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 007853aed9a95a90f1f805b802478c8b21c879ee5a2bbac7f780d0bbab5392e9
Instruction ID: 0ae22ef131ab7bfac225d517132b143d1f403bc665c9559fd48892b3cc0b0a56
Opcode Fuzzy Hash: 007853aed9a95a90f1f805b802478c8b21c879ee5a2bbac7f780d0bbab5392e9
Instruction Fuzzy Hash: F6322575A007059FDB28CF59C481A6AB7F0FF58320B15C96EE89ADB7A1E770E941CB40

Function 008C22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,008C180A,00000000), ref: 008C23E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 008C2418

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 9f7a3b8890ddf5bf3cac456362ed32068d80271a4f4d32295acad0bcc3dd4be9
Instruction ID: fee8e319f568b6eed6c1c93916bbc591253b062506cffb0564a9718c90b4c5fe
Opcode Fuzzy Hash: 9f7a3b8890ddf5bf3cac456362ed32068d80271a4f4d32295acad0bcc3dd4be9
Instruction Fuzzy Hash: 0B41E371A04209BFEB10DEA9DC81FBBB7BCFB40728F10406EF605E6291DA75DE419654

Function 008BB3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008BB40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 008BB465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 008BB4B2

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: fce930740bd684fc74bcc831e26b8086295b386347c260c9f3b91c356e480d98
Instruction ID: 03482bfde07ad646fd5dade0cc406ee04f9e7806407dd7fa24bdaaaf5d76b999
Opcode Fuzzy Hash: fce930740bd684fc74bcc831e26b8086295b386347c260c9f3b91c356e480d98
Instruction Fuzzy Hash: D2217435A00118DFCB00DF65D880AEDBBB8FF49315F1480AAE945EB352DB319915CF51

Function 008A87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00870DB6: std::exception::exception.LIBCMT ref: 00870DEC
Part of subcall function 00870DB6: __CxxThrowException@8.LIBCMT ref: 00870E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008A882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 008A8858
GetLastError.KERNEL32 ref: 008A8865

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 889f45f4f529754383d99d63228a2996ae3c09ceea4dd555f0686691872e3d6a
Instruction ID: 1c4f2cf3333f518f65d5301790e01e4b5980a605d769df242aff3f5395c4b1d6
Opcode Fuzzy Hash: 889f45f4f529754383d99d63228a2996ae3c09ceea4dd555f0686691872e3d6a
Instruction Fuzzy Hash: 9F116DB2414304EFE728DFA4DC85D6BBBE8FB45714B20862EE45697641EF34AC408B60

Function 008A874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 008A8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 008A878B
FreeSid.ADVAPI32(?), ref: 008A879B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 9dadd24eb0c1b7d6707d482f92d7eb90a974458e94bed5983dc51f204d158462
Instruction ID: e01d0ea41bfb4c2e1be4af92b9eac3cba28af00779abcf52d26b76165b427217
Opcode Fuzzy Hash: 9dadd24eb0c1b7d6707d482f92d7eb90a974458e94bed5983dc51f204d158462
Instruction Fuzzy Hash: FFF03C75911208BBDB00DFE49C89AADB7B8FF08201F504569A602E2282D7715A049B50

Function 008BC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008BC6FB
FindClose.KERNEL32(00000000), ref: 008BC72B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 11248b5474785adc2445bc1850d694666ba2dd1b801850fc0258f71eb232ec50
Instruction ID: 5b6c7978dcbd74aab44b908855ec4380d08ce3b0cc3b49cad42c2273900daaa5
Opcode Fuzzy Hash: 11248b5474785adc2445bc1850d694666ba2dd1b801850fc0258f71eb232ec50
Instruction Fuzzy Hash: 451152716006049FDB10DF29D84596AF7E5FF45325F04861EF9A9DB391DB30A905CF81

Function 008BA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,008C9468,?,008DFB84,?), ref: 008BA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,008C9468,?,008DFB84,?), ref: 008BA0A9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 84e86e8b7e5446731944dd5528cab6eda68dd35f29c9fac9db3c8af35e4618d8
Instruction ID: 89f0ed2445fd21ab96b31d44a8783f1de913d97b853cd95060b81d3de3ca99c2
Opcode Fuzzy Hash: 84e86e8b7e5446731944dd5528cab6eda68dd35f29c9fac9db3c8af35e4618d8
Instruction Fuzzy Hash: 0CF0823515522DBBDB21AFA4DC48FEA776CFF08361F008266F909D6281DA309944CBA2

Function 008A81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008A8309), ref: 008A81E0
CloseHandle.KERNEL32(?,?,008A8309), ref: 008A81F2

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 9028583ef60427950a1c8f55aaa39bcd1b200107544fbd2843a27efbb051b0f9
Instruction ID: 218b920f278d57e8a10d73626f8b3f3ea371adae3844e9da17db17e19ecab90b
Opcode Fuzzy Hash: 9028583ef60427950a1c8f55aaa39bcd1b200107544fbd2843a27efbb051b0f9
Instruction Fuzzy Hash: 45E0B672011A10EFE7252B65EC09D777BEAFB04310B14C92AB9AAC4475DB62ACD1EB50

Function 0087A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00878D57,?,?,?,00000001), ref: 0087A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0087A163

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b21c2ee4f52a08c1ef0723015cfe90ac9fa15716705e4eb21ae9ab3193e86e1f
Instruction ID: 1eb755abf2017475ccc51ea8540c8a7bdb67c489fa987216bfd95980c7d7161b
Opcode Fuzzy Hash: b21c2ee4f52a08c1ef0723015cfe90ac9fa15716705e4eb21ae9ab3193e86e1f
Instruction Fuzzy Hash: 34B09231055208ABCA042B95EC09B883F68FB44AA2F418122F70E84262CB625450AA91

Function 0087F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064190b35567f6dafb4b9e25c30b716a0b63127bef90c5a50a81634d212f754a
Instruction ID: 19d733d5bdf4748038d4bde492470fa591d36119b601d2bb5a4aa8964669e158
Opcode Fuzzy Hash: 064190b35567f6dafb4b9e25c30b716a0b63127bef90c5a50a81634d212f754a
Instruction Fuzzy Hash: 85321422D29F814DD7239635D872336A648FFB73D4F15D737E919B99AAEB28C4834100

Function 0088242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39ec0152940c58a95d3cf5211d938015145523a2cc6ecadd7f4a5ac33413615
Instruction ID: 53eedfee01053c89c5e34a2be104930d775bf88af5a11d6c20e4b9230f65431a
Opcode Fuzzy Hash: f39ec0152940c58a95d3cf5211d938015145523a2cc6ecadd7f4a5ac33413615
Instruction Fuzzy Hash: 8BB1F120D2AF814DD323A6398871336B65CBFBB6C9F52D71BFC1674E62EB2195834241

Function 008B8889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 008B889B

Part of subcall function 0087520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,008B8F6E,00000000,?,?,?,?,008B911F,00000000,?), ref: 00875213
Part of subcall function 0087520A: __aulldiv.LIBCMT ref: 00875233

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: f73ea278f0f411a2a2cfc9da31b7edb714768298ef1e2eed1070b97b50cdb9b2
Instruction ID: 46920284f62f924fe7cfff964ad1e91234c3ec4a3aba955df4b4145135bd4140
Opcode Fuzzy Hash: f73ea278f0f411a2a2cfc9da31b7edb714768298ef1e2eed1070b97b50cdb9b2
Instruction Fuzzy Hash: 9521B432A35610CBC729CF29D841A92B3E5EFA5311B688E6CE0F5CB2C0CB74B905DB54

Function 008B4C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 008B4C4A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: f8f7e547b6251fa09a086543fd7f1db84fe3875dfb22c57efc5a3d66fb27c940
Instruction ID: 68bb645f4e240b2f89ef62fabd0a962ae5b4fc9f578989b61e998666c3d49ff6
Opcode Fuzzy Hash: f8f7e547b6251fa09a086543fd7f1db84fe3875dfb22c57efc5a3d66fb27c940
Instruction Fuzzy Hash: A1D09E951A661E79ED5C0B649E2FFFA1A48F340F96FD4B2897602CA2C3ECB05C446132

Function 008A87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,008A8389), ref: 008A87D1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: fc7a1371d78abb4f6dbff6ca89803e894866f5db737d044b9e8533b736437195
Instruction ID: ad3b4468093ede5048782318e95f3890d4a8d14c34d2bdc932bf8bab76e7383e
Opcode Fuzzy Hash: fc7a1371d78abb4f6dbff6ca89803e894866f5db737d044b9e8533b736437195
Instruction Fuzzy Hash: 76D09E3226490EABEF019EA4DD05EAE3B69EB04B01F408511FE16D61A1C775D935AB60

Function 0087A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0087A12A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2a1cf90699b15c9e5a73ddb07651e9c5a130a7039459a8d539f12c26046a4d32
Instruction ID: 76d8db1bd115f0388227c79c2f52dc81ce16b65204f9fcca6f98419d33c622ef
Opcode Fuzzy Hash: 2a1cf90699b15c9e5a73ddb07651e9c5a130a7039459a8d539f12c26046a4d32
Instruction Fuzzy Hash: 9AA0123000010CA7CA001B45EC044447F5CE600190B004021F50D40122873254105580

Function 00868808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cb016ce8f0b2248bc49a9374c8aeedc137200dcb715a1c9c0180f42034df965
Instruction ID: 753607d9f3c486e35356f720aabdcda143e7888510bf45917ef681f370cf6f1e
Opcode Fuzzy Hash: 5cb016ce8f0b2248bc49a9374c8aeedc137200dcb715a1c9c0180f42034df965
Instruction Fuzzy Hash: A0226A3051451ACBEF388B64C49477D7BA1FF42308F2A826BD94ADB992DB709DD1CB42

Function 008721C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 0575c882fdaf774d868f911d1b20bee1580c2a083eac500afda2365cbe031dd0
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 4CC183322050930ADF6D463D847503EFEA1FEA27B131A875DD8BACB5D9EE20C965D720

Function 008725FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 939f90fa4c927bbd74b5182061d1de2e7cee3f55ed6797b266b14f0c97819e66
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 6BC1963220519309DF2D463DC47513EBEA1FEA27B131A876DD4BADB5D8EE20C925D720

Function 00871978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 967191d50447ca7adf4c12b87571d6ce97b757dac9b5e2c65d926b7dca0ae1a8
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 63C1843220519309DF2D463D847913EFEA1EFA27B131A875DD4BADB9C8EE20C965DB10

Function 008C7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 008C785B
DeleteObject.GDI32(00000000), ref: 008C786D
DestroyWindow.USER32 ref: 008C787B
GetDesktopWindow.USER32 ref: 008C7895
GetWindowRect.USER32(00000000), ref: 008C789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 008C79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 008C79ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7A35
GetClientRect.USER32(00000000,?), ref: 008C7A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 008C7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7ABB
GlobalLock.KERNEL32(00000000), ref: 008C7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7AD3
GlobalUnlock.KERNEL32(00000000), ref: 008C7ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7AE3
GlobalFree.KERNEL32(00000000), ref: 008C7AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,008E2CAC,00000000), ref: 008C7B16
GlobalFree.KERNEL32(00000000), ref: 008C7B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 008C7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 008C7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008C7D7A

Strings

, xrefs: 008C7D00
AutoIt v3, xrefs: 008C7A2D
static, xrefs: 008C7A75, 008C7BCC
DISPLAY, xrefs: 008C7BDD

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 15bc2794966ba137558fe31466ccedd05c1f6e383d176bc6895eff1f4aa4a89e
Instruction ID: 289191b753c2898c7bfe152a2725a77c298cd68bd61053a7499cceab478c24a4
Opcode Fuzzy Hash: 15bc2794966ba137558fe31466ccedd05c1f6e383d176bc6895eff1f4aa4a89e
Instruction Fuzzy Hash: F4021971901115EFDB14DFA8DC89EAE7BB9FB48310F148269F916EB2A1C7349D01DB60

Function 008D356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,008DF910), ref: 008D3627
IsWindowVisible.USER32(?), ref: 008D364B

Strings

ISENABLED, xrefs: 008D366B
ISCHECKED, xrefs: 008D3839
SETCURRENTSELECTION, xrefs: 008D37B6
EDITPASTE, xrefs: 008D395F
GETLINECOUNT, xrefs: 008D38C6
TABRIGHT, xrefs: 008D369D
UNCHECK, xrefs: 008D3883
GETCURRENTSELECTION, xrefs: 008D37E3
ISVISIBLE, xrefs: 008D3637
GETLINE, xrefs: 008D399B
SELECTSTRING, xrefs: 008D3806
FINDSTRING, xrefs: 008D3776
SHOWDROPDOWN, xrefs: 008D36E0
GETCURRENTCOL, xrefs: 008D3928
DELSTRING, xrefs: 008D3749
CHECK, xrefs: 008D386D
GETCURRENTLINE, xrefs: 008D38ED
TABLEFT, xrefs: 008D3687
GETSELECTED, xrefs: 008D38A3
SENDCOMMANDID, xrefs: 008D39DA
HIDEDROPDOWN, xrefs: 008D3700
ADDSTRING, xrefs: 008D3716
CURRENTTAB, xrefs: 008D36BD

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 25f8f0ce4573d540f4e249ac7b44f44df2e89bd39443618f55254b46a2be9152
Instruction ID: 1180888cba1431ad13227866aad9179c28b38c2e42a1a3a7b6dc3561e73faa42
Opcode Fuzzy Hash: 25f8f0ce4573d540f4e249ac7b44f44df2e89bd39443618f55254b46a2be9152
Instruction Fuzzy Hash: 93D16B30204311DBCB14EF14C852A6EBBA1FF95754F148569F886DB7A3DB21EA0ACB53

Function 008DA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 008DA630
GetSysColorBrush.USER32(0000000F), ref: 008DA661
GetSysColor.USER32(0000000F), ref: 008DA66D
SetBkColor.GDI32(?,000000FF), ref: 008DA687
SelectObject.GDI32(?,00000000), ref: 008DA696
InflateRect.USER32(?,000000FF,000000FF), ref: 008DA6C1
GetSysColor.USER32(00000010), ref: 008DA6C9
CreateSolidBrush.GDI32(00000000), ref: 008DA6D0
FrameRect.USER32(?,?,00000000), ref: 008DA6DF
DeleteObject.GDI32(00000000), ref: 008DA6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 008DA731
FillRect.USER32(?,?,00000000), ref: 008DA763
GetWindowLongW.USER32(?,000000F0), ref: 008DA78E

Part of subcall function 008DA8CA: GetSysColor.USER32(00000012), ref: 008DA903
Part of subcall function 008DA8CA: SetTextColor.GDI32(?,?), ref: 008DA907
Part of subcall function 008DA8CA: GetSysColorBrush.USER32(0000000F), ref: 008DA91D
Part of subcall function 008DA8CA: GetSysColor.USER32(0000000F), ref: 008DA928
Part of subcall function 008DA8CA: GetSysColor.USER32(00000011), ref: 008DA945
Part of subcall function 008DA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 008DA953
Part of subcall function 008DA8CA: SelectObject.GDI32(?,00000000), ref: 008DA964
Part of subcall function 008DA8CA: SetBkColor.GDI32(?,00000000), ref: 008DA96D
Part of subcall function 008DA8CA: SelectObject.GDI32(?,?), ref: 008DA97A
Part of subcall function 008DA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 008DA999
Part of subcall function 008DA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008DA9B0
Part of subcall function 008DA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 008DA9C5
Part of subcall function 008DA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 008DA9ED

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: dac33c3f2020893268fae2c9de7fe72ff71365ec7c906093074fdd12f8c54d09
Instruction ID: 59d2ebead33c7e2f524942242c1fa91ba726566a805eef6731221e17f0290302
Opcode Fuzzy Hash: dac33c3f2020893268fae2c9de7fe72ff71365ec7c906093074fdd12f8c54d09
Instruction Fuzzy Hash: 67917E72009305EFCB119F64EC08A5B7BB9FF88321F144B2AFAA2D61A1D771D944DB52

Function 00852C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00852CA2
DeleteObject.GDI32(00000000), ref: 00852CE8
DeleteObject.GDI32(00000000), ref: 00852CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00852CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00852D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0088C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0088C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0088C89D

Part of subcall function 00851B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00852036,?,00000000,?,?,?,?,008516CB,00000000,?), ref: 00851B9A

SendMessageW.USER32(?,00001053), ref: 0088C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0088C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0088C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0088C912

Strings

0, xrefs: 0088C731

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 2486c5b2e5bde8bb019aa9e3c06608becabbd7d50b47fd6410b945bc872234b2
Instruction ID: 93dab84af8fab4c1591e898373ef79148bf569e6cee991feb9d1a00c261ab74a
Opcode Fuzzy Hash: 2486c5b2e5bde8bb019aa9e3c06608becabbd7d50b47fd6410b945bc872234b2
Instruction Fuzzy Hash: 4C129E30600201DFDB25EF28C884BA9BBE1FF05315F5445B9E996CB666CB31EC45DBA1

Function 008C74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 008C74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 008C759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 008C75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 008C75ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 008C7633
GetClientRect.USER32(00000000,?), ref: 008C763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 008C7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 008C7692
GetStockObject.GDI32(00000011), ref: 008C76A2
SelectObject.GDI32(00000000,00000000), ref: 008C76A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 008C76B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008C76BF
DeleteDC.GDI32(00000000), ref: 008C76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 008C76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 008C770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 008C7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 008C775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 008C776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 008C779B
GetStockObject.GDI32(00000011), ref: 008C77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 008C77B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 008C77BB

Strings

AutoIt v3, xrefs: 008C762B
static, xrefs: 008C767D, 008C7795
DISPLAY, xrefs: 008C7688
msctls_progress32, xrefs: 008C773C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: f558f17aa8b86f641e5de57a1701c9e397d31084d49a9ee6bc564c791454d657
Instruction ID: f6b2b37fcffa70924fd25ecc6ff36c1aac6f73e8b685fc9571f4821383137c42
Opcode Fuzzy Hash: f558f17aa8b86f641e5de57a1701c9e397d31084d49a9ee6bc564c791454d657
Instruction Fuzzy Hash: 27A15E71A40615BFEB149BA8DC4AFAE7BB9FB48710F058215FA15E72E1C670AD00DB60

Function 008BAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008BAD1E
GetDriveTypeW.KERNEL32(?,008DFAC0,?,\\.\,008DF910), ref: 008BADFB
SetErrorMode.KERNEL32(00000000,008DFAC0,?,\\.\,008DF910), ref: 008BAF59

Strings

1394, xrefs: 008BAEDB
Fibre, xrefs: 008BAEE9
SSA, xrefs: 008BAEE2
SSD, xrefs: 008BAE86
Network, xrefs: 008BAE39
RAID, xrefs: 008BAEF7
CDROM, xrefs: 008BAE2F
ATAPI, xrefs: 008BAECD
Fixed, xrefs: 008BAE43
PhysicalDrive, xrefs: 008BADA7
Removable, xrefs: 008BAE4D
USB, xrefs: 008BAEF0
SAS, xrefs: 008BAF05
iSCSI, xrefs: 008BAEFE
RAMDisk, xrefs: 008BAE25
SCSI, xrefs: 008BAEC6
Virtual, xrefs: 008BAF21
MMC, xrefs: 008BAF1A
Unknown, xrefs: 008BAE1B, 008BAEBF
FileBackedVirtual, xrefs: 008BAF28
\\.\, xrefs: 008BAD70
ATA, xrefs: 008BAED4
SATA, xrefs: 008BAF0C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 36c863b46b4c0df254f2ead13185f9d36c80be34fcb60434c4b7d74fc155bece
Instruction ID: f4b08b30684f8e388ff43fb6f4386e1d11808691c09e9e8e5523a7e6a1648560
Opcode Fuzzy Hash: 36c863b46b4c0df254f2ead13185f9d36c80be34fcb60434c4b7d74fc155bece
Instruction Fuzzy Hash: E8516DB0744209AECB08EB14D9528FE77A1FB887197244066F846E77D1DE319D09AB53

Function 008D9A1C Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 008D9AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 008D9B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 008D9BA7

Strings

0, xrefs: 008D9BE4
V, xrefs: 008D9A6B, 008D9EB2, 008D9F00

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0$V
API String ID: 2326795674-3648174478
Opcode ID: 3e897462c54ab85585b108647e633945c532a10b2fabf49d675d403b9b69193e
Instruction ID: ab89076d42609243a07d647b4bbbf07e3078689cd8549b6fc1bf949a113aec2d
Opcode Fuzzy Hash: 3e897462c54ab85585b108647e633945c532a10b2fabf49d675d403b9b69193e
Instruction Fuzzy Hash: F102BC31209201AFD725CF24C849BAABBE5FF89314F04862EF9D9D63A1CB74D944DB52

Function 008568DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00856931
__wcsnicmp.LIBCMT ref: 00856949
__wcsnicmp.LIBCMT ref: 00856961
__wcsnicmp.LIBCMT ref: 00856979
__wcsnicmp.LIBCMT ref: 00856991
__wcsnicmp.LIBCMT ref: 008569A9
__wcsnicmp.LIBCMT ref: 008569C1
__wcsnicmp.LIBCMT ref: 008569D5
__wcsnicmp.LIBCMT ref: 00856A16
__wcsnicmp.LIBCMT ref: 00856A2A
__wcsnicmp.LIBCMT ref: 00856A3E
__wcsnicmp.LIBCMT ref: 00856A52

Strings

#pragma compile, xrefs: 0085692B
#notrayicon, xrefs: 00856943
#cs, xrefs: 008569CF, 00856A24
#include, xrefs: 008569A3
#requireadmin, xrefs: 0085695B
#comments-end, xrefs: 00856A38
#ce, xrefs: 00856A4C
#OnAutoItStartRegister, xrefs: 00856973
Unterminated group of comments, xrefs: 0088E403
Cannot parse #include, xrefs: 0088E3F0
Bad directive syntax error, xrefs: 0088E31A
#comments-start, xrefs: 008569BB, 00856A10
#include-once, xrefs: 0085698B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: e6bdfea484ac11b6ca6b5429dfe0b1a9a8f4f232756c2fcdcc2823a08c34bb94
Instruction ID: e65669189f053de8e33258153c2e74e6f0cd5c8735959bac1d657dfc1fca2580
Opcode Fuzzy Hash: e6bdfea484ac11b6ca6b5429dfe0b1a9a8f4f232756c2fcdcc2823a08c34bb94
Instruction Fuzzy Hash: A18148B0600219AACB21BB24EC42FAF3768FF11755F444025FD05EB296FB60DE69D362

Function 008D89D5 Relevance: 40.7, APIs: 21, Strings: 2, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 008D8AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008D8AD2
CharNextW.USER32(0000014E), ref: 008D8B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 008D8B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 008D8B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008D8B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 008D8B86
SetWindowTextW.USER32(?,0000014E), ref: 008D8BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 008D8BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 008D8C1F
_memset.LIBCMT ref: 008D8C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 008D8C8D
_memset.LIBCMT ref: 008D8CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 008D8D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 008D8D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 008D8E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 008D8E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008D8E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008D8EB4
DrawMenuBar.USER32(?), ref: 008D8EC3
SetWindowTextW.USER32(?,0000014E), ref: 008D8EEB

Strings

V, xrefs: 008D8A23
0, xrefs: 008D8E55

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0$V
API String ID: 1073566785-3648174478
Opcode ID: 8252bb122185e117a1d79a4ec3ef111be798245e1c3e332cd70a1815dede4c25
Instruction ID: 4969f0e354924122ac315b4d196f794e463a35ba9eaaf73d34f642c2fa4ccee6
Opcode Fuzzy Hash: 8252bb122185e117a1d79a4ec3ef111be798245e1c3e332cd70a1815dede4c25
Instruction Fuzzy Hash: F9E14C71901218EBDB209F54CC84EEE7BB9FB09724F108257FA15EA291DB709A80DF61

Function 008DA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 008DA903
SetTextColor.GDI32(?,?), ref: 008DA907
GetSysColorBrush.USER32(0000000F), ref: 008DA91D
GetSysColor.USER32(0000000F), ref: 008DA928
CreateSolidBrush.GDI32(?), ref: 008DA92D
GetSysColor.USER32(00000011), ref: 008DA945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 008DA953
SelectObject.GDI32(?,00000000), ref: 008DA964
SetBkColor.GDI32(?,00000000), ref: 008DA96D
SelectObject.GDI32(?,?), ref: 008DA97A
InflateRect.USER32(?,000000FF,000000FF), ref: 008DA999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 008DA9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 008DA9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 008DA9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 008DAA14
InflateRect.USER32(?,000000FD,000000FD), ref: 008DAA32
DrawFocusRect.USER32(?,?), ref: 008DAA3D
GetSysColor.USER32(00000011), ref: 008DAA4B
SetTextColor.GDI32(?,00000000), ref: 008DAA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 008DAA67
SelectObject.GDI32(?,008DA5FA), ref: 008DAA7E
DeleteObject.GDI32(?), ref: 008DAA89
SelectObject.GDI32(?,?), ref: 008DAA8F
DeleteObject.GDI32(?), ref: 008DAA94
SetTextColor.GDI32(?,?), ref: 008DAA9A
SetBkColor.GDI32(?,?), ref: 008DAAA4

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 090ba852c3eed2e75258fae663e2e5badd844ec2bcd7b62f4fc039a53c912858
Instruction ID: 73da3886d5d80508d51772683faf53d3768fddd6af0c9f627988f91ccfeed1f6
Opcode Fuzzy Hash: 090ba852c3eed2e75258fae663e2e5badd844ec2bcd7b62f4fc039a53c912858
Instruction Fuzzy Hash: 0A513071901208FFDF119FA4DC48EAE7B79FB08320F254226FA16AB2A2D7759940DF50

Function 008D488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 008D49CA
GetDesktopWindow.USER32 ref: 008D49DF
GetWindowRect.USER32(00000000), ref: 008D49E6
GetWindowLongW.USER32(?,000000F0), ref: 008D4A48
DestroyWindow.USER32(?), ref: 008D4A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 008D4A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 008D4ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 008D4AE1
SendMessageW.USER32(?,00000421,?,?), ref: 008D4AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 008D4B09
IsWindowVisible.USER32(?), ref: 008D4B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 008D4B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 008D4B58
GetWindowRect.USER32(?,?), ref: 008D4B70
MonitorFromPoint.USER32(?,?,00000002), ref: 008D4B96
GetMonitorInfoW.USER32(00000000,?), ref: 008D4BB0
CopyRect.USER32(?,?), ref: 008D4BC7
SendMessageW.USER32(?,00000412,00000000), ref: 008D4C32

Strings

(, xrefs: 008D4BA3
tooltips_class32, xrefs: 008D4A96
0, xrefs: 008D4975

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 41547b58b3ce40c1c23673e87b4351ccf1a05397e66d813a25b9d555c97c525f
Instruction ID: fad30d3d5bb1a0253b34743b7833df0395b989cd444b51457073184c92aa9160
Opcode Fuzzy Hash: 41547b58b3ce40c1c23673e87b4351ccf1a05397e66d813a25b9d555c97c525f
Instruction Fuzzy Hash: 82B15971604350AFDB04DF68D844B6ABBE4FF88314F008A1AF99ADB2A1D771EC05CB56

Function 008B449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 008B44AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 008B44D2
_wcscpy.LIBCMT ref: 008B4500
_wcscmp.LIBCMT ref: 008B450B
_wcscat.LIBCMT ref: 008B4521
_wcsstr.LIBCMT ref: 008B452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 008B4548
_wcscat.LIBCMT ref: 008B4591
_wcscat.LIBCMT ref: 008B4598
_wcsncpy.LIBCMT ref: 008B45C3

Strings

%u.%u.%u.%u, xrefs: 008B4626
StringFileInfo\, xrefs: 008B451B
04090000, xrefs: 008B457E
\VarFileInfo\Translation, xrefs: 008B4540
DefaultLangCodepage, xrefs: 008B45AB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: c185bbf0e321a7d475a220d76966d0eec5484c999ea7ea9168d27b2d10974167
Instruction ID: ec1a3b709f5fe6318f845764af29c2707af80b163d43c245fc3e8e834e734c3a
Opcode Fuzzy Hash: c185bbf0e321a7d475a220d76966d0eec5484c999ea7ea9168d27b2d10974167
Instruction Fuzzy Hash: B341D8326002147BDB10AA789C47EFF776CFF41714F04456AFA09E6283EA75DA0196A6

Function 008527D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008528BC
GetSystemMetrics.USER32(00000007), ref: 008528C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008528EF
GetSystemMetrics.USER32(00000008), ref: 008528F7
GetSystemMetrics.USER32(00000004), ref: 0085291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00852939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00852949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0085297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00852990
GetClientRect.USER32(00000000,000000FF), ref: 008529AE
GetStockObject.GDI32(00000011), ref: 008529CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 008529D5

Part of subcall function 00852344: GetCursorPos.USER32(?), ref: 00852357
Part of subcall function 00852344: ScreenToClient.USER32(009157B0,?), ref: 00852374
Part of subcall function 00852344: GetAsyncKeyState.USER32(00000001), ref: 00852399
Part of subcall function 00852344: GetAsyncKeyState.USER32(00000002), ref: 008523A7

SetTimer.USER32(00000000,00000000,00000028,00851256), ref: 008529FC

Strings

AutoIt v3 GUI, xrefs: 00852974

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 4d7f7a59722400d2546e6c927b9b99d0b584fedccf983402795c1d7c7b5f7024
Instruction ID: 29b4f5e599d2159a9242958950731c3cb972738599d1df48e401da3c8da08cf5
Opcode Fuzzy Hash: 4d7f7a59722400d2546e6c927b9b99d0b584fedccf983402795c1d7c7b5f7024
Instruction Fuzzy Hash: 8DB17D71A0020ADFDB15DFA8DC85BED7BB5FB48315F118229FA16E7290DB74A840DB50

Function 008AA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 008AA47A
__swprintf.LIBCMT ref: 008AA51B
_wcscmp.LIBCMT ref: 008AA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 008AA583
_wcscmp.LIBCMT ref: 008AA5BF
GetClassNameW.USER32(?,?,00000400), ref: 008AA5F6
GetDlgCtrlID.USER32(?), ref: 008AA648
GetWindowRect.USER32(?,?), ref: 008AA67E
GetParent.USER32(?), ref: 008AA69C
ScreenToClient.USER32(00000000), ref: 008AA6A3
GetClassNameW.USER32(?,?,00000100), ref: 008AA71D
_wcscmp.LIBCMT ref: 008AA731
GetWindowTextW.USER32(?,?,00000400), ref: 008AA757
_wcscmp.LIBCMT ref: 008AA76B

Part of subcall function 0087362C: _iswctype.LIBCMT ref: 00873634

Strings

%s%u, xrefs: 008AA515

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 104f1952ae324832f9dbe1436dc4a8f6736e81ad53241065d2f0ebd6b0433f43
Instruction ID: fd18c7f08040bf03cce9a3417c3d2bcfc373d519cbd56210c00994d03324f7c7
Opcode Fuzzy Hash: 104f1952ae324832f9dbe1436dc4a8f6736e81ad53241065d2f0ebd6b0433f43
Instruction Fuzzy Hash: 96A1F371204706AFE719DF64C884BAAB7E8FF55314F00862AF999D2990DB30E945CB92

Function 008AAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 008AAF18
_wcscmp.LIBCMT ref: 008AAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 008AAF51
CharUpperBuffW.USER32(?,00000000), ref: 008AAF6E
_wcscmp.LIBCMT ref: 008AAF8C
_wcsstr.LIBCMT ref: 008AAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 008AAFD5
_wcscmp.LIBCMT ref: 008AAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 008AB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 008AB055
_wcscmp.LIBCMT ref: 008AB065
GetClassNameW.USER32(00000010,?,00000400), ref: 008AB08D
GetWindowRect.USER32(00000004,?), ref: 008AB0F6

Strings

ThumbnailClass, xrefs: 008AAFE0, 008AB060
@, xrefs: 008AAEF9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: bd734b416b9f0b129252559e8ebac4dc441db0c49c041c62ae61a73b70f31fff
Instruction ID: 14466b479d117ece06bb7049cd90fc0f087048771270bb51092b03b972feb904
Opcode Fuzzy Hash: bd734b416b9f0b129252559e8ebac4dc441db0c49c041c62ae61a73b70f31fff
Instruction Fuzzy Hash: 4781B0711082059FEB08DF14C885FAA7BE8FF55314F04856AFD89CA496EB34DD89CB62

Function 008DA1B9 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008DA259
DestroyWindow.USER32(?,?), ref: 008DA2D3

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 008DA34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 008DA36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 008DA382
DestroyWindow.USER32(00000000), ref: 008DA3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00850000,00000000), ref: 008DA3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 008DA3F4
GetDesktopWindow.USER32 ref: 008DA40D
GetWindowRect.USER32(00000000), ref: 008DA414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 008DA42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 008DA444

Part of subcall function 008525DB: GetWindowLongW.USER32(?,000000EB), ref: 008525EC

Strings

0, xrefs: 008DA26F
tooltips_class32, xrefs: 008DA346, 008DA3D4
V, xrefs: 008DA1F4, 008DA2B7, 008DA2D9, 008DA2EC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32$V
API String ID: 1297703922-3097446078
Opcode ID: 5091d2e7d9a7803bbed8268a1f2689b89d718d4f6b1b3d91dd9ffb58d2d6893d
Instruction ID: e9fc3b0d9d6b0d058604e49f50539dcaed997716f4aa56a83a31b79f95af5b52
Opcode Fuzzy Hash: 5091d2e7d9a7803bbed8268a1f2689b89d718d4f6b1b3d91dd9ffb58d2d6893d
Instruction Fuzzy Hash: 0B717A70240205AFD729CF18C849FA67BE6FB88704F15461EF985C73A1DBB0E906DB56

Function 008DC5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

DragQueryPoint.SHELL32(?,?), ref: 008DC627

Part of subcall function 008DAB37: ClientToScreen.USER32(?,?), ref: 008DAB60
Part of subcall function 008DAB37: GetWindowRect.USER32(?,?), ref: 008DABD6
Part of subcall function 008DAB37: PtInRect.USER32(?,?,008DC014), ref: 008DABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 008DC690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 008DC69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 008DC6BE
_wcscat.LIBCMT ref: 008DC6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 008DC705
SendMessageW.USER32(?,000000B0,?,?), ref: 008DC71E
SendMessageW.USER32(?,000000B1,?,?), ref: 008DC735
SendMessageW.USER32(?,000000B1,?,?), ref: 008DC757
DragFinish.SHELL32(?), ref: 008DC75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 008DC851

Strings

@GUI_DROPID, xrefs: 008DC77E
@GUI_DRAGFILE, xrefs: 008DC800
@GUI_DRAGID, xrefs: 008DC7C9
V, xrefs: 008DC65D, 008DC6CA

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$V
API String ID: 169749273-1508676730
Opcode ID: 20f55779068f1b57abcf2fccf7d7f59949cb844f8063dd81697d06f25ad2806a
Instruction ID: d21c61ce37a0b7b47c2038731285b5f756fe547a3a071b12f3a4d35f6caa7471
Opcode Fuzzy Hash: 20f55779068f1b57abcf2fccf7d7f59949cb844f8063dd81697d06f25ad2806a
Instruction Fuzzy Hash: 50616C71508301AFC701DF68D885D9BBBE9FF98310F004A2EF595D62A1DB309A49CB52

Function 008AABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 008AAC33

Strings

[CLASS:, xrefs: 008AAC83
[HANDLE:, xrefs: 008AAC3F
[REGEXPTITLE:, xrefs: 008AAC5B
HANDLE=, xrefs: 008AAC2C
CLASSNAME=, xrefs: 008AAC70
ACTIVE, xrefs: 008AAC0E
[LAST, xrefs: 008AACE0
REGEXP=, xrefs: 008AAC48
[ALL, xrefs: 008AACD9
ALL, xrefs: 008AACC7
LAST, xrefs: 008AABF8
[ACTIVE, xrefs: 008AAC20

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 398c83c86423ee4465a198ec585ec8934fdb6c4def73e8a984ff6bde810aa017
Instruction ID: 8e3a38815684441f2a6d95d963a9201cb560e182da44fa220d7c7d1f541e84f6
Opcode Fuzzy Hash: 398c83c86423ee4465a198ec585ec8934fdb6c4def73e8a984ff6bde810aa017
Instruction Fuzzy Hash: 9D31A631A48209AAEA18FA98DD03EAEB768FF11775F604429F806F18D5EF516F08C553

Function 008C4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 008C5013
LoadCursorW.USER32(00000000,00007F00), ref: 008C501E
LoadCursorW.USER32(00000000,00007F03), ref: 008C5029
LoadCursorW.USER32(00000000,00007F8B), ref: 008C5034
LoadCursorW.USER32(00000000,00007F01), ref: 008C503F
LoadCursorW.USER32(00000000,00007F81), ref: 008C504A
LoadCursorW.USER32(00000000,00007F88), ref: 008C5055
LoadCursorW.USER32(00000000,00007F80), ref: 008C5060
LoadCursorW.USER32(00000000,00007F86), ref: 008C506B
LoadCursorW.USER32(00000000,00007F83), ref: 008C5076
LoadCursorW.USER32(00000000,00007F85), ref: 008C5081
LoadCursorW.USER32(00000000,00007F82), ref: 008C508C
LoadCursorW.USER32(00000000,00007F84), ref: 008C5097
LoadCursorW.USER32(00000000,00007F04), ref: 008C50A2
LoadCursorW.USER32(00000000,00007F02), ref: 008C50AD
LoadCursorW.USER32(00000000,00007F89), ref: 008C50B8
GetCursorInfo.USER32(?), ref: 008C50C8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: a2700fad3bfe2693a644989bba5ba15a8b8d0830fff979214aa3a5a29f71878c
Instruction ID: ad56fe376ce7ab35eef53d9e2e0c4ae7b2a35da8a6307c604d65ecbd3df68168
Opcode Fuzzy Hash: a2700fad3bfe2693a644989bba5ba15a8b8d0830fff979214aa3a5a29f71878c
Instruction Fuzzy Hash: 353101B1D48319AADF109FB68C89DAFBFF8FB04750F50453AA54DE7280DA78A5408E91

Function 008D4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008D4424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 008D446F

Strings

GETITEMCOUNT, xrefs: 008D4551
ISCHECKED, xrefs: 008D45F2
COLLAPSE, xrefs: 008D44B5
CHECK, xrefs: 008D448F
SELECT, xrefs: 008D4620
UNCHECK, xrefs: 008D464B
EXPAND, xrefs: 008D4521
GETSELECTED, xrefs: 008D457F
GETTEXT, xrefs: 008D45C2
EXISTS, xrefs: 008D44D8
GETTOTALCOUNT, xrefs: 008D4456

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: c7616bcd450e3be337f34e4289d4c43a7f309263a470f541e604daa9b2652848
Instruction ID: 6c1ce33407f8596537172fa2f6a30cf2c947f0baad2cdb642297f3cbb2e81789
Opcode Fuzzy Hash: c7616bcd450e3be337f34e4289d4c43a7f309263a470f541e604daa9b2652848
Instruction Fuzzy Hash: CB917D702047119FDB04EF18C852A6EB7E1FF95754F048969F8969B7A2CB30ED49CB82

Function 008DC1AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 008DC1FC
GetFocus.USER32 ref: 008DC20C
GetDlgCtrlID.USER32(00000000), ref: 008DC217
_memset.LIBCMT ref: 008DC342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 008DC36D
GetMenuItemCount.USER32(?), ref: 008DC38D
GetMenuItemID.USER32(?,00000000), ref: 008DC3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 008DC3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 008DC41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 008DC454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 008DC489

Strings

0, xrefs: 008DC33A
V, xrefs: 008DC2F2, 008DC318

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0$V
API String ID: 1296962147-3648174478
Opcode ID: b24188159ca2d4f0ebd849f0995804d0f78afe0b861ba8accc95690c6c058a3c
Instruction ID: c42a8a01ad93ba9011d73e89e72e22d398775f95b3b60969d7ecca849aab3e3b
Opcode Fuzzy Hash: b24188159ca2d4f0ebd849f0995804d0f78afe0b861ba8accc95690c6c058a3c
Instruction Fuzzy Hash: 45817B702093029FD714DF18D894AAABBE9FF88714F004A2EFA95D7391D730D905DB92

Function 008DB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 008DB8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,008D91C2), ref: 008DB910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 008DB949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 008DB98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 008DB9C3
FreeLibrary.KERNEL32(?), ref: 008DB9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 008DB9DF
DestroyIcon.USER32(?,?,?,?,?,008D91C2), ref: 008DB9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 008DBA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 008DBA17

Part of subcall function 00872EFD: __wcsicmp_l.LIBCMT ref: 00872F86

Strings

.dll, xrefs: 008DB86D
.icl, xrefs: 008DB82A
.exe, xrefs: 008DB84A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 178407533eb770e80a3bff4c5965ee3cff702da8ac79faabb3f07d4c42079a77
Instruction ID: 60a1d14a440d398535f6b6803706aef4186294f35a2c631c46fa0bb5eef1eba2
Opcode Fuzzy Hash: 178407533eb770e80a3bff4c5965ee3cff702da8ac79faabb3f07d4c42079a77
Instruction Fuzzy Hash: 8661C071900259FAEB14DF64CC41FBE7BA8FB08721F108616FA15D62D1EB749990EBA0

Function 008BDC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 008BDCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 008BDCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 008BDCF8
__wsplitpath.LIBCMT ref: 008BDD56
_wcscat.LIBCMT ref: 008BDD6E
_wcscat.LIBCMT ref: 008BDD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 008BDD95
SetCurrentDirectoryW.KERNEL32(?), ref: 008BDDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 008BDDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 008BDDFC
_wcscpy.LIBCMT ref: 008BDE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 008BDE47

Strings

*.*, xrefs: 008BDE02

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: dba28180bdab9eb6b003fd2cc5297b04ab8603f39ee4e5703ae0e14c643c559a
Instruction ID: eef279c3cfbcdf29ca65ec917ad006225bc88e1b7abe1f857622a82a9b105e71
Opcode Fuzzy Hash: dba28180bdab9eb6b003fd2cc5297b04ab8603f39ee4e5703ae0e14c643c559a
Instruction Fuzzy Hash: 06615A72504305AFCB10EF24C8549AEB7E8FF89314F04892EE989C7351EB35E945CB92

Function 0085201B Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00851B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00852036,?,00000000,?,?,?,?,008516CB,00000000,?), ref: 00851B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 008520D3
KillTimer.USER32(-00000001,?,?,?,?,008516CB,00000000,?,?,00851AE2,?,?), ref: 0085216E
DestroyAcceleratorTable.USER32(00000000), ref: 0088BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,008516CB,00000000,?,?,00851AE2,?,?), ref: 0088BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,008516CB,00000000,?,?,00851AE2,?,?), ref: 0088BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,008516CB,00000000,?,?,00851AE2,?,?), ref: 0088BD0A
DeleteObject.GDI32(00000000), ref: 0088BD1C

Strings

V, xrefs: 00852054

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: V
API String ID: 641708696-4045069856
Opcode ID: dd897bc60063296ca7be10f31d4b43f70f90c7c8d1dd516aec7be17445258b38
Instruction ID: 10a2aed4ec40ffb0aff25b39e3b3299fc1239918e632a62420f222a981619d0a
Opcode Fuzzy Hash: dd897bc60063296ca7be10f31d4b43f70f90c7c8d1dd516aec7be17445258b38
Instruction Fuzzy Hash: EF619D31215E04DFCB35AF18D948B6AB7F2FF81316F118569E942CB9A1CB70A885EB41

Function 008BA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

CharLowerBuffW.USER32(?,?), ref: 008BA3CB
GetDriveTypeW.KERNEL32 ref: 008BA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008BA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008BA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008BA4C5

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

Strings

open , xrefs: 008BA427
set cd door , xrefs: 008BA466
closed, xrefs: 008BA3DF, 008BA3E8
type cdaudio alias cd wait, xrefs: 008BA443
open, xrefs: 008BA3F2
wait, xrefs: 008BA482
close cd wait, xrefs: 008BA4B0
close, xrefs: 008BA3D1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 6180739115ac2cc9c93a95d09bd5625c76e4897614bb9bd20d625eea3a44bd1d
Instruction ID: cca259b382749b503b84732c85ae18f324f3234657e7dd2ca5f4cdde510e3522
Opcode Fuzzy Hash: 6180739115ac2cc9c93a95d09bd5625c76e4897614bb9bd20d625eea3a44bd1d
Instruction Fuzzy Hash: C55128716043059FC704EF14D89186AB7E8FF98719F10896DF89A972A1DB31ED09CB52

Function 008AF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0088E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 008AF8DF
LoadStringW.USER32(00000000,?,0088E029,00000001), ref: 008AF8E8

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

GetModuleHandleW.KERNEL32(00000000,00915310,?,00000FFF,?,?,0088E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 008AF90A
LoadStringW.USER32(00000000,?,0088E029,00000001), ref: 008AF90D
__swprintf.LIBCMT ref: 008AF95D
__swprintf.LIBCMT ref: 008AF96E
_wprintf.LIBCMT ref: 008AFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008AFA2E

Strings

%s (%d) : ==> %s: %s %s, xrefs: 008AFA12
Line %d:, xrefs: 008AF968
^ ERROR, xrefs: 008AF9C3
Line %d (File "%s"):, xrefs: 008AF957
Error: , xrefs: 008AF9E5

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 9d1fe0eff581445a30c2701f26c9140ede4ff594217063aaa3950220decc3268
Instruction ID: 51c4d6825be6bdf7c46df4ee52683c060c372b56d37349df97971b85245351cb
Opcode Fuzzy Hash: 9d1fe0eff581445a30c2701f26c9140ede4ff594217063aaa3950220decc3268
Instruction Fuzzy Hash: B2414D72904119AACF04FBE8ED86DEE7778FF15301F504065BA05F60A2EA356F09CA62

Function 008521A5 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 008525DB: GetWindowLongW.USER32(?,000000EB), ref: 008525EC

GetSysColor.USER32(0000000F), ref: 008521D3

Strings

V, xrefs: 008521ED

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ColorLongWindow
String ID: V
API String ID: 259745315-4045069856
Opcode ID: 6eea769ccc0089a2dad0477c5e5e9212baad5cd79d512d370c17990180570dbc
Instruction ID: ee345a4896cf18c0b401ded546b06dcb7e22b242a40b15d143d066cb85b7c6b1
Opcode Fuzzy Hash: 6eea769ccc0089a2dad0477c5e5e9212baad5cd79d512d370c17990180570dbc
Instruction Fuzzy Hash: 60419E35101540DEDF215F28EC88BB97B65FB46322F1843A6FE66CA1E2CB318C46DB21

Function 008DBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,008D9207,?,?), ref: 008DBA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,008D9207,?,?,00000000,?), ref: 008DBA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,008D9207,?,?,00000000,?), ref: 008DBA78
CloseHandle.KERNEL32(00000000,?,?,?,?,008D9207,?,?,00000000,?), ref: 008DBA85
GlobalLock.KERNEL32(00000000), ref: 008DBA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,008D9207,?,?,00000000,?), ref: 008DBA9D
GlobalUnlock.KERNEL32(00000000), ref: 008DBAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,008D9207,?,?,00000000,?), ref: 008DBAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,008D9207,?,?,00000000,?), ref: 008DBABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,008E2CAC,?), ref: 008DBAD7
GlobalFree.KERNEL32(00000000), ref: 008DBAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 008DBB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 008DBB36
DeleteObject.GDI32(00000000), ref: 008DBB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 008DBB74

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 3f094d11c76ab38579e9d6bd5b8b1133957670dedda7c2e30a82f9648a56f3da
Instruction ID: cd43a3cfc88b63a7fd2cf4437b8ac8467c73825e9c50ed5fc6504cd931e5a6c8
Opcode Fuzzy Hash: 3f094d11c76ab38579e9d6bd5b8b1133957670dedda7c2e30a82f9648a56f3da
Instruction Fuzzy Hash: F0414C75501208EFDB119F65DC48EAA7BB8FF89721F11426AFA06D7261D7309E01DB20

Function 008BD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 008BDA10
_wcscat.LIBCMT ref: 008BDA28
_wcscat.LIBCMT ref: 008BDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 008BDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 008BDA63
GetFileAttributesW.KERNEL32(?), ref: 008BDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 008BDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 008BDAA7

Strings

*.*, xrefs: 008BDAE6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 335c520ff32db23702861c1e3f37e911e0f02ccaff46da793c8e37ae5b7e33e6
Instruction ID: 8c2bd50a81925135e20c3f481f2cd96d6058d7d9b793ed0b9d65c50309e2fceb
Opcode Fuzzy Hash: 335c520ff32db23702861c1e3f37e911e0f02ccaff46da793c8e37ae5b7e33e6
Instruction Fuzzy Hash: DC818171504345AFCB24EF68C8449AABBE4FF89354F18892EF889CB351E734D945CB52

Function 008D6F23 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 008D6FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 008D6FA8
GetWindowLongW.USER32(?,000000F0), ref: 008D6FCC
_memset.LIBCMT ref: 008D6FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 008D6FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 008D7067

Strings

V, xrefs: 008D6F6F, 008D6F7E, 008D6FB4, 008D7006, 008D712F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID: V
API String ID: 830647256-4045069856
Opcode ID: 61e333a89df74d69fdbab0efc1b5698798a6a11c1c540e0d5e3bd73938cf2c34
Instruction ID: 10e4736f8d11b50d06cb0cddb4026a7555bc18e91949f73598e869b0213635c1
Opcode Fuzzy Hash: 61e333a89df74d69fdbab0efc1b5698798a6a11c1c540e0d5e3bd73938cf2c34
Instruction Fuzzy Hash: 19614871A00208AFDB11DFA8CC81EEE77B8FB49714F10429AFA15EB3A1D771A941DB50

Function 008C731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008C738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 008C739B
CreateCompatibleDC.GDI32(?), ref: 008C73A7
SelectObject.GDI32(00000000,?), ref: 008C73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 008C7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 008C7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 008C7468
SelectObject.GDI32(00000006,?), ref: 008C7470
DeleteObject.GDI32(?), ref: 008C7479
DeleteDC.GDI32(00000006), ref: 008C7480
ReleaseDC.USER32(00000000,?), ref: 008C748B

Strings

(, xrefs: 008C7410

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: bf2127df40e9107724916337a2fdc7ee73e11361db4e8f5082b50734fdc207ac
Instruction ID: a5b7fa6a5b80b9d651a4f5d4f6269bc90fd14a5a35c5c5349e262646d4b88033
Opcode Fuzzy Hash: bf2127df40e9107724916337a2fdc7ee73e11361db4e8f5082b50734fdc207ac
Instruction Fuzzy Hash: 11512575904249EFCB15CFA8DC85EAEBBB9FF48310F14852EEA5AD7211C731A9409F50

Function 00856A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00870957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00856B0C,?,00008000), ref: 00870973

Part of subcall function 00854750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00854743,?,?,008537AE,?), ref: 00854770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00856BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00856CFA

Part of subcall function 0085586D: _wcscpy.LIBCMT ref: 008558A5

Part of subcall function 0087363D: _iswctype.LIBCMT ref: 00873645

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 0088E421
EA06, xrefs: 0088E452
AU3!, xrefs: 00856B61
>>>AUTOIT SCRIPT<<<, xrefs: 0088E496
Bad directive syntax error, xrefs: 0088E79D
Error opening the file, xrefs: 0088E43D, 0088E4B8
Unterminated string, xrefs: 0088E7E4

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: ccab216574d95725318c142cc8038cda6a51bb9e6dbc90c130423a3641f969df
Instruction ID: 23af2833413dddd6684c4f5816518c1b76f42a99e36dbf4239ab2050cc6c2f9b
Opcode Fuzzy Hash: ccab216574d95725318c142cc8038cda6a51bb9e6dbc90c130423a3641f969df
Instruction Fuzzy Hash: 4E0258311083409FC724EF28C8919AEBBE5FF95315F50492DF89AD72A2EA30D949CB53

Function 008B2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008B2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 008B2DDD
GetMenuItemCount.USER32(00915890), ref: 008B2E66
DeleteMenu.USER32(00915890,00000005,00000000,000000F5,?,?), ref: 008B2EF6
DeleteMenu.USER32(00915890,00000004,00000000), ref: 008B2EFE
DeleteMenu.USER32(00915890,00000006,00000000), ref: 008B2F06
DeleteMenu.USER32(00915890,00000003,00000000), ref: 008B2F0E
GetMenuItemCount.USER32(00915890), ref: 008B2F16
SetMenuItemInfoW.USER32(00915890,00000004,00000000,00000030), ref: 008B2F4C
GetCursorPos.USER32(?), ref: 008B2F56
SetForegroundWindow.USER32(00000000), ref: 008B2F5F
TrackPopupMenuEx.USER32(00915890,00000000,?,00000000,00000000,00000000), ref: 008B2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 008B2F7E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 8f91e3446e5eb8946b1aaafc7c5985662654baaf297e0b3ae89ad43cffc94363
Instruction ID: eebafb17bdfcffb812f2dfd6728c1fc957c0662e2bae75ebfadab032cbcbf7c9
Opcode Fuzzy Hash: 8f91e3446e5eb8946b1aaafc7c5985662654baaf297e0b3ae89ad43cffc94363
Instruction Fuzzy Hash: B071C370601209BBEB219F59DC45FEABF64FF04764F144216F625EA3E2C771A820DB91

Function 008A77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

_memset.LIBCMT ref: 008A786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008A78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008A78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008A78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 008A7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 008A792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 008A7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 008A793A

Strings

\IPC$, xrefs: 008A7882
SOFTWARE\Classes\, xrefs: 008A780C
\CLSID, xrefs: 008A7822

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: a4dca302eff7dbb97952e75590c27e702cd8cd929ede4a785f18ede01f2ed379
Instruction ID: fdb81e43c7f7b7edcf9e6c68e4f38393a899e757786a239e328df563649f2d99
Opcode Fuzzy Hash: a4dca302eff7dbb97952e75590c27e702cd8cd929ede4a785f18ede01f2ed379
Instruction Fuzzy Hash: 64411972C1462DAADB11EBA8EC45DEEB7B8FF04351F44812AE905E31A1DB345E08DB91

Function 008D0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,008CFDAD,?,?), ref: 008D0E31

Strings

HKCC, xrefs: 008D0EFF
HKEY_CURRENT_CONFIG, xrefs: 008D0EEE
HKEY_CURRENT_USER, xrefs: 008D0F10
HKU, xrefs: 008D0F43
HKEY_CLASSES_ROOT, xrefs: 008D0EC4
HKEY_LOCAL_MACHINE, xrefs: 008D0E9A
HKLM, xrefs: 008D0EAF
HKCU, xrefs: 008D0F21
HKCR, xrefs: 008D0ED9
HKEY_USERS, xrefs: 008D0F32

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: dfcb6f8d827c9437efdb1c461627afde8fc99caf18baf4c8b9a3cd85cf48c59d
Instruction ID: e5c1e4fb2e4e1c7cb40e544cac10d211ab80d282f92fe0d7b02d84ef177bc446
Opcode Fuzzy Hash: dfcb6f8d827c9437efdb1c461627afde8fc99caf18baf4c8b9a3cd85cf48c59d
Instruction Fuzzy Hash: 0B41667150031A8BCF20EF14E862AEE37A0FF11714F648516FC559B2A6DB30991ACBA1

Function 008D7152 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008D716A
CreateMenu.USER32 ref: 008D7185
SetMenu.USER32(?,00000000), ref: 008D7194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008D7221
IsMenu.USER32(?), ref: 008D7237
CreatePopupMenu.USER32 ref: 008D7241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 008D726E
DrawMenuBar.USER32 ref: 008D7276

Strings

0, xrefs: 008D7160
F, xrefs: 008D7262
V, xrefs: 008D71E0, 008D71FD

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F$V
API String ID: 176399719-3113831973
Opcode ID: 6bad4e0333ac862c3b12a662b8088385d6d5505cd4c6f1159a17eb6bd733694b
Instruction ID: 4f8d15fa238080b318864090bc2946b9177e819c9c180ce70ce8712d33107c15
Opcode Fuzzy Hash: 6bad4e0333ac862c3b12a662b8088385d6d5505cd4c6f1159a17eb6bd733694b
Instruction Fuzzy Hash: BB415874A01209EFDB20DF64E884E9A7BB5FF49310F15422AFA06E7361E731A910DF90

Function 008AF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0088E2A0,00000010,?,Bad directive syntax error,008DF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 008AF7C2
LoadStringW.USER32(00000000,?,0088E2A0,00000010), ref: 008AF7C9

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

_wprintf.LIBCMT ref: 008AF7FC
__swprintf.LIBCMT ref: 008AF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 008AF88D

Strings

Line %d:, xrefs: 008AF818
%s (%d) : ==> %s.: %s %s, xrefs: 008AF7F7
Error: , xrefs: 008AF85B
Line %d (File "%s"):, xrefs: 008AF833
., xrefs: 008AF873

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 45ee981c1907a8e65b07ce081017b65fbf6e17bdcb6c9843aa1901beb8a53f12
Instruction ID: 54489e93afbc301ec9813c755f6bb0cc3003619d38de2a2018982e599ce4bc7f
Opcode Fuzzy Hash: 45ee981c1907a8e65b07ce081017b65fbf6e17bdcb6c9843aa1901beb8a53f12
Instruction Fuzzy Hash: 90218E31900219AFCF11AF94DC4AEEE7738FF28305F044466F915A60A2DA319A18DB52

Function 008B52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

Part of subcall function 00857924: _memmove.LIBCMT ref: 008579AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 008B5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 008B5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008B5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 008B5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 008B537A

Strings

open , xrefs: 008B52DF
play PlayMe, xrefs: 008B5375
status PlayMe mode, xrefs: 008B532B
alias PlayMe, xrefs: 008B5309
play PlayMe wait, xrefs: 008B5364
close PlayMe, xrefs: 008B5341, 008B536E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 2b9b23a5bdb561d0a174b0a725f6c9bce12d192054ab7692d1814308e3440763
Instruction ID: a2621a7a09254012c206e81e7a85ae9f8c4ad9eb9efed4e53dfe673f41265661
Opcode Fuzzy Hash: 2b9b23a5bdb561d0a174b0a725f6c9bce12d192054ab7692d1814308e3440763
Instruction Fuzzy Hash: A2116061A501697DD720B665DC4ADFFAFBCFBD6B49F400429B851E22D1DEA00D08C5A1

Function 008B46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 008B46D2
gethostname.WSOCK32(?,00000100), ref: 008B46EC
gethostbyname.WSOCK32(?), ref: 008B46F9
_wcscpy.LIBCMT ref: 008B4721
_memmove.LIBCMT ref: 008B4734
inet_ntoa.WSOCK32(?), ref: 008B473F
_strcat.LIBCMT ref: 008B474D
_wcscpy.LIBCMT ref: 008B4764
WSACleanup.WSOCK32 ref: 008B4772
_wcscpy.LIBCMT ref: 008B4780

Strings

0.0.0.0, xrefs: 008B471B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 6fb82aeeac91d7f8171b5a5c17f2786cf214a0aed1d9b2b4b3c8ecf5c69c8854
Instruction ID: a74406f9f4f3abbd37e1d1aaca6f5b7c487b1f1084eb18c87e89b8295b3caca0
Opcode Fuzzy Hash: 6fb82aeeac91d7f8171b5a5c17f2786cf214a0aed1d9b2b4b3c8ecf5c69c8854
Instruction Fuzzy Hash: D511D831500118AFCB20AB349C46EEA7BBCFB01715F044276F54AD6293EF71C981DA56

Function 008B4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 008B4F7A

Part of subcall function 0087049F: timeGetTime.WINMM(?,7608B400,00860E7B), ref: 008704A3

Sleep.KERNEL32(0000000A), ref: 008B4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 008B4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 008B4FEC
SetActiveWindow.USER32 ref: 008B500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 008B5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 008B5038
Sleep.KERNEL32(000000FA), ref: 008B5043
IsWindow.USER32 ref: 008B504F
EndDialog.USER32(00000000), ref: 008B5060

Strings

BUTTON, xrefs: 008B4FDE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: cb0131455d41b0a9e5e3ca275e9f38ed40d2447b9be6914520b139237ddcaa50
Instruction ID: e402ab5f7482719382e2d4590e06a325f7dbd5b3c985c8e89f27cd3573589fd9
Opcode Fuzzy Hash: cb0131455d41b0a9e5e3ca275e9f38ed40d2447b9be6914520b139237ddcaa50
Instruction Fuzzy Hash: 56219F7070AA05AFE7106F60EC89BA63B6AFB55745B049125F203C23B2DB718D01FA62

Function 008BD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

CoInitialize.OLE32(00000000), ref: 008BD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 008BD67D
SHGetDesktopFolder.SHELL32(?), ref: 008BD691
CoCreateInstance.OLE32(008E2D7C,00000000,00000001,00908C1C,?), ref: 008BD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 008BD74C
CoTaskMemFree.OLE32(?,?), ref: 008BD7A4
_memset.LIBCMT ref: 008BD7E1
SHBrowseForFolderW.SHELL32(?), ref: 008BD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 008BD840
CoTaskMemFree.OLE32(00000000), ref: 008BD847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 008BD87E
CoUninitialize.OLE32(00000001,00000000), ref: 008BD880

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 477c0545015457be2aafe038916ab25e8107c7b9f77678272036bc74ead850a1
Instruction ID: 89094b50f20956650b8312be123969136b514e8b57eb6b9e1fa36fea0619ee35
Opcode Fuzzy Hash: 477c0545015457be2aafe038916ab25e8107c7b9f77678272036bc74ead850a1
Instruction Fuzzy Hash: 98B1FA75A00209EFDB04DFA8C884DAEBBB9FF49314B148469E90ADB361DB30ED45CB55

Function 008AC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 008AC283
GetWindowRect.USER32(00000000,?), ref: 008AC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 008AC2F3
GetDlgItem.USER32(?,00000002), ref: 008AC2FE
GetWindowRect.USER32(00000000,?), ref: 008AC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 008AC364
GetDlgItem.USER32(?,000003E9), ref: 008AC372
GetWindowRect.USER32(00000000,?), ref: 008AC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 008AC3C6
GetDlgItem.USER32(?,000003EA), ref: 008AC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 008AC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 008AC3FE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 8165bf106e78cf99d4a7b117b77f7791d7ec8923c9b978df1a89a66ec9d317f5
Instruction ID: 081544c0185a6bfb02c3bb5ade156e95c759f76173cb0c2c712acede2379d5c0
Opcode Fuzzy Hash: 8165bf106e78cf99d4a7b117b77f7791d7ec8923c9b978df1a89a66ec9d317f5
Instruction Fuzzy Hash: 45514071B00205AFDF18CFA9DD89AAEBBB6FB98310F14822DF616D7691D7709D008B10

Function 008BA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,008DF910), ref: 008BA90B
GetDriveTypeW.KERNEL32(00000061,009089A0,00000061), ref: 008BA9D5
_wcscpy.LIBCMT ref: 008BA9FF

Strings

fixed, xrefs: 008BA953
network, xrefs: 008BA969
unknown, xrefs: 008BA996
all, xrefs: 008BA911
ramdisk, xrefs: 008BA97F
removable, xrefs: 008BA93D
cdrom, xrefs: 008BA927

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: d86560506a4e6b9dff24365c4515ab3a90bbbe2f6c17314de91eb6d0d1bbd41a
Instruction ID: 58c9da12cf8d9bdfba2e07c8863b8e5a059a6ce8465be96f6e4880c435e110c0
Opcode Fuzzy Hash: d86560506a4e6b9dff24365c4515ab3a90bbbe2f6c17314de91eb6d0d1bbd41a
Instruction Fuzzy Hash: 84517B315083119FC314EF18C892AAFBBA5FF84704F544829F9A6D72A2DB31D909CA53

Function 008D8645 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 008D86FF

Strings

V, xrefs: 008D8681

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: InvalidateRect
String ID: V
API String ID: 634782764-4045069856
Opcode ID: 25555398c3e452141a9d8e6e787762dc90e855f292fe8e0db2a31a5c3d587437
Instruction ID: 90561f6d5c6d2c938351b783424dc6d63184c61a72b5b1c15395de86c2c2ff57
Opcode Fuzzy Hash: 25555398c3e452141a9d8e6e787762dc90e855f292fe8e0db2a31a5c3d587437
Instruction Fuzzy Hash: 17515F30600244EEDB209B289C89FAD7B65FB15764F604367FA51E63A1CF71E980DA51

Function 00859837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00859862
__swprintf.LIBCMT ref: 008598AC
__i64tow.LIBCMT ref: 0088F5E6

Strings

False, xrefs: 0088F5AE
0x%p, xrefs: 0088F5C8
%.15g, xrefs: 008598A6
True, xrefs: 0088F5A7

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 08caec5d0675d5fc13d4ed383980738071b078bbc128e0c738f3ab66f9634913
Instruction ID: 7fd31431293278edc634a2dde00a9d13a213cb142d884011492cbdefa0666e50
Opcode Fuzzy Hash: 08caec5d0675d5fc13d4ed383980738071b078bbc128e0c738f3ab66f9634913
Instruction Fuzzy Hash: 7E41E771600209EFDB24EF78D841A7A77E8FF45304F24847EE989D7296EA31D9458B11

Function 008D74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 008D755E
CreateCompatibleDC.GDI32(00000000), ref: 008D7565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 008D7578
SelectObject.GDI32(00000000,00000000), ref: 008D7580
GetPixel.GDI32(00000000,00000000,00000000), ref: 008D758B
DeleteDC.GDI32(00000000), ref: 008D7594
GetWindowLongW.USER32(?,000000EC), ref: 008D759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 008D75B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 008D75BE

Strings

static, xrefs: 008D74F6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 6cacabb72d784911144957f15c0684b6536948cda4854ddd43aeddb1840594f9
Instruction ID: 3082ae3d0e2b8490977ab606a9c8c674ef2e14b03407f88714117b9f9ad373ad
Opcode Fuzzy Hash: 6cacabb72d784911144957f15c0684b6536948cda4854ddd43aeddb1840594f9
Instruction Fuzzy Hash: 07315832105214ABDF129F64EC09FDA3B79FF09361F114326FA16E62A1D731D821EBA5

Function 00876E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00876E3E

Part of subcall function 00878B28: __getptd_noexit.LIBCMT ref: 00878B28

__gmtime64_s.LIBCMT ref: 00876ED7
__gmtime64_s.LIBCMT ref: 00876F0D
__gmtime64_s.LIBCMT ref: 00876F2A
__allrem.LIBCMT ref: 00876F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00876F9C
__allrem.LIBCMT ref: 00876FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00876FD1
__allrem.LIBCMT ref: 00876FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00877006
__invoke_watson.LIBCMT ref: 00877077

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: a8f051cc79a93378407dba7c1c86705d1f96d8972a59b9dae10ca6fd877b1736
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: C871E376A00F17ABD714AA6CDC41B5AB7A8FF04724F14C229F418E6285FB70DE508791

Function 008B2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008B2542
GetMenuItemInfoW.USER32(00915890,000000FF,00000000,00000030), ref: 008B25A3
SetMenuItemInfoW.USER32(00915890,00000004,00000000,00000030), ref: 008B25D9
Sleep.KERNEL32(000001F4), ref: 008B25EB
GetMenuItemCount.USER32(?), ref: 008B262F
GetMenuItemID.USER32(?,00000000), ref: 008B264B
GetMenuItemID.USER32(?,-00000001), ref: 008B2675
GetMenuItemID.USER32(?,?), ref: 008B26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 008B2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008B2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008B2735

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 1c87184a6ee75f061eaf28a4153ee28ecc18d4dad62e67f15ca512f425167ec2
Instruction ID: 629e7fe99b2ecfb645d0e69c18aab6e8f20c24271b51e2ee47b2d02686e874f2
Opcode Fuzzy Hash: 1c87184a6ee75f061eaf28a4153ee28ecc18d4dad62e67f15ca512f425167ec2
Instruction Fuzzy Hash: 0F61AD7090024AAFDB21DFA8DC88DEE7BB8FB46308F144559E852E3361DB31AD05DB21

Function 008A6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 008A6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 008A6C18
VariantInit.OLEAUT32(?), ref: 008A6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 008A6C4A
VariantCopy.OLEAUT32(?,?), ref: 008A6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 008A6CB1
VariantClear.OLEAUT32(?), ref: 008A6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 008A6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 008A6CDC
VariantClear.OLEAUT32(?), ref: 008A6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 008A6CF9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6e73a8dedb753ee41e1fd10b29da803be7366c8738d39f4138aa64381fd8434f
Instruction ID: 70c2d9c9c193fe4d786e8ea7cb8bb084ffa3212e06dbe8949c8c32c92e35df2f
Opcode Fuzzy Hash: 6e73a8dedb753ee41e1fd10b29da803be7366c8738d39f4138aa64381fd8434f
Instruction Fuzzy Hash: 27419231A00219EFDF00DF68C8449AEBBB9FF08350F048179E956E7261DB30A945CFA0

Function 008DD43E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

GetSystemMetrics.USER32(0000000F), ref: 008DD47C
GetSystemMetrics.USER32(0000000F), ref: 008DD49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 008DD6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 008DD6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 008DD716
ShowWindow.USER32(00000003,00000000), ref: 008DD735
InvalidateRect.USER32(?,00000000,00000001), ref: 008DD75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 008DD77D

Strings

V, xrefs: 008DD4E9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID: V
API String ID: 1211466189-4045069856
Opcode ID: 598bfe0eb4a49b31a967a6cf9adf10355e4e0e34669aa91e716c6643222eeb2d
Instruction ID: 1608353c2bdf523599218c4b519e8735bce35018000df0e486167e6cfb0884a8
Opcode Fuzzy Hash: 598bfe0eb4a49b31a967a6cf9adf10355e4e0e34669aa91e716c6643222eeb2d
Instruction Fuzzy Hash: 7EB18871600229EFDF14CF68C985BAD7BB1FF04711F09C2AAED49DA295D734A950CB90

Function 008C83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

CoInitialize.OLE32 ref: 008C8403
CoUninitialize.OLE32 ref: 008C840E
CoCreateInstance.OLE32(?,00000000,00000017,008E2BEC,?), ref: 008C846E
IIDFromString.OLE32(?,?), ref: 008C84E1
VariantInit.OLEAUT32(?), ref: 008C857B
VariantClear.OLEAUT32(?), ref: 008C85DC

Strings

Invalid parameter, xrefs: 008C84FA
Failed to create object, xrefs: 008C8479, 008C852F
NULL Pointer assignment, xrefs: 008C84B3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 08915c807cdc52e228ee35e9610fab66b60dc628e50870c4dc30547b5c363ad1
Instruction ID: 0e599cedbffd3f6d57dbce253f6324a22a7511dd496bf87e58a090b86e3b4c71
Opcode Fuzzy Hash: 08915c807cdc52e228ee35e9610fab66b60dc628e50870c4dc30547b5c363ad1
Instruction Fuzzy Hash: 90614570648212DFC714DB24C848F6ABBE8FF89758F04451DF986DB291CB70E948CB96

Function 008C5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 008C5793
inet_addr.WSOCK32(?,?,?), ref: 008C57D8
gethostbyname.WSOCK32(?), ref: 008C57E4
IcmpCreateFile.IPHLPAPI ref: 008C57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 008C5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 008C5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 008C58ED
WSACleanup.WSOCK32 ref: 008C58F3

Strings

Ping, xrefs: 008C5816

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: b5c97edb8adfdf269c51a676a72e3cb1d577dbc5fd645e429126748681ef9997
Instruction ID: b58e95c144f124e8cd3e0633e45d2a20e915937d861778210618bae3ccb3633f
Opcode Fuzzy Hash: b5c97edb8adfdf269c51a676a72e3cb1d577dbc5fd645e429126748681ef9997
Instruction Fuzzy Hash: 9E515B316046009FDB11AF28DC45F6ABBF4FB48724F04892AF996DB2A1DB70E944DB42

Function 008BB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008BB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 008BB546
GetLastError.KERNEL32 ref: 008BB550
SetErrorMode.KERNEL32(00000000,READY), ref: 008BB5BD

Strings

INVALID, xrefs: 008BB58F
READY, xrefs: 008BB596
NOTREADY, xrefs: 008BB57C
READONLY, xrefs: 008BB588
UNKNOWN, xrefs: 008BB575

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 0ce66045b94779e3fcefd921eb7dee886c07fb28677da58a44ffc94a6ead7b17
Instruction ID: 555b33702dc0e0414609b29b19c3883d32f3e916335527f064acf94b787bc654
Opcode Fuzzy Hash: 0ce66045b94779e3fcefd921eb7dee886c07fb28677da58a44ffc94a6ead7b17
Instruction Fuzzy Hash: F9317E75A00209DFCB20EB68C845AEEBBB4FF48315F144126E905D7392DBB0AA46CB52

Function 008A8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008AAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 008A9014
GetDlgCtrlID.USER32 ref: 008A901F
GetParent.USER32 ref: 008A903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 008A903E
GetDlgCtrlID.USER32(?), ref: 008A9047
GetParent.USER32(?), ref: 008A9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 008A9066

Strings

ComboBox, xrefs: 008A8F9C
ListBox, xrefs: 008A8FD1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: f78b740f67cae01bea4831dceb21a68bef48b7e6ec74c134586479026f23ea85
Instruction ID: 2850e1947930f119d23d81f3487e1b154f5d32a7f406960edf387127f3da0cef
Opcode Fuzzy Hash: f78b740f67cae01bea4831dceb21a68bef48b7e6ec74c134586479026f23ea85
Instruction Fuzzy Hash: 1B21C770A00108BFDF04ABA4DC85EFEBB74FF59320F104116F952976E2DB759819DA21

Function 008A907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008AAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 008A90FD
GetDlgCtrlID.USER32 ref: 008A9108
GetParent.USER32 ref: 008A9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 008A9127
GetDlgCtrlID.USER32(?), ref: 008A9130
GetParent.USER32(?), ref: 008A914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 008A914F

Strings

ComboBox, xrefs: 008A9087
ListBox, xrefs: 008A90BC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ddac01bd1de5844f1ff731b0fdb275f3002c71c285f2f3ac681d78c78e2fa56d
Instruction ID: 532617cf810dcc647ef5b86e3c4c9d204c5d9c4a1a6c80cbd90b48ae55960c28
Opcode Fuzzy Hash: ddac01bd1de5844f1ff731b0fdb275f3002c71c285f2f3ac681d78c78e2fa56d
Instruction Fuzzy Hash: DE21D674A00108BBEF00ABA4DC85EFEBB74FF59310F004116F951D76E2EB799419DA21

Function 008A9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 008A916F
GetClassNameW.USER32(00000000,?,00000100), ref: 008A9184
_wcscmp.LIBCMT ref: 008A9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 008A9211

Strings

list, xrefs: 008A91F3
details, xrefs: 008A91BF
smallicons, xrefs: 008A91D9
SHELLDLL_DefView, xrefs: 008A9190
largeicons, xrefs: 008A91A5

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: a27685abf70a949d16a24cca46f2d78740923c9c5e1279c74bfd04f86c73ef4c
Instruction ID: 2277d81df5b63da9a9e1d1e8249a602bdcbab857f01f28ca171f9b3f8c883b8d
Opcode Fuzzy Hash: a27685abf70a949d16a24cca46f2d78740923c9c5e1279c74bfd04f86c73ef4c
Instruction Fuzzy Hash: 11115C3764C317BDFA102628EC06EA7779CFF12334B200026F924E08D6FE61A8516591

Function 008C88AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008C88D7
CoInitialize.OLE32(00000000), ref: 008C8904
CoUninitialize.OLE32 ref: 008C890E
GetRunningObjectTable.OLE32(00000000,?), ref: 008C8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 008C8B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,008E2C0C), ref: 008C8B6F
CoGetObject.OLE32(?,00000000,008E2C0C,?), ref: 008C8B92
SetErrorMode.KERNEL32(00000000), ref: 008C8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 008C8C25
VariantClear.OLEAUT32(?), ref: 008C8C35

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 93a88d41121d309eb8e1d3101031d883bed715d1713b91dc4ca8d5fcc2d14a92
Instruction ID: 6782933526c343138be8250b6e41870af940d3ae3d1b9644857d01cbb4a09089
Opcode Fuzzy Hash: 93a88d41121d309eb8e1d3101031d883bed715d1713b91dc4ca8d5fcc2d14a92
Instruction Fuzzy Hash: F2C1E1B1608305EFD700DF68C884A2AB7E9FB89358F00496DF98ADB251DB71ED05CB52

Function 008B7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 008B7A6C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 79bcd99579755b067f4adf478e0f8c59b528fad77549e21b6cd9a4f5152ef492
Instruction ID: 1c5688124ba2f7bcf6a89e6b8726b0b51c67c458471e8d4c0c62006ddf3e4c4d
Opcode Fuzzy Hash: 79bcd99579755b067f4adf478e0f8c59b528fad77549e21b6cd9a4f5152ef492
Instruction Fuzzy Hash: A0B1697190421A9FDB10DFA8C894BFEBBB4FF89325F204429EA41E7391D734A941CB91

Function 008B11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008B11F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,008B0268,?,00000001), ref: 008B1204
GetWindowThreadProcessId.USER32(00000000), ref: 008B120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,008B0268,?,00000001), ref: 008B121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 008B122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,008B0268,?,00000001), ref: 008B1245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,008B0268,?,00000001), ref: 008B1257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,008B0268,?,00000001), ref: 008B129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,008B0268,?,00000001), ref: 008B12B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,008B0268,?,00000001), ref: 008B12BC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 5a30c31971698a2c888225c770896fa2b7db9c8dea0e7c978a5137ff1da6e6ff
Instruction ID: 13b83416f3c0a1e4c9185789e929b56c1751cb6734ed9331ded91fbd847b6a3c
Opcode Fuzzy Hash: 5a30c31971698a2c888225c770896fa2b7db9c8dea0e7c978a5137ff1da6e6ff
Instruction Fuzzy Hash: 42319C75B11204ABDF10DF54EC58BEA37AAFB55311F508226F901CB3A1D7709E40DB60

Function 0085FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0085FAA6
OleUninitialize.OLE32(?,00000000), ref: 0085FB45
UnregisterHotKey.USER32(?), ref: 0085FC9C
DestroyWindow.USER32(?), ref: 008945D6
FreeLibrary.KERNEL32(?), ref: 0089463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00894668

Strings

close all, xrefs: 0085FAA1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 18b25630b52de149ffcaa5cafe1b41aca3f7b24fde04247097a70e909c7669c6
Instruction ID: c6888610fa51325c895735e07ca525fe70618cfc8f5587c739bd1df147b7a513
Opcode Fuzzy Hash: 18b25630b52de149ffcaa5cafe1b41aca3f7b24fde04247097a70e909c7669c6
Instruction Fuzzy Hash: C0A17970301216CFDB19EF18C894E69B760FF15715F1542ADEA0AEB262DB30AC1ACF52

Function 008AA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,008AA439), ref: 008AA377

Strings

INSTANCE, xrefs: 008AA285
TEXT, xrefs: 008AA2AE
CLASS, xrefs: 008AA0F6
CLASSNN, xrefs: 008AA119
REGEXPCLASS, xrefs: 008AA13C
NAME, xrefs: 008AA1A9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 44e1d415ae9a963db1ca6fea5643f71dbad72209a045726b20fde28ef21ba390
Instruction ID: bfd9c624a1263e2fd59190fda31b0b96d33ec7045dde4b50870fe9cb5c8a2ad7
Opcode Fuzzy Hash: 44e1d415ae9a963db1ca6fea5643f71dbad72209a045726b20fde28ef21ba390
Instruction Fuzzy Hash: F991D730900605EAEB1CDFA4C442BEEFBB4FF05310F54C119D85AE3A91DB31A999DB92

Function 008DB351 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00EA56E0), ref: 008DB3EB
IsWindowEnabled.USER32(00EA56E0), ref: 008DB3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 008DB4DB
SendMessageW.USER32(00EA56E0,000000B0,?,?), ref: 008DB512
IsDlgButtonChecked.USER32(?,?), ref: 008DB54F
GetWindowLongW.USER32(00EA56E0,000000EC), ref: 008DB571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 008DB589

Strings

V, xrefs: 008DB38A, 008DB401, 008DB4BC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: V
API String ID: 4072528602-4045069856
Opcode ID: be4027c55beb9f9382cb1a631914e5673fe1cb65e71c687c0c1e490aa5320f21
Instruction ID: 27a8093287b7b8544885e8e5d2d2cea3f05877117d534201d43d118cc8cab81b
Opcode Fuzzy Hash: be4027c55beb9f9382cb1a631914e5673fe1cb65e71c687c0c1e490aa5320f21
Instruction Fuzzy Hash: 3071AA34605204EFDB25DF64C894FAA7BBAFF49310F16825AEA42D73A2C731AC40DB54

Function 00852E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00852EAE

Part of subcall function 00851DB3: GetClientRect.USER32(?,?), ref: 00851DDC
Part of subcall function 00851DB3: GetWindowRect.USER32(?,?), ref: 00851E1D
Part of subcall function 00851DB3: ScreenToClient.USER32(?,?), ref: 00851E45

GetDC.USER32 ref: 0088CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0088CD45
SelectObject.GDI32(00000000,00000000), ref: 0088CD53
SelectObject.GDI32(00000000,00000000), ref: 0088CD68
ReleaseDC.USER32(?,00000000), ref: 0088CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0088CDFB

Strings

U, xrefs: 0088CCD0

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 0f8d179c7a2c4750edd890f8dae76c8592e47f7c681df82a91865a7efde5433b
Instruction ID: a37eb6183f0c4463fd8e862091b202f6bbab2d7322a387383f2cbdee1debbadc
Opcode Fuzzy Hash: 0f8d179c7a2c4750edd890f8dae76c8592e47f7c681df82a91865a7efde5433b
Instruction Fuzzy Hash: A271C031500209DFCF21AF64C885AEA7BB6FF49325F14827AED55DA2AAD7308C45DB60

Function 008C1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 008C1A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 008C1A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 008C1ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 008C1AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008C1AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 008C1B10
InternetCloseHandle.WININET(00000000), ref: 008C1B57

Part of subcall function 008C2483: GetLastError.KERNEL32(?,?,008C1817,00000000,00000000,00000001), ref: 008C2498
Part of subcall function 008C2483: SetEvent.KERNEL32(?,?,008C1817,00000000,00000000,00000001), ref: 008C24AD

Strings

, xrefs: 008C1B01

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 79313ddce6a8a11681713aa53a570a5dece0c6adab3bc20a35c5159dac8c68ff
Instruction ID: fb27571dcb93a4d7e6eceb7f7abd0d9cc9204c927f1f3d59d47322de0264e6bd
Opcode Fuzzy Hash: 79313ddce6a8a11681713aa53a570a5dece0c6adab3bc20a35c5159dac8c68ff
Instruction Fuzzy Hash: 57414CB1501218BFEB119F54CC89FFA7BACFB09354F04812AFA05DA182E770DE449BA5

Function 008D62CD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 008D62EC
GetWindowLongW.USER32(00EA56E0,000000F0), ref: 008D631F
GetWindowLongW.USER32(00EA56E0,000000F0), ref: 008D6354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 008D6386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 008D63B0
GetWindowLongW.USER32(00000000,000000F0), ref: 008D63C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 008D63DB

Strings

V, xrefs: 008D62D0, 008D6304, 008D6339, 008D6371, 008D6395, 008D63CD

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: V
API String ID: 2178440468-4045069856
Opcode ID: 8589204f423523cfcc64c6a96af374a1f88d83c640092f71f58cedf8c13cb0b0
Instruction ID: 210250e176fd3722a865b2c4b230f9081905e4b638bed571bdaf95aac13ce622
Opcode Fuzzy Hash: 8589204f423523cfcc64c6a96af374a1f88d83c640092f71f58cedf8c13cb0b0
Instruction Fuzzy Hash: 3B31FF30644259EFDB24CF58EC84F5837E1FB5A714F1A42AAF601CB3B2DB61A850EB51

Function 008C8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,008DF910), ref: 008C8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,008DF910), ref: 008C8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 008C8ED6
SysFreeString.OLEAUT32(?), ref: 008C8F00

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: e90a0b9ad910bf8d24f08414d29e411a1a7133b258a8efd92b4c008ce291f2e5
Instruction ID: 604db926e57fa8be32fddaaebc1a4f7aac56f8edf9697007719da74d1e1d1834
Opcode Fuzzy Hash: e90a0b9ad910bf8d24f08414d29e411a1a7133b258a8efd92b4c008ce291f2e5
Instruction Fuzzy Hash: FBF10471A00209EFDB14DF94C888EAEB7B9FF49315F108598E906EB251DB31EE45CB61

Function 008CF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008CF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 008CF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 008CF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 008CF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 008CF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 008CFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 008CFA7C
CloseHandle.KERNEL32(?), ref: 008CFAAB
CloseHandle.KERNEL32(?), ref: 008CFB22

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 9cb19790dea9749e5f6c77dee0da20e62774f2cbf0621ca6aa8c28b8ee8e4df1
Instruction ID: 66a648b548e2042c23c7eaa9da38f4c72b25f4947f7ff2451e4b87e42a89dc12
Opcode Fuzzy Hash: 9cb19790dea9749e5f6c77dee0da20e62774f2cbf0621ca6aa8c28b8ee8e4df1
Instruction Fuzzy Hash: B0E17C316042509FDB14EF28C891B6ABBE2FF85314F14856DF999DB2A2DB30DC45CB52

Function 008B4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008B466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008B3697,?), ref: 008B468B

Part of subcall function 008B466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008B3697,?), ref: 008B46A4

Part of subcall function 008B4A31: GetFileAttributesW.KERNEL32(?,008B370B), ref: 008B4A32

lstrcmpiW.KERNEL32(?,?), ref: 008B4D40
_wcscmp.LIBCMT ref: 008B4D5A
MoveFileW.KERNEL32(?,?), ref: 008B4D75

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: b089cc6d56ccf9d5ac69acdc63ce493ee2cb896ee03cd29271ab638fe932aec1
Instruction ID: ba108f62e9627b30479b2ce7e78c5bfa6b280284412a8de6d797a26f9f352b78
Opcode Fuzzy Hash: b089cc6d56ccf9d5ac69acdc63ce493ee2cb896ee03cd29271ab638fe932aec1
Instruction Fuzzy Hash: 0A5140B20083459BC724DB64D8919DFB7ECFF85350F40592EB689D3252EE34A688C767

Function 00852B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0088C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0088C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0088C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0088C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0088C370
DestroyIcon.USER32(00000000), ref: 0088C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0088C39C
DestroyIcon.USER32(?), ref: 0088C3AB

Part of subcall function 008DA4AF: DeleteObject.GDI32(00000000), ref: 008DA4E8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: e436b9740de80baab5f2a308d4738f4c8ff75e230fb0086c31aef1fd0dd326d9
Instruction ID: 34b88af27b918a2fbf5f25b90f9d2710c6cc947c0d9baae54f37d596bedfa5ce
Opcode Fuzzy Hash: e436b9740de80baab5f2a308d4738f4c8ff75e230fb0086c31aef1fd0dd326d9
Instruction Fuzzy Hash: 9F517B70600209EFDB20EF64CC45BAA3BA5FB55321F108629F902D72A0DB70ED51EB61

Function 008A966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 008AA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 008AA84C
Part of subcall function 008AA82C: GetCurrentThreadId.KERNEL32 ref: 008AA853
Part of subcall function 008AA82C: AttachThreadInput.USER32(00000000,?,008A9683,?,00000001), ref: 008AA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 008A968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 008A96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 008A96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 008A96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 008A96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 008A96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 008A96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 008A96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 008A96FB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 3890428c6e21b872f700042cc1d57cbe0a0cd8efa152c5a20deeff43ece8bc80
Instruction ID: 9f8116171423565d29e18c737e3202a5da3bbc5298526cfe8119b5c7b751c0fe
Opcode Fuzzy Hash: 3890428c6e21b872f700042cc1d57cbe0a0cd8efa152c5a20deeff43ece8bc80
Instruction Fuzzy Hash: 3A11E1B1910218FEFB116F64DC89F6A3B2DFB4D761F100526F345AB4A1CAF25C10EAA4

Function 008A8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,008A853C,00000B00,?,?), ref: 008A892A
HeapAlloc.KERNEL32(00000000,?,008A853C,00000B00,?,?), ref: 008A8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,008A853C,00000B00,?,?), ref: 008A8946
GetCurrentProcess.KERNEL32(?,00000000,?,008A853C,00000B00,?,?), ref: 008A894E
DuplicateHandle.KERNEL32(00000000,?,008A853C,00000B00,?,?), ref: 008A8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,008A853C,00000B00,?,?), ref: 008A8961
GetCurrentProcess.KERNEL32(008A853C,00000000,?,008A853C,00000B00,?,?), ref: 008A8969
DuplicateHandle.KERNEL32(00000000,?,008A853C,00000B00,?,?), ref: 008A896C
CreateThread.KERNEL32(00000000,00000000,008A8992,00000000,00000000,00000000), ref: 008A8986

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: a080fb564f7f439af3e2e516f08b2e85c3d12b6d2b8b0e721a2c2f14a084413d
Instruction ID: 98c6c765066ed12143460a0182dfc383bb8fc374c334e41f59145095a4533b5a
Opcode Fuzzy Hash: a080fb564f7f439af3e2e516f08b2e85c3d12b6d2b8b0e721a2c2f14a084413d
Instruction Fuzzy Hash: 8A01AC75241304FFEA11ABA5DC49F673B6CFB89711F448521FB05DB1A1CA7498009A20

Function 008C9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 008C9B7B
NULL Pointer assignment, xrefs: 008C9BA4, 008C9EC8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: c114e2ba272b961ba2b0b28c522f1a1a678b7556f2d60d04e6960d19c64dcecc
Instruction ID: 542c377a29cc6e14b027bb0492cc566417b16289606b29393b3e7caadeff94b7
Opcode Fuzzy Hash: c114e2ba272b961ba2b0b28c522f1a1a678b7556f2d60d04e6960d19c64dcecc
Instruction Fuzzy Hash: 1BC17F71A0021AABDF10DFA8D888FAEB7B5FB58314F1584ADE945E7281E770DD41CB90

Function 008C9113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008C9167
VariantInit.OLEAUT32(?), ref: 008C9238
VariantInit.OLEAUT32(?), ref: 008C9339
VariantClear.OLEAUT32(?), ref: 008C9343
VariantClear.OLEAUT32(?), ref: 008C93A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 008C931C
Null Object assignment in FOR..IN loop, xrefs: 008C91C8, 008C92F6, 008C93AE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: dabe601315682f824588fc8a79f16fc4a9944f4eb9e1d65d86eda7fc3f9bc8a6
Instruction ID: 8d3ac9ed3a99c544cad67c8dd88c2d44b4040921d54dcc236868e6c29f8fdc41
Opcode Fuzzy Hash: dabe601315682f824588fc8a79f16fc4a9944f4eb9e1d65d86eda7fc3f9bc8a6
Instruction Fuzzy Hash: 85915B71A00219ABDB24DFA5C848FAEBBB8FF45714F10819DE595EB280D770D945CBA0

Function 008C975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 008A710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?,?,008A7455), ref: 008A7127
Part of subcall function 008A710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?), ref: 008A7142
Part of subcall function 008A710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?), ref: 008A7150
Part of subcall function 008A710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?), ref: 008A7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 008C9806
_memset.LIBCMT ref: 008C9813
_memset.LIBCMT ref: 008C9956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 008C9982
CoTaskMemFree.OLE32(?), ref: 008C998D

Strings

NULL Pointer assignment, xrefs: 008C99DB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: cfea020fdd1cdd381f966bb84b74d7259480bfe169e1345945b3d21d67a59154
Instruction ID: 0102c2c5702fd927e780e9b64a2977d58027064344f3afcee6c17989658546a7
Opcode Fuzzy Hash: cfea020fdd1cdd381f966bb84b74d7259480bfe169e1345945b3d21d67a59154
Instruction Fuzzy Hash: 8F910571D00229EBDB10DFA5DC45EDEBBB9FF08310F20416AE519E7291DB719A44CBA1

Function 008D6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 008D6E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 008D6E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 008D6E52
_wcscat.LIBCMT ref: 008D6EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 008D6EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 008D6EF2

Strings

SysListView32, xrefs: 008D6DF6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 91b2b5c1dddbf4af52c244162ee04949c0beda7e74073c766c29d7c3d27355b0
Instruction ID: 10a1028b099e9f5a22c8adb78cda06d51cac14c28a61a9707b9bd61ceb610c8c
Opcode Fuzzy Hash: 91b2b5c1dddbf4af52c244162ee04949c0beda7e74073c766c29d7c3d27355b0
Instruction Fuzzy Hash: 3841B270A0030CAFEB219F64CC85BEA77A9FF08350F10462AF585E7292E6729D94CB50

Function 008CE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 008B3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 008B3C7A
Part of subcall function 008B3C55: Process32FirstW.KERNEL32(00000000,?), ref: 008B3C88
Part of subcall function 008B3C55: CloseHandle.KERNEL32(00000000), ref: 008B3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 008CE9A4
GetLastError.KERNEL32 ref: 008CE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 008CE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 008CEA63
GetLastError.KERNEL32(00000000), ref: 008CEA6E
CloseHandle.KERNEL32(00000000), ref: 008CEAA3

Strings

SeDebugPrivilege, xrefs: 008CE9C2

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f752a25b394ddaea3077490ec647e015e8237de5b7b8887f24c11f38664ed365
Instruction ID: 80577ee6dbde3fb138ca6c4cc79c7333117b977d37a99edbf537f16d6940c6a4
Opcode Fuzzy Hash: f752a25b394ddaea3077490ec647e015e8237de5b7b8887f24c11f38664ed365
Instruction Fuzzy Hash: 144178712002109FDB15EF28C896F6ABBA5FF51314F088419FA469B2D2DB75E908CF96

Function 008D7291 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008D72AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008D7351
IsMenu.USER32(?), ref: 008D7369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 008D73B1
DrawMenuBar.USER32 ref: 008D73C4

Strings

V, xrefs: 008D7311, 008D732C
0, xrefs: 008D729E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0$V
API String ID: 3866635326-3648174478
Opcode ID: 9f5d0c6206c51150a2c21cadef38e35f892f9c52be0d94f3f0d0ffb41dcb6f86
Instruction ID: 9bb8af165d6784143b8b9954e4d0b20aa65b7e333af06c3591277371e2c859f7
Opcode Fuzzy Hash: 9f5d0c6206c51150a2c21cadef38e35f892f9c52be0d94f3f0d0ffb41dcb6f86
Instruction Fuzzy Hash: 30411575A04208EFDB24DF54D884A9ABBF8FB08314F54866AFD15EB350E730AD50EB60

Function 008B2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 008B3033

Strings

blank, xrefs: 008B2FB5
info, xrefs: 008B2FD4
stop, xrefs: 008B3004
warning, xrefs: 008B301C
question, xrefs: 008B2FEC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: bf3749cba288d677eb6471904825bbda24884c84b1a9582c9a2a95e8b505beda
Instruction ID: e3d8f7c0a8c71b8331e65e3c885adfaa51aee3d5b3023cc9aedc596796ab95be
Opcode Fuzzy Hash: bf3749cba288d677eb6471904825bbda24884c84b1a9582c9a2a95e8b505beda
Instruction Fuzzy Hash: AD112E3238C786BED7146A19DC82CEB779CFF19364B10406AF904E63C2DB70AF4255A5

Function 008B42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 008B4312
LoadStringW.USER32(00000000), ref: 008B4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 008B432F
LoadStringW.USER32(00000000), ref: 008B4336
_wprintf.LIBCMT ref: 008B435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008B437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 008B4357

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 049d9b8b93608aee34e68e517ba00ef9664a50815386125aa93e41f54cce6db0
Instruction ID: 981655118d53215883bae3bbcd8122dd604312dd8c9ccb7ad50332ac749558d3
Opcode Fuzzy Hash: 049d9b8b93608aee34e68e517ba00ef9664a50815386125aa93e41f54cce6db0
Instruction Fuzzy Hash: 390186F290120CBFE71197A4DD89EF7776CFB08700F0046A2B74AE2152EA749E855B71

Function 00852A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0088C1C7,00000004,00000000,00000000,00000000), ref: 00852ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0088C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00852B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0088C1C7,00000004,00000000,00000000,00000000), ref: 0088C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0088C1C7,00000004,00000000,00000000,00000000), ref: 0088C286

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 1d32b74aaa162e7126bb324a24cd5a2570cd6397194368533dcf495afa9e9167
Instruction ID: 09c258b570bfbe41cf55ee43c1d5867870606af1c99f5122e2d05c0de1c7e46c
Opcode Fuzzy Hash: 1d32b74aaa162e7126bb324a24cd5a2570cd6397194368533dcf495afa9e9167
Instruction Fuzzy Hash: A2411B30204684DACB379B289C88B6E7B92FB87316F548519E947C25A1CF31984DD721

Function 008B70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 008B70DD

Part of subcall function 00870DB6: std::exception::exception.LIBCMT ref: 00870DEC
Part of subcall function 00870DB6: __CxxThrowException@8.LIBCMT ref: 00870E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 008B7114
EnterCriticalSection.KERNEL32(?), ref: 008B7130
_memmove.LIBCMT ref: 008B717E
_memmove.LIBCMT ref: 008B719B
LeaveCriticalSection.KERNEL32(?), ref: 008B71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 008B71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 008B71DE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 661b986ee4bb60751240d2024d2599c8be5fe49cf8a399a2138f6fa0f04b1d1f
Instruction ID: 21329bc5bfa071f922c9d050bd22208a75ad355b0f51e39cf9067abe5e0a0db4
Opcode Fuzzy Hash: 661b986ee4bb60751240d2024d2599c8be5fe49cf8a399a2138f6fa0f04b1d1f
Instruction Fuzzy Hash: 82314D32900205EBCB10DFA8DC85AAABB78FF45710F1481A6F904DA256DB30DA54DB61

Function 008D61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 008D61EB
GetDC.USER32(00000000), ref: 008D61F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008D61FE
ReleaseDC.USER32(00000000,00000000), ref: 008D620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 008D6246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 008D6257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,008D902A,?,?,000000FF,00000000,?,000000FF,?), ref: 008D6291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 008D62B1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: e5fd0148fc0e9c41b0844500728002e8b59d41403dbb5d17a4eb2272bbc5f127
Instruction ID: a043ecfb33a351c93234051045c18f93f8a295d166b08130e99db66c46c5ba7b
Opcode Fuzzy Hash: e5fd0148fc0e9c41b0844500728002e8b59d41403dbb5d17a4eb2272bbc5f127
Instruction Fuzzy Hash: 7D31AB72201214BFEF108F10DC8AFEA3BA9FF49720F044166FE09DA292D6759C51CB60

Function 008ABBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 008ABBC4
_memcmp.LIBCMT ref: 008ABBE6
_memcmp.LIBCMT ref: 008ABBFE
_memcmp.LIBCMT ref: 008ABC11
_memcmp.LIBCMT ref: 008ABC2B
_memcmp.LIBCMT ref: 008ABC3E
_memcmp.LIBCMT ref: 008ABC56
_memcmp.LIBCMT ref: 008ABC71

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 80006e7830af93720ebde0bb3cb528ea17b399294d19c579e822a6e73112d72b
Instruction ID: 5c5960d0509c839e1381a234447d33ed6901be5a3191b2ca81d5c27f0609ef0e
Opcode Fuzzy Hash: 80006e7830af93720ebde0bb3cb528ea17b399294d19c579e822a6e73112d72b
Instruction Fuzzy Hash: DA2195716016597BB704661A9D82FBB735DFF13368F048010FD08D6E87EB58DE1182B6

Function 008BEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

Part of subcall function 0086FC86: _wcscpy.LIBCMT ref: 0086FCA9

_wcstok.LIBCMT ref: 008BEC94
_wcscpy.LIBCMT ref: 008BED23
_memset.LIBCMT ref: 008BED56

Strings

X, xrefs: 008BED93

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 323eccdc603e046d6d67e04ce6f9f9aca82044119623e8fa6c41141540697841
Instruction ID: db90a65fc2de9479ec7a1e4c736edfeff156bd3493651f4fa2f0e6a0d59d0dab
Opcode Fuzzy Hash: 323eccdc603e046d6d67e04ce6f9f9aca82044119623e8fa6c41141540697841
Instruction Fuzzy Hash: 94C13B715086019FC764EF28D851A9AB7E4FF85315F14892DF899D73A2DB30E849CB83

Function 008C6B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 008C6C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 008C6C21
WSAGetLastError.WSOCK32(00000000), ref: 008C6C34
htons.WSOCK32(?,?,?,00000000,?), ref: 008C6CEA
inet_ntoa.WSOCK32(?), ref: 008C6CA7

Part of subcall function 008AA7E9: _strlen.LIBCMT ref: 008AA7F3
Part of subcall function 008AA7E9: _memmove.LIBCMT ref: 008AA815

_strlen.LIBCMT ref: 008C6D44
_memmove.LIBCMT ref: 008C6DAD

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 226ee750ad79d3ed10dcc673eaebd78898e458b39043fc52a9700dbe6bffb254
Instruction ID: 3b184d32b26df757f2ba0a0694d1a3c4b5e85b6a38d2b30bbad35141417516ff
Opcode Fuzzy Hash: 226ee750ad79d3ed10dcc673eaebd78898e458b39043fc52a9700dbe6bffb254
Instruction Fuzzy Hash: 6A818F71204200ABD710EB28DC91F6AB7B8FF84724F14492DF956DB2A2EA71DD05CB52

Function 00851424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab721bfce9cf81da822366b518e4a44c5008c4564829085bba2c1a72756a9d6f
Instruction ID: 1a4d81e42ddb4159a59e1806b7122a0a1d3a180acf637d75cd1e4df42ac8125f
Opcode Fuzzy Hash: ab721bfce9cf81da822366b518e4a44c5008c4564829085bba2c1a72756a9d6f
Instruction Fuzzy Hash: B9715930900109EFCF04DF98CC89ABEBB7AFF85315F148259F915EA251D734AA55CBA4

Function 008CF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008CF448
_memset.LIBCMT ref: 008CF511
ShellExecuteExW.SHELL32(?), ref: 008CF556

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

Part of subcall function 0086FC86: _wcscpy.LIBCMT ref: 0086FCA9

GetProcessId.KERNEL32(00000000), ref: 008CF5CD
CloseHandle.KERNEL32(00000000), ref: 008CF5FC

Strings

@, xrefs: 008CF525

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9277d23f487f3140703d3e56299b06a25dc07f1d151001e7f8d0b03d12f07ebc
Instruction ID: b25544568baf91e1af7055aea7dd6cc8fc92d63ad1a4122bcd2541822ac177f8
Opcode Fuzzy Hash: 9277d23f487f3140703d3e56299b06a25dc07f1d151001e7f8d0b03d12f07ebc
Instruction Fuzzy Hash: B061AA75A00619DFCB04DF68C881AAEBBB5FF48310F148069E95AEB352CB30ED41CB85

Function 008B0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 008B0F8C
GetKeyboardState.USER32(?), ref: 008B0FA1
SetKeyboardState.USER32(?), ref: 008B1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 008B1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 008B104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 008B1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 008B10B8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b6446dbf6b8942377526555418caa4542ece0a206cb2324155fab4689554b0fe
Instruction ID: d71e94a8e7f69516ad778502197fc499999085e0c32934e7f80428e2a43c600c
Opcode Fuzzy Hash: b6446dbf6b8942377526555418caa4542ece0a206cb2324155fab4689554b0fe
Instruction Fuzzy Hash: 5951F260604AD539FF3252388C29BF7BFA9BB06304F488589E1D5C9AC3C694DCC9DB51

Function 008B0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 008B0DA5
GetKeyboardState.USER32(?), ref: 008B0DBA
SetKeyboardState.USER32(?), ref: 008B0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 008B0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 008B0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 008B0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 008B0EC9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: be9b708d8e01ab6d9dd715228b294277ec9bad6ac98b9ce34166005a28f3f427
Instruction ID: 80f7ada5d7f41d0e3923cbcfc294cbe81b73ea3965d6f26735a0c611984eda4e
Opcode Fuzzy Hash: be9b708d8e01ab6d9dd715228b294277ec9bad6ac98b9ce34166005a28f3f427
Instruction Fuzzy Hash: 3F51E3A05446D53DFB3283648855BFB7FA9FB06300F088989E1D5CAAC2D795EC88EB51

Function 008B55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 008B560A
_wcsncpy.LIBCMT ref: 008B563F
_wcsncpy.LIBCMT ref: 008B5671
_wcsncpy.LIBCMT ref: 008B56A4
_wcsncpy.LIBCMT ref: 008B56E6
_wcsncpy.LIBCMT ref: 008B5720
_wcsncpy.LIBCMT ref: 008B574F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 5a2f4e209cb6b9bdbec44055128529745361fbf5659c9f9e93fae99739dbd3fe
Instruction ID: 6bc5a3e29b9354fe924a3e933c27540c3ffcec6caef5a2a25f498d3289d7a47d
Opcode Fuzzy Hash: 5a2f4e209cb6b9bdbec44055128529745361fbf5659c9f9e93fae99739dbd3fe
Instruction Fuzzy Hash: 4A41A365C11618B6CB11EBB88C86ACFB7B8FF05310F50C956E518E3225EB34E245C7AB

Function 008DA056 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

V, xrefs: 008DA099, 008DA133

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-4045069856
Opcode ID: cf1c35118a0bdaee12e9342f0a0e9b98b14ed83843d4edc1451ad890bd803488
Instruction ID: 38d10a20de4cea7dd9a2233e03d057a935f1344ab99a58612d9ea1ab5b388b1b
Opcode Fuzzy Hash: cf1c35118a0bdaee12e9342f0a0e9b98b14ed83843d4edc1451ad890bd803488
Instruction Fuzzy Hash: FC419235905504EBDB189B28CC88FA9BBA4FB09320F254366F917E73E1C7309D41EA51

Function 008B3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008B466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008B3697,?), ref: 008B468B

Part of subcall function 008B466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008B3697,?), ref: 008B46A4

lstrcmpiW.KERNEL32(?,?), ref: 008B36B7
_wcscmp.LIBCMT ref: 008B36D3
MoveFileW.KERNEL32(?,?), ref: 008B36EB
_wcscat.LIBCMT ref: 008B3733
SHFileOperationW.SHELL32(?), ref: 008B379F

Strings

\*.*, xrefs: 008B372D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a7c49be30184d89bc24a5edabb8517f8ce05dc9a77d4409030be7576a7f2d9aa
Instruction ID: 0c1cf1a98c435537b7596132e5f55723439e004342710bd7aecf0098fadd3aa2
Opcode Fuzzy Hash: a7c49be30184d89bc24a5edabb8517f8ce05dc9a77d4409030be7576a7f2d9aa
Instruction Fuzzy Hash: 37417E71508344AEC751EF68D4429EFB7E8FF89380F00193EB49AC3251EA34D689C756

Function 008D0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 008D0FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008D0FFE
FreeLibrary.KERNEL32(00000000), ref: 008D10B5

Part of subcall function 008D0FA5: RegCloseKey.ADVAPI32(?), ref: 008D101B
Part of subcall function 008D0FA5: FreeLibrary.KERNEL32(?), ref: 008D106D
Part of subcall function 008D0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 008D1090

RegDeleteKeyW.ADVAPI32(?,?), ref: 008D1058

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: fc29dbbbf1c9efd43fa9ff51797238fa3d87a3607bf50257b0ec10670c567c24
Instruction ID: 0ed4b84aa44db63863683cfe1776a4740dbd049e45ee1c196e48c7c2396a633e
Opcode Fuzzy Hash: fc29dbbbf1c9efd43fa9ff51797238fa3d87a3607bf50257b0ec10670c567c24
Instruction Fuzzy Hash: 5D31EC71901509BFDF159B94DC89AFFB7BCFF08300F10426AE512E2251DB749E859AA1

Function 008ADAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008ADB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008ADB54
SysAllocString.OLEAUT32(00000000), ref: 008ADB57
SysAllocString.OLEAUT32(?), ref: 008ADB75
SysFreeString.OLEAUT32(?), ref: 008ADB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 008ADBA3
SysAllocString.OLEAUT32(?), ref: 008ADBB1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4c166bbf70e82176dcd8e96c1381d3731167aa8db53c37a3d3096cf16e287856
Instruction ID: 58cb8527339b6590e0212954343ec35d57d56f84e8872cc8c81852e34ac864f0
Opcode Fuzzy Hash: 4c166bbf70e82176dcd8e96c1381d3731167aa8db53c37a3d3096cf16e287856
Instruction Fuzzy Hash: DD219132601219AFAF109FA8DC84CBB73ACFB09370B018126FE16DB651D6709C4297A4

Function 008C6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008C7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008C7DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 008C61C6
WSAGetLastError.WSOCK32(00000000), ref: 008C61D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 008C620E
connect.WSOCK32(00000000,?,00000010), ref: 008C6217
WSAGetLastError.WSOCK32 ref: 008C6221
closesocket.WSOCK32(00000000), ref: 008C624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 008C6263

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: fea9e587b5b7b46e1adc43e9b8d6b83811b97be9bc86e6a434c828622cd42d35
Instruction ID: bb22a53e70d325a037a94179e60c12f2e97b7f62b05b8b15defacbdc169a2b9b
Opcode Fuzzy Hash: fea9e587b5b7b46e1adc43e9b8d6b83811b97be9bc86e6a434c828622cd42d35
Instruction Fuzzy Hash: D2316131600118ABEB10AF64CC85FB97BB9FF45765F04413AFD06E7292DB70ED149AA2

Function 008AF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 008AF671
__wcsnicmp.LIBCMT ref: 008AF692
__wcsnicmp.LIBCMT ref: 008AF6AC

Strings

#notrayicon, xrefs: 008AF669
#requireadmin, xrefs: 008AF68C
#OnAutoItStartRegister, xrefs: 008AF6A6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 3a4acef41a82aea530cea2ef784d0575a9f6880329495212a4b25b1680b40f07
Instruction ID: 01988341428ba959e1fb6c71f12a94a77640abd95a8be910f09f5f994568bde1
Opcode Fuzzy Hash: 3a4acef41a82aea530cea2ef784d0575a9f6880329495212a4b25b1680b40f07
Instruction Fuzzy Hash: F521347220455166E220AA78AC02EA773DCFF67354F108439FA8AC65A2FB549D81D396

Function 008ADBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008ADC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008ADC2F
SysAllocString.OLEAUT32(00000000), ref: 008ADC32
SysAllocString.OLEAUT32 ref: 008ADC53
SysFreeString.OLEAUT32 ref: 008ADC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 008ADC76
SysAllocString.OLEAUT32(?), ref: 008ADC84

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: df78d1a482d1ed9867349ca0f514ec42ffdccdb73b3dba4db842ee20e25dd011
Instruction ID: a16998ed8ebac4cebcbdd7350c6b567c7c2c838d3c6a7845d9b419b2e408572c
Opcode Fuzzy Hash: df78d1a482d1ed9867349ca0f514ec42ffdccdb73b3dba4db842ee20e25dd011
Instruction Fuzzy Hash: 59214776605204AFAB10DFA8DC88DAB77ECFB09370B50C126FA16CB661DA74DC41D764

Function 008D75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00851D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00851D73
Part of subcall function 00851D35: GetStockObject.GDI32(00000011), ref: 00851D87
Part of subcall function 00851D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00851D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 008D7632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 008D763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 008D764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 008D7659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 008D7665

Strings

Msctls_Progress32, xrefs: 008D7603

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 108baa21d70b94b014aee4359c848d151c6a88397b3954133c643b739ea63c58
Instruction ID: d2bbe0f789e83f597d9ae496af6c2a2582856a8dc84e96ef3a4561aae159129b
Opcode Fuzzy Hash: 108baa21d70b94b014aee4359c848d151c6a88397b3954133c643b739ea63c58
Instruction Fuzzy Hash: 5C1190B2110219BFEF118F64DC85EE77F6DFF087A8F014215BA04A21A0DA72DC21DBA4

Function 00879AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00879AE6

Part of subcall function 00873187: EncodePointer.KERNEL32(00000000), ref: 0087318A
Part of subcall function 00873187: __initp_misc_winsig.LIBCMT ref: 008731A5
Part of subcall function 00873187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00879EA0
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00879EB4
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00879EC7
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00879EDA
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00879EED
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00879F00
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00879F13
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00879F26
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00879F39
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00879F4C
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00879F5F
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00879F72
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00879F85
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00879F98
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00879FAB
Part of subcall function 00873187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00879FBE

__mtinitlocks.LIBCMT ref: 00879AEB
__mtterm.LIBCMT ref: 00879AF4

Part of subcall function 00879B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00879AF9,00877CD0,0090A0B8,00000014), ref: 00879C56
Part of subcall function 00879B5C: _free.LIBCMT ref: 00879C5D
Part of subcall function 00879B5C: DeleteCriticalSection.KERNEL32(0090EC00,?,?,00879AF9,00877CD0,0090A0B8,00000014), ref: 00879C7F

__calloc_crt.LIBCMT ref: 00879B19
__initptd.LIBCMT ref: 00879B3B
GetCurrentThreadId.KERNEL32 ref: 00879B42

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 00ccdba3d808e427297d0156a441c311d8ff4aece2da5cf6aae8cd63524d72ad
Instruction ID: 3a9bbd45b25d40e9bfc30c68b1de1477f2328a5414f63c241f42ca2aa2dd38e3
Opcode Fuzzy Hash: 00ccdba3d808e427297d0156a441c311d8ff4aece2da5cf6aae8cd63524d72ad
Instruction Fuzzy Hash: 15F0623251A7219AE634B67C7C07A4A3B91FF02730B20CA19F4ECC51DAEE20C4414562

Function 0087406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00873F85), ref: 00874085
GetProcAddress.KERNEL32(00000000), ref: 0087408C
EncodePointer.KERNEL32(00000000), ref: 00874097
DecodePointer.KERNEL32(00873F85), ref: 008740B2

Strings

combase.dll, xrefs: 00874080
RoUninitialize, xrefs: 00874074

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: f2da23d9c6d666e142199f92e199f1ab7e5563bc2437036e69fb5f3a47d918f0
Instruction ID: bf105f64b691e4f32c5c62268720268b4d594ca849dfbe15795eadd6892302d8
Opcode Fuzzy Hash: f2da23d9c6d666e142199f92e199f1ab7e5563bc2437036e69fb5f3a47d918f0
Instruction Fuzzy Hash: 5CE09A7079A204ABEA519F61ED09B453BB5F704742F10C135F212E12A1CBB68604EB14

Function 008B64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008B660B
_memmove.LIBCMT ref: 008B6546

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

_memmove.LIBCMT ref: 008B65B9
_memmove.LIBCMT ref: 008B66A0
_memmove.LIBCMT ref: 008B66B9
_memmove.LIBCMT ref: 008B66D5

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 01f6861b9c9f464f3e444165d26c031541feffe0c99e54a007fe9ecc55138285
Instruction ID: 51c61ce9215d53adc1c0b2194168b2c04b924ec32f135de761c00fb29a1bc326
Opcode Fuzzy Hash: 01f6861b9c9f464f3e444165d26c031541feffe0c99e54a007fe9ecc55138285
Instruction Fuzzy Hash: 71616C3150065A9BDF11EF68CC81AFE37A5FF15308F044529FC59EB292EA38E919CB52

Function 008D01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008D0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008CFDAD,?,?), ref: 008D0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008D02BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008D02FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 008D0320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 008D0349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 008D038C
RegCloseKey.ADVAPI32(00000000), ref: 008D0399

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: b933aed2e8f017fcd4a017447364344e27433f049f4c0686e9755c21ba2e0118
Instruction ID: e8a53f27bbdd8a6a8f29d4f373f59b6c77c99755a378db5620939e90e2fa67a0
Opcode Fuzzy Hash: b933aed2e8f017fcd4a017447364344e27433f049f4c0686e9755c21ba2e0118
Instruction Fuzzy Hash: D5514A31108204AFC715EF68D845E6ABBE9FF85314F044A1EF955C72A2DB31E909DF52

Function 008D5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 008D57FB
GetMenuItemCount.USER32(00000000), ref: 008D5832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 008D585A
GetMenuItemID.USER32(?,?), ref: 008D58C9
GetSubMenu.USER32(?,?), ref: 008D58D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 008D5928

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 265bfbe1fdcea9600a79809e058563ebf6f915eea3ea74c036451a00ecf49327
Instruction ID: e497df9df3dc772d6e99a15fcce186ad37a9a8dfc3f606604570eb3e70f94d42
Opcode Fuzzy Hash: 265bfbe1fdcea9600a79809e058563ebf6f915eea3ea74c036451a00ecf49327
Instruction Fuzzy Hash: 12515C35E01619EFCF11EF68C845AAEBBB5FF48320F144166E946EB351CB30AE419B91

Function 008AEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008AEF06
VariantClear.OLEAUT32(00000013), ref: 008AEF78
VariantClear.OLEAUT32(00000000), ref: 008AEFD3
_memmove.LIBCMT ref: 008AEFFD
VariantClear.OLEAUT32(?), ref: 008AF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 008AF078

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 3e780a4594cf0a2853ce64730aedc20622b7683da60297a7a8c2fe7d15454d52
Instruction ID: 12a75e0d4b27c86ae8682a7f0e482b88f8977f3f1f1c42d22f44f9b1efb0a554
Opcode Fuzzy Hash: 3e780a4594cf0a2853ce64730aedc20622b7683da60297a7a8c2fe7d15454d52
Instruction Fuzzy Hash: C0516D75A00209DFDB14CF58C880AAAB7F9FF4D314B15856AEA59DB302E734E911CF90

Function 008B220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008B2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008B22A3
IsMenu.USER32(00000000), ref: 008B22C3
CreatePopupMenu.USER32 ref: 008B22F7
GetMenuItemCount.USER32(000000FF), ref: 008B2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 008B2386

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 1d099d0be71f1fafd8ac2f1d69949bb783007a3ac33b7f088eabd2da712f3c0e
Instruction ID: ee0090eb37fd4fb062f1e63b7773404106c870463e849fead7b160837e15da11
Opcode Fuzzy Hash: 1d099d0be71f1fafd8ac2f1d69949bb783007a3ac33b7f088eabd2da712f3c0e
Instruction Fuzzy Hash: 11517970601209DBDF21CF68D888BEEBBF5FF49318F14426AE811E63A1D3749945CB51

Function 00851765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0085179A
GetWindowRect.USER32(?,?), ref: 008517FE
ScreenToClient.USER32(?,?), ref: 0085181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0085182C
EndPaint.USER32(?,?), ref: 00851876

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 61088be963d482ec34b200c6f852825e0b25f4236207ca8cf28314cc1b2b9e30
Instruction ID: 76acec082ce44d672aec9cb01cfc134a56fd05a055aa83983e7ef88321355683
Opcode Fuzzy Hash: 61088be963d482ec34b200c6f852825e0b25f4236207ca8cf28314cc1b2b9e30
Instruction Fuzzy Hash: 2E41A330204301DFDB11DF28CC88FAA7BE8FB59725F044679F965C61A1C7309849DB62

Function 008DB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(009157B0,00000000,00EA56E0,?,?,009157B0,?,008DB5A8,?,?), ref: 008DB712
EnableWindow.USER32(00000000,00000000), ref: 008DB736
ShowWindow.USER32(009157B0,00000000,00EA56E0,?,?,009157B0,?,008DB5A8,?,?), ref: 008DB796
ShowWindow.USER32(00000000,00000004,?,008DB5A8,?,?), ref: 008DB7A8
EnableWindow.USER32(00000000,00000001), ref: 008DB7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 008DB7EF

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3b07865a7d363dd92de69a2607ca56a80d6a2a2774db833a489d6d332adef84f
Instruction ID: 26fe1fbf1e70074e4953c5e17c20ecbecdbb9ff97c693a8d59cf175816101b22
Opcode Fuzzy Hash: 3b07865a7d363dd92de69a2607ca56a80d6a2a2774db833a489d6d332adef84f
Instruction Fuzzy Hash: C3414F34601240EFDB26CF24C499B947BE1FB45310F1982BAFA59CF7A2CB31A856CB51

Function 008C709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,008C4E41,?,?,00000000,00000001), ref: 008C70AC

Part of subcall function 008C39A0: GetWindowRect.USER32(?,?), ref: 008C39B3

GetDesktopWindow.USER32 ref: 008C70D6
GetWindowRect.USER32(00000000), ref: 008C70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 008C710F

Part of subcall function 008B5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008B52BC

GetCursorPos.USER32(?), ref: 008C713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 008C7199

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 38847d4b0d00d44d9559309d422a4eaf22e76817bd7b9609087ba4bb5e42245b
Instruction ID: 75fb17717981029618293a706ace1a433d4044ec3f39ccaddffa8f3f4f95faab
Opcode Fuzzy Hash: 38847d4b0d00d44d9559309d422a4eaf22e76817bd7b9609087ba4bb5e42245b
Instruction Fuzzy Hash: EB31A172509305ABD720DF14D849F9BB7A9FB88314F040A1AF585D7192D670EA09CB92

Function 008A8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008A80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 008A80C0
Part of subcall function 008A80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 008A80CA
Part of subcall function 008A80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 008A80D9
Part of subcall function 008A80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 008A80E0
Part of subcall function 008A80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 008A80F6

GetLengthSid.ADVAPI32(?,00000000,008A842F), ref: 008A88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 008A88D6
HeapAlloc.KERNEL32(00000000), ref: 008A88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 008A88F6
GetProcessHeap.KERNEL32(00000000,00000000,008A842F), ref: 008A890A
HeapFree.KERNEL32(00000000), ref: 008A8911

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ab018b18fb4092290db1d4db5ac18b7ac57f8cd385a969571a411afb8f05087d
Instruction ID: 8915fe1b5c82eb2f85b03622a6280a1b723abbb723386c9541f0cda58b3a07a5
Opcode Fuzzy Hash: ab018b18fb4092290db1d4db5ac18b7ac57f8cd385a969571a411afb8f05087d
Instruction Fuzzy Hash: E1119D71502609EFEB119BA4DC09BBF7B78FB46315F148129E946D7211CB369E00DB60

Function 008A85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 008A85E2
OpenProcessToken.ADVAPI32(00000000), ref: 008A85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 008A85F8
CloseHandle.KERNEL32(00000004), ref: 008A8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 008A8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 008A8646

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 65fa62c3b833b1c5fccdfc222631b225245ad8afd5ec16e09f829b3e99e9d8ff
Instruction ID: 0192fa2a673fb4a68a7170b00449d835d156e6f70b83a9d194883793020a5fd6
Opcode Fuzzy Hash: 65fa62c3b833b1c5fccdfc222631b225245ad8afd5ec16e09f829b3e99e9d8ff
Instruction Fuzzy Hash: 811147B2501249EBEF018FA4DD49BDE7BA9FB09304F044165FE05A2161C7728D60AB60

Function 008AB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008AB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 008AB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008AB7CD
ReleaseDC.USER32(00000000,00000000), ref: 008AB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 008AB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 008AB7FE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 30b63df2565bd4e02d08e4059ed4c2c8a68c8766050c066941916a67c7fa7351
Instruction ID: 6068e707c20d6c8237e8016e049445725979cea876690546635d6f445f6eaba0
Opcode Fuzzy Hash: 30b63df2565bd4e02d08e4059ed4c2c8a68c8766050c066941916a67c7fa7351
Instruction Fuzzy Hash: EC018475E41209BBEF109BA69C45A5EBFB8FB49321F004176FB04E7292D6709D00DF91

Function 00870162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00870193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0087019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008701A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 008701B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 008701B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 008701C1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: e6dc9aef6fba723b5cee0569cad049c983060c4cce4245b8ad143183140e7372
Instruction ID: 2578ddced1a79dcde0586775ecfd0dee3cbc79ba4df353366c9997eb46c2f68a
Opcode Fuzzy Hash: e6dc9aef6fba723b5cee0569cad049c983060c4cce4245b8ad143183140e7372
Instruction Fuzzy Hash: 09016CB09027597DE3008F5A8C85B52FFA8FF19354F00411BA15C47942C7F5A864CBE5

Function 008B53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 008B53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 008B540F
GetWindowThreadProcessId.USER32(?,?), ref: 008B541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008B542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008B5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008B543E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 0c3a5fff194b1edfb39e09768983dad28b4eba9d04163878a051f32f3e2be973
Instruction ID: 8e7c8cd54b0e5ad75b9ff03692b1050209211177e95a097a4a7b7d746cd0bcc1
Opcode Fuzzy Hash: 0c3a5fff194b1edfb39e09768983dad28b4eba9d04163878a051f32f3e2be973
Instruction Fuzzy Hash: 93F09631142158BBD7215B52EC0DEEF7B7CFFC6B11F00026AFB06D1152D7A05A0196B5

Function 008B7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 008B7243
EnterCriticalSection.KERNEL32(?,?,00860EE4,?,?), ref: 008B7254
TerminateThread.KERNEL32(00000000,000001F6,?,00860EE4,?,?), ref: 008B7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00860EE4,?,?), ref: 008B726E

Part of subcall function 008B6C35: CloseHandle.KERNEL32(00000000,?,008B727B,?,00860EE4,?,?), ref: 008B6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 008B7281
LeaveCriticalSection.KERNEL32(?,?,00860EE4,?,?), ref: 008B7288

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 4baceb9e318b70c2cac9d3c13e145c6dbb26df42a28611d6e38b27d96671faf0
Instruction ID: c71a99a7f0c3e39e8daddd9e36615f903add9d4d5ae512821e44e7a9b045f3b7
Opcode Fuzzy Hash: 4baceb9e318b70c2cac9d3c13e145c6dbb26df42a28611d6e38b27d96671faf0
Instruction Fuzzy Hash: 34F05E36542612EBE7122B64ED4CADA772AFF45702F100632F643911A2DB765911EB50

Function 008A8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 008A899D
UnloadUserProfile.USERENV(?,?), ref: 008A89A9
CloseHandle.KERNEL32(?), ref: 008A89B2
CloseHandle.KERNEL32(?), ref: 008A89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 008A89C3
HeapFree.KERNEL32(00000000), ref: 008A89CA

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 9823be373548c0403793c9027be8b1ad28563680430e5e877177c55325539abf
Instruction ID: 1d1b1fea625485bb056a9350453c1ac94b9be9c861d86997a019a1e6f892ef20
Opcode Fuzzy Hash: 9823be373548c0403793c9027be8b1ad28563680430e5e877177c55325539abf
Instruction Fuzzy Hash: DEE0C236105001FBDA022FE5EC0C94ABB69FB89322B108332F31A81271CB329420EB50

Function 008C85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008C8613
CharUpperBuffW.USER32(?,?), ref: 008C8722
VariantClear.OLEAUT32(?), ref: 008C889A

Part of subcall function 008B7562: VariantInit.OLEAUT32(00000000), ref: 008B75A2
Part of subcall function 008B7562: VariantCopy.OLEAUT32(00000000,?), ref: 008B75AB
Part of subcall function 008B7562: VariantClear.OLEAUT32(00000000), ref: 008B75B7

Strings

AUTOIT.ERROR, xrefs: 008C8728
Incorrect Parameter format, xrefs: 008C864B, 008C880D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: b9bb0c6eaa2621c610c85c93093cc7985ad78aa8040f542921fe3d6fed62c61f
Instruction ID: 324dbbfc3b9d449e438262367f79dbfc8e30e880ec1013c2955a4423d683b686
Opcode Fuzzy Hash: b9bb0c6eaa2621c610c85c93093cc7985ad78aa8040f542921fe3d6fed62c61f
Instruction Fuzzy Hash: A0910471608305DFC710DF28C485A5ABBF4FB89714F14896EF89ACB261DB31E949CB92

Function 008B2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0086FC86: _wcscpy.LIBCMT ref: 0086FCA9

_memset.LIBCMT ref: 008B2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 008B2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 008B2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 008B2C97

Strings

0, xrefs: 008B2B73

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: da122d6b94ce696755b2942634cd51a69b961b926a23193ced407164b832f5b1
Instruction ID: 0f2e2e68150f15f1eb08b53af5ec151362df46a28b68a80147af78a629a84996
Opcode Fuzzy Hash: da122d6b94ce696755b2942634cd51a69b961b926a23193ced407164b832f5b1
Instruction Fuzzy Hash: F751DD716083019BD7249F28D855AAFBBE8FF99320F044A2DF895D7291DB70CD44DB92

Function 008D97F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00EAE560,?), ref: 008D9863
ScreenToClient.USER32(00000002,00000002), ref: 008D9896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 008D9903

Strings

V, xrefs: 008D9832, 008D992D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: V
API String ID: 3880355969-4045069856
Opcode ID: fd865b0a01c1427b65ee0782ccde276e19ef1e7580537282f7b8d23ec9e69aaf
Instruction ID: a7693764a07a6ac6398ad544b5328ac1e66a66e9fb6a1c4568911eeda2e217bf
Opcode Fuzzy Hash: fd865b0a01c1427b65ee0782ccde276e19ef1e7580537282f7b8d23ec9e69aaf
Instruction Fuzzy Hash: 26512B34A00209EFCB10CF68D894AAE7BB5FF55760F15826AF995DB3A0D730AD41DB90

Function 008AD56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 008AD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 008AD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 008AD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 008AD69D

Strings

DllGetClassObject, xrefs: 008AD610

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 0d43ac71f610bf4da1b2ec1c95ab3545dd2da2a5cc5fae9b734b13fbe0b0cb95
Instruction ID: 85d6d6069a90316fc27edf400e84a5b8c31fc87f6aaf60dc5ac9a46ba6127eaf
Opcode Fuzzy Hash: 0d43ac71f610bf4da1b2ec1c95ab3545dd2da2a5cc5fae9b734b13fbe0b0cb95
Instruction Fuzzy Hash: 23418EB1600305EFEB05CF54C884A9ABBB9FF56314F1581A9AD0ADFA06D7B1D944CBE0

Function 008B2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008B27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 008B27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 008B2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00915890,00000000), ref: 008B286B

Strings

0, xrefs: 008B27B5

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 88799cb7d58119ac9d32e8c129245b8da40494b64c78ecc51f676deede540ab4
Instruction ID: 0370034fc01e8b2c4d45f0087c54e0a6cf7e0c62a3c88a67651fb9449fd8e7e1
Opcode Fuzzy Hash: 88799cb7d58119ac9d32e8c129245b8da40494b64c78ecc51f676deede540ab4
Instruction Fuzzy Hash: 4E416B702043419FDB20DF28D844B9ABBE8FF85314F144A2EE9A6D7392D734A905CB52

Function 008D8851 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 008D88DE

Strings

V, xrefs: 008D888D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: InvalidateRect
String ID: V
API String ID: 634782764-4045069856
Opcode ID: 63eb6ccba9754c7cf980036cd5b28f753a7f728197c5b473ea83f97a6e0d2481
Instruction ID: a8c3ae3814289782e23ff6874d204fd34641e49d3d97d3b12340b126c57a5c3d
Opcode Fuzzy Hash: 63eb6ccba9754c7cf980036cd5b28f753a7f728197c5b473ea83f97a6e0d2481
Instruction Fuzzy Hash: 45319234605108FFEB209A58DC55FBC7BA5FB05360FA44323FA91E63A1CA71E940E752

Function 008DAB37 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 008DAB60
GetWindowRect.USER32(?,?), ref: 008DABD6
PtInRect.USER32(?,?,008DC014), ref: 008DABE6
MessageBeep.USER32(00000000), ref: 008DAC57

Strings

V, xrefs: 008DAB9C, 008DABFE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID: V
API String ID: 1352109105-4045069856
Opcode ID: 15603e7d6e9034ff66400fc2b9bddd349d3c59bfb3e17eae7e49e7c628f91947
Instruction ID: 6840c0a173c5ca99a97c6e531f4c5a085c9427b63329b5170829dfc3119d65fe
Opcode Fuzzy Hash: 15603e7d6e9034ff66400fc2b9bddd349d3c59bfb3e17eae7e49e7c628f91947
Instruction Fuzzy Hash: 5541BF30610109DFCB19CF58D884BA97BF5FF49320F2982AAE915DB361C731E841DB92

Function 008CD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 008CD7C5

Part of subcall function 0085784B: _memmove.LIBCMT ref: 00857899

Strings

stdcall, xrefs: 008CD847
none, xrefs: 008CD8A0
winapi, xrefs: 008CD836
cdecl, xrefs: 008CD81C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: c203e5d92d31bd11015257409a3cefcf373016a3876cbfb6097be4437e8ef6c3
Instruction ID: cf758910db13895cf93ce4347de4a00610f3424806bf6e050beb0311efb149d0
Opcode Fuzzy Hash: c203e5d92d31bd11015257409a3cefcf373016a3876cbfb6097be4437e8ef6c3
Instruction Fuzzy Hash: 9F318C71904319AFCF10EF58C851AAEB7B5FF04720B108A39E829D76E1DB71E905CB80

Function 008A8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008AAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 008A8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 008A8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 008A8F57

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

Strings

ComboBox, xrefs: 008A8E9E
ListBox, xrefs: 008A8ED3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: e3e7e67e5ae7703ab956bbb2ed6bcd259c1c1b59ea8000b7391fdbe36a76cba4
Instruction ID: 8bde98623d259a892967f6c5ee29f39523b847ef8a48e204b09fc84336e00e3c
Opcode Fuzzy Hash: e3e7e67e5ae7703ab956bbb2ed6bcd259c1c1b59ea8000b7391fdbe36a76cba4
Instruction Fuzzy Hash: BE21F271A00109BEEB14ABB49C85DFEBB69FF06320F048619F825E76E1DF395809D621

Function 008D7B93 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 008D7C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 008D7C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 008D7C5F

Strings

msctls_updown32, xrefs: 008D7BC4
V, xrefs: 008D7C15, 008D7C34

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32$V
API String ID: 4014797782-1590291244
Opcode ID: 021d4b7a1195efac7770d763a0815468802194297f802d6ea1af2a0224d84c22
Instruction ID: 36acef72c112841f05bb05ecef6124ba79695b3c198c18790a49852fad080816
Opcode Fuzzy Hash: 021d4b7a1195efac7770d763a0815468802194297f802d6ea1af2a0224d84c22
Instruction Fuzzy Hash: D3216BB1214208AFDB10DF28DCC1DAA37ECFB5A364B15415AFA01DB3A1DB31EC01DA61

Function 008C182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 008C184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008C1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 008C18A2
InternetCloseHandle.WININET(00000000), ref: 008C18E9

Part of subcall function 008C2483: GetLastError.KERNEL32(?,?,008C1817,00000000,00000000,00000001), ref: 008C2498
Part of subcall function 008C2483: SetEvent.KERNEL32(?,?,008C1817,00000000,00000000,00000001), ref: 008C24AD

Strings

, xrefs: 008C1893

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: a7d5bcbb18fd530ab298abc5a1447fb913cb82b11891deee15d9df4192d0fd96
Instruction ID: 4d8a53bc8996293079d58b72ecd2fbf816277ea144a54b73df1f5ffe004be682
Opcode Fuzzy Hash: a7d5bcbb18fd530ab298abc5a1447fb913cb82b11891deee15d9df4192d0fd96
Instruction Fuzzy Hash: C7219AB1504208BFEB11AB648CC9FBB77BDFB49744F10412EF906E2241EA30CD04A7A1

Function 008DC498 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

GetCursorPos.USER32(?), ref: 008DC4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0088B9AB,?,?,?,?,?), ref: 008DC4E7
GetCursorPos.USER32(?), ref: 008DC534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0088B9AB,?,?,?), ref: 008DC56E

Strings

V, xrefs: 008DC504, 008DC53A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID: V
API String ID: 2864067406-4045069856
Opcode ID: fc67d378db98b688c27c3e7b7519701d2be02a41d731215b2220558f51f70524
Instruction ID: b7855407f1ab3e152d47d14395630939ecad2b442b869258007652316f4a2f4b
Opcode Fuzzy Hash: fc67d378db98b688c27c3e7b7519701d2be02a41d731215b2220558f51f70524
Instruction Fuzzy Hash: DF319135610418EFCB25CF98D858EEA7BB5FB49310F0442AAF905CB361CB31AD50EBA4

Function 008D63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00851D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00851D73
Part of subcall function 00851D35: GetStockObject.GDI32(00000011), ref: 00851D87
Part of subcall function 00851D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00851D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 008D6461
LoadLibraryW.KERNEL32(?), ref: 008D6468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 008D647D
DestroyWindow.USER32(?), ref: 008D6485

Strings

SysAnimate32, xrefs: 008D643C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: be6b023ed93edcf63f7ee5f9f14e685a6ed39cbf2bff1571b8705bdfd43a9327
Instruction ID: 7c0e6a877b8dd9410caf72adebaae83687a545139c8ebf75b5ef3503287fe3f5
Opcode Fuzzy Hash: be6b023ed93edcf63f7ee5f9f14e685a6ed39cbf2bff1571b8705bdfd43a9327
Instruction Fuzzy Hash: 26215B71200209AFEF104F64DC84EBB77AAFB59378F10872AFA50D2291E771DC61A764

Function 008B6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 008B6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 008B6DEF
GetStdHandle.KERNEL32(0000000C), ref: 008B6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 008B6E3B

Strings

nul, xrefs: 008B6E36

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 7ca8cb18d69d737cf029ee3a4b7b221719854ed372502a6763251b743711fff1
Instruction ID: dc71ddee926f03fbdd473a6d78f14b38cc884ea65053f4a4594c047ce0183031
Opcode Fuzzy Hash: 7ca8cb18d69d737cf029ee3a4b7b221719854ed372502a6763251b743711fff1
Instruction Fuzzy Hash: C621907460020AABDB209F29DC04ADA7BF4FF44720F244A29FDA1D73D0EB7599649B50

Function 008B6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 008B6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 008B6EBB
GetStdHandle.KERNEL32(000000F6), ref: 008B6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 008B6F06

Strings

nul, xrefs: 008B6F01

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 2ad0fa0076e3331231ab2249a2ffec3fce0c2450451b05c19be3f01029f9d994
Instruction ID: ddd342e483b2a8f62cd53141cae321697e875144eac8154b01cb101f548a8eab
Opcode Fuzzy Hash: 2ad0fa0076e3331231ab2249a2ffec3fce0c2450451b05c19be3f01029f9d994
Instruction Fuzzy Hash: 53215E796003059BDB209F69DC04AEA77A8FF45724F300A1AF9A1D73D0EB74E9618B61

Function 008BAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008BAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 008BACA8
__swprintf.LIBCMT ref: 008BACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,008DF910), ref: 008BACFF

Strings

%lu, xrefs: 008BACBB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: c32df718d4ca972b76ee13ee4cc468556035371b167fc0da91ba75fc8de96966
Instruction ID: 3785ab2b1e2fd7cab3c503c6c4bccad34d48892c9313a0ca1b54cbfdc52cc327
Opcode Fuzzy Hash: c32df718d4ca972b76ee13ee4cc468556035371b167fc0da91ba75fc8de96966
Instruction Fuzzy Hash: 75216070A00109AFCB10EF69CD45DEE7BB8FF49715B004069F909EB352DA31EA45DB22

Function 008B1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008B1B19

Strings

APPEND, xrefs: 008B1B52
KEYS, xrefs: 008B1B30
REMOVE, xrefs: 008B1B1F
EXISTS, xrefs: 008B1B41

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 2f09ab4eaba10166ef95599ebeba24eb10a97fc7771911c92c38c96bec5e16a3
Instruction ID: d4e9bcd66e34561a0d2996b0fdc16822c6d1dd1fc66f4e824ac23e0765e883fc
Opcode Fuzzy Hash: 2f09ab4eaba10166ef95599ebeba24eb10a97fc7771911c92c38c96bec5e16a3
Instruction Fuzzy Hash: 34113C709002189FCF00EF58D8668EEF7B4FF25704F5084A5E855EB6A6EB329906CF51

Function 008CEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 008CEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 008CEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 008CED6A
CloseHandle.KERNEL32(?), ref: 008CEDEB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 8c21a8d2e59fccb27de62ce91c81773b653a0810742eca707804b6aa17eb80f2
Instruction ID: b7274f99ec3bfe6f57c1e118109dc1aca21130c0594214388252d8a5d0b80d99
Opcode Fuzzy Hash: 8c21a8d2e59fccb27de62ce91c81773b653a0810742eca707804b6aa17eb80f2
Instruction Fuzzy Hash: 3B812C716007109FD760EF28C886F2AB7E5FF44721F14892DF99ADB292D7B0AD448B52

Function 008D0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008D0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008CFDAD,?,?), ref: 008D0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 008D00FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008D013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 008D0183
RegCloseKey.ADVAPI32(?,?), ref: 008D01AF
RegCloseKey.ADVAPI32(00000000), ref: 008D01BC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 8585c87933182f07ddc4b5e8d7d777bb3b70a1cd0f0a1de3cc83d75c813499d8
Instruction ID: 4178bb09fcad25ceb2ce2b553feb6c1ac1ee98461958131e4875518ed586102b
Opcode Fuzzy Hash: 8585c87933182f07ddc4b5e8d7d777bb3b70a1cd0f0a1de3cc83d75c813499d8
Instruction Fuzzy Hash: 35512D71204204AFD714EF68D881F6AB7E9FF84314F44491EF996C72A2DB31E905CB52

Function 008CD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 008CD927
GetProcAddress.KERNEL32(00000000,?), ref: 008CD9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 008CD9C6
GetProcAddress.KERNEL32(00000000,?), ref: 008CDA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 008CDA21

Part of subcall function 00855A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008B7896,?,?,00000000), ref: 00855A2C
Part of subcall function 00855A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008B7896,?,?,00000000,?,?), ref: 00855A50

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 6c6074cf411f5e575f17412f6f67831f68b9049a175c65812acf9a2e15db992d
Instruction ID: e18ab74a6526518d1e9235e26b9f1b99dd29b0a44c309aba7a1b96ebf4bfe618
Opcode Fuzzy Hash: 6c6074cf411f5e575f17412f6f67831f68b9049a175c65812acf9a2e15db992d
Instruction Fuzzy Hash: 0F51F675A00219DFCB00EFA8C4949A9BBF4FF09324B148169E95AEB212D730ED49CB51

Function 008BE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 008BE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 008BE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 008BE687

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 008BE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 008BE6B4

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: da406a80871cddb1a6611282804988acd54cdb1e6065601c7173b103d9d4cf0e
Instruction ID: a43d915e889ea9e1e068b23c9999a0d329177db1d87e4e707424070eceeeded8
Opcode Fuzzy Hash: da406a80871cddb1a6611282804988acd54cdb1e6065601c7173b103d9d4cf0e
Instruction Fuzzy Hash: 8C510635A00605DFCB01EF68C981AAABBF5FF09315B1480A9E849EB362CB31ED55DF51

Function 00852344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00852357
ScreenToClient.USER32(009157B0,?), ref: 00852374
GetAsyncKeyState.USER32(00000001), ref: 00852399
GetAsyncKeyState.USER32(00000002), ref: 008523A7

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6a09e59e916ea841a91d202d2b5101512afa2a84ad580a0001df2a670f06dd99
Instruction ID: 6bf12091d60d435ab812884885f4111fb302cd92793f2921930a8fb3d9455cc1
Opcode Fuzzy Hash: 6a09e59e916ea841a91d202d2b5101512afa2a84ad580a0001df2a670f06dd99
Instruction Fuzzy Hash: 1B418135604109FBCF259F68C844AE9BB74FB06365F20435AF829D22A1CB349D54DFA1

Function 008A63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008A63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 008A6433
TranslateMessage.USER32(?), ref: 008A645C
DispatchMessageW.USER32(?), ref: 008A6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008A6475

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 27da604325fe938ec530524858310b666ca1baf849b62e157e1a173b5437e098
Instruction ID: 9a7c59fe6b7aa42cd3cd0fd1748d8bb2c4e78eae794cbb253c4971366905ed0f
Opcode Fuzzy Hash: 27da604325fe938ec530524858310b666ca1baf849b62e157e1a173b5437e098
Instruction Fuzzy Hash: DB310531A06606EFEB20CF70DC44BF67BE8FB06300F194165E521C29A5F73594A9EB64

Function 008A8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008A8A30
PostMessageW.USER32(?,00000201,00000001), ref: 008A8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 008A8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 008A8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 008A8AF8

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 3e862b4057d0b297d3fffbd74f6be05f3fa40e42843f117693cc80f8a2ca93ed
Instruction ID: db885dac6197d65a2d48ac3c7f9224fe09d357f50bd4e3065c7ae46054d73f0f
Opcode Fuzzy Hash: 3e862b4057d0b297d3fffbd74f6be05f3fa40e42843f117693cc80f8a2ca93ed
Instruction Fuzzy Hash: C531E071500229EFEF14CFA8D94CA9E3BB5FB05315F10822AF925E65D1C7B0A910DBA1

Function 008AB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 008AB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 008AB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 008AB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 008AB27F
_wcsstr.LIBCMT ref: 008AB289

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 415dd6688248b28b6ac045188e823b2d4ae5a8b0bdf55ceebc9844c27a6c73f9
Instruction ID: 1111822000699b46f40871f1f291fe61d885ba098be08cb92c8343e728f5140c
Opcode Fuzzy Hash: 415dd6688248b28b6ac045188e823b2d4ae5a8b0bdf55ceebc9844c27a6c73f9
Instruction Fuzzy Hash: BA21F832205204BAFB155B799C45F7F7F98FF46720F00813AF909DA592EB61DC40A661

Function 008DB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

GetWindowLongW.USER32(?,000000F0), ref: 008DB192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 008DB1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 008DB1CF
GetSystemMetrics.USER32(00000004), ref: 008DB1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,008C0E90,00000000), ref: 008DB216

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 97999cc0b48d97c5ba986f83dfaeef8be762fcf3751a349ebaed6f546f833bfb
Instruction ID: 2d6eb9f4c6c8e53d9114eb7efea47c193983bb640799ae5249859a3d96117669
Opcode Fuzzy Hash: 97999cc0b48d97c5ba986f83dfaeef8be762fcf3751a349ebaed6f546f833bfb
Instruction Fuzzy Hash: CF219F72A14655EFCB109F38DC44A6A3BA4FB05361F16472AF932D72E0E7309810DB90

Function 008A9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 008A9320

Part of subcall function 00857BCC: _memmove.LIBCMT ref: 00857C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 008A9352
__itow.LIBCMT ref: 008A936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 008A9392
__itow.LIBCMT ref: 008A93A3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: b90779aa8f547fefa711e9412e5fd42b76a3eb5398d5ff68ea4870a8011d3289
Instruction ID: 3ff2cfdb4c4276fff2c41b0c517983952713891135fc907af97e7f1cb25aba52
Opcode Fuzzy Hash: b90779aa8f547fefa711e9412e5fd42b76a3eb5398d5ff68ea4870a8011d3289
Instruction Fuzzy Hash: 2F21F531705208ABEF109A649C89EAE7BBCFB5A720F049025FE85D73C1D6B0CD459793

Function 008C5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 008C5A6E
GetForegroundWindow.USER32 ref: 008C5A85
GetDC.USER32(00000000), ref: 008C5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 008C5ACD
ReleaseDC.USER32(00000000,00000003), ref: 008C5B08

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 02817b18385fd3487af9b59213cdc58a928473243d971501e8948033a6a2d79f
Instruction ID: 2920560fad459f72275b15e07c0d84924f91ea02e1f765904f91ef49d26d7087
Opcode Fuzzy Hash: 02817b18385fd3487af9b59213cdc58a928473243d971501e8948033a6a2d79f
Instruction Fuzzy Hash: 9F218E35A01114AFDB00EF69D884A9ABBF9FF48310F14C179E94AD7762CA30ED45DB91

Function 008512F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0085134D
SelectObject.GDI32(?,00000000), ref: 0085135C
BeginPath.GDI32(?), ref: 00851373
SelectObject.GDI32(?,00000000), ref: 0085139C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 9493ab3873ebd630ec6f95f8b9ffc7ea3a0c866d648649e29e0267765f066822
Instruction ID: 278395fa60e775b4999119927f9d2394f5767aa4f8768c2721cb78356e50a436
Opcode Fuzzy Hash: 9493ab3873ebd630ec6f95f8b9ffc7ea3a0c866d648649e29e0267765f066822
Instruction Fuzzy Hash: EC21AF30915A08EFDF10DF29DC087E97BA8FB40322F5682A6F811D62B1D7749895EF90

Function 008ABC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 008ABCB3
_memcmp.LIBCMT ref: 008ABCD1
_memcmp.LIBCMT ref: 008ABCE4
_memcmp.LIBCMT ref: 008ABCFC
_memcmp.LIBCMT ref: 008ABD14

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: bcdd9dd174739764ce9029ce789bec1bfb60075a9e0172b062efa409b78831b8
Instruction ID: 1db5227bdc43e085c5c969a39dc22b49d3cf7e106334b8aad3f4974c001f4268
Opcode Fuzzy Hash: bcdd9dd174739764ce9029ce789bec1bfb60075a9e0172b062efa409b78831b8
Instruction Fuzzy Hash: 9201C0712001097AE7046B1A9D82FBBA31DFF133A8F048020FE09D7B47EB54EE1092A5

Function 008B4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008B4ABA
__beginthreadex.LIBCMT ref: 008B4AD8
MessageBoxW.USER32(?,?,?,?), ref: 008B4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 008B4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 008B4B0A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: cb87b6bf8a2b3a032839472c58c3b59c3027ae808d266adc7de7ab4ba3c12f46
Instruction ID: 6200263dd586b4f142ccf31084771c2ba9ad072083261cc269efbba022bcc3eb
Opcode Fuzzy Hash: cb87b6bf8a2b3a032839472c58c3b59c3027ae808d266adc7de7ab4ba3c12f46
Instruction Fuzzy Hash: 6B114872A09208BFCB018FA8AC05ADF7FACFB84320F158366F925D3352D670C90097A0

Function 008A8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 008A821E
GetLastError.KERNEL32(?,008A7CE2,?,?,?), ref: 008A8228
GetProcessHeap.KERNEL32(00000008,?,?,008A7CE2,?,?,?), ref: 008A8237
HeapAlloc.KERNEL32(00000000,?,008A7CE2,?,?,?), ref: 008A823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 008A8255

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6bda8aa00375050e9f04e485b5f7147b3d01f73ec0fa971831bfbff4346a06f4
Instruction ID: 3a11dc85eb9c6d79b10e1fc9a0acdf7dd2ad9077ad9e3ca316de8e49a0683180
Opcode Fuzzy Hash: 6bda8aa00375050e9f04e485b5f7147b3d01f73ec0fa971831bfbff4346a06f4
Instruction Fuzzy Hash: 78016D71201204FFEB204FA5EC48D6B7BACFF8A755B50053AF90AC2220DA318D00DA70

Function 008A710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?,?,008A7455), ref: 008A7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?), ref: 008A7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?), ref: 008A7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?), ref: 008A7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008A7044,80070057,?,?), ref: 008A716C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 0c43ab50ad9cffedd8ec89b3338898655049224ca15820fa5ae3c5176a475f3c
Instruction ID: fdcb7adb101ed88e46243e6c357e87f0f31a62322a9f729631d1c07fb52a6912
Opcode Fuzzy Hash: 0c43ab50ad9cffedd8ec89b3338898655049224ca15820fa5ae3c5176a475f3c
Instruction Fuzzy Hash: 8D017C72602208ABEB114F64DC44BAE7BEDFB49792F144179FE05D2221E731DD40BBA0

Function 008B5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008B5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 008B526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 008B5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 008B5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008B52BC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 017918b63b94ff3749e237bd8a286fee4f177de23f3ce6ffe0ad59c5ca1d5e1b
Instruction ID: 65dae9cdb3dbbd917bed803c3f6970d914b48604fd1073d67612c49b28181c36
Opcode Fuzzy Hash: 017918b63b94ff3749e237bd8a286fee4f177de23f3ce6ffe0ad59c5ca1d5e1b
Instruction Fuzzy Hash: F2012931D02A1DDBCF00EFE8E949AEDBB78FB09711F400156EA42F2241CB705554D7A1

Function 008A810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 008A8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 008A812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008A813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 008A8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008A8157

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d0458cb45ec8b217d00ff072616611acb945388692c7f2ebc11da793be6a3b87
Instruction ID: 19c0f859f161d8359b1c24fe6485e7a326882d526becdea170f3b6f02d547ced
Opcode Fuzzy Hash: d0458cb45ec8b217d00ff072616611acb945388692c7f2ebc11da793be6a3b87
Instruction Fuzzy Hash: D5F04F71201304EFEB120FA5EC88E673BACFF4A754F040136FA86C6151DB619D41EA70

Function 008AC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 008AC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 008AC20E
MessageBeep.USER32(00000000), ref: 008AC226
KillTimer.USER32(?,0000040A), ref: 008AC242
EndDialog.USER32(?,00000001), ref: 008AC25C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 6d81acae7e3a58e6011b564ab0a5af6872250b81da5ad63fe8999e52c0327e1a
Instruction ID: 6092be29336c89cf747b7213265779a6da99d84108cafc7e8570450ecdf0d1f0
Opcode Fuzzy Hash: 6d81acae7e3a58e6011b564ab0a5af6872250b81da5ad63fe8999e52c0327e1a
Instruction Fuzzy Hash: CB01A230404308ABFB205B64ED4EF9677B8FF11B06F00466AB653E18E1DBE0A9449B90

Function 008513B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 008513BF
StrokeAndFillPath.GDI32(?,?,0088B888,00000000,?), ref: 008513DB
SelectObject.GDI32(?,00000000), ref: 008513EE
DeleteObject.GDI32 ref: 00851401
StrokePath.GDI32(?), ref: 0085141C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 1f1f6f2340b0b609ec6548410f44cde6833b4355c35778e0c978c1f0acb61b6d
Instruction ID: 505d455724178589acfe31de00b162d687e47e36d63cf0077e9582083f49b12b
Opcode Fuzzy Hash: 1f1f6f2340b0b609ec6548410f44cde6833b4355c35778e0c978c1f0acb61b6d
Instruction Fuzzy Hash: 9AF03C30119B08EBDB115F2AEC4C7983FA5F740366F4AC365E92A890F2C7344999EF10

Function 00862CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00870DB6: std::exception::exception.LIBCMT ref: 00870DEC
Part of subcall function 00870DB6: __CxxThrowException@8.LIBCMT ref: 00870E01

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 00857A51: _memmove.LIBCMT ref: 00857AAB

__swprintf.LIBCMT ref: 00862ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00862D66

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: e034847a3e4b71a02e1692c4d3ddcbd1db36d50599449b31f72242ec02eab499
Instruction ID: 9399db5172aede7795e67bfbec3af0306d5b3fe6892a87f77140e0a69ab11218
Opcode Fuzzy Hash: e034847a3e4b71a02e1692c4d3ddcbd1db36d50599449b31f72242ec02eab499
Instruction Fuzzy Hash: 62918C711086059FCB14EF28D895C6EBBA8FF85311F04496DF885DB2A2EA30ED48CB53

Function 008BB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00854750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00854743,?,?,008537AE,?), ref: 00854770

CoInitialize.OLE32(00000000), ref: 008BB9BB
CoCreateInstance.OLE32(008E2D6C,00000000,00000001,008E2BDC,?), ref: 008BB9D4
CoUninitialize.OLE32 ref: 008BB9F1

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

Strings

.lnk, xrefs: 008BB99D, 008BB9AB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 7076201049dda32957f105bd62a3ef7ec43e0ba6dea53fe6c568463b5f914923
Instruction ID: 5bc79b30b56382afdf2fbb0bfd7274a2b4d5fb59ee90f62a92a471beee02f797
Opcode Fuzzy Hash: 7076201049dda32957f105bd62a3ef7ec43e0ba6dea53fe6c568463b5f914923
Instruction Fuzzy Hash: 8DA135756042059FC700DF18C894D6ABBE5FF89324F148998F899DB3A2CB71ED49CB92

Function 0087501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008750AD

Part of subcall function 008800F0: __87except.LIBCMT ref: 0088012B

Strings

pow, xrefs: 00875085, 008750A2

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: e894573b2b00e567edfa771afcc54cfca5d2c79640e9d6897325b2474fcc7d38
Instruction ID: ef658c9b5637905908ce43289bad71648cb7c57dda536b04b69982b6b7a5bc95
Opcode Fuzzy Hash: e894573b2b00e567edfa771afcc54cfca5d2c79640e9d6897325b2474fcc7d38
Instruction Fuzzy Hash: B3514721A0CA0686DB51B728C84536E3B94FB41710F30CD59E4D9CA2ADEFB4CDD89F92

Function 00866192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00866248
_memmove.LIBCMT ref: 008662E4
_memset.LIBCMT ref: 00866308

Strings

ERCP, xrefs: 008661B3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 2e69c6768edeb7b2557c1e93e67a29fa9dd4aa06bd9401b4b3ddcf90441c1388
Instruction ID: 9ffb6ccdcf35b20bbc22ccdb3b0e43bf611a94308b9234ddc7f9dab63043657f
Opcode Fuzzy Hash: 2e69c6768edeb7b2557c1e93e67a29fa9dd4aa06bd9401b4b3ddcf90441c1388
Instruction Fuzzy Hash: E351AF71900349DFDB24CFA5C981BAABBE4FF44314F20856EE94ACB291E770EA54CB41

Function 008A97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008B14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008A9296,?,?,00000034,00000800,?,00000034), ref: 008B14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 008A983F

Part of subcall function 008B1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008A92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 008B14B1

Part of subcall function 008B13DE: GetWindowThreadProcessId.USER32(?,?), ref: 008B1409
Part of subcall function 008B13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,008A925A,00000034,?,?,00001004,00000000,00000000), ref: 008B1419
Part of subcall function 008B13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,008A925A,00000034,?,?,00001004,00000000,00000000), ref: 008B142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008A98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008A98F9

Strings

@, xrefs: 008A9911

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 19fa263714da4713f905aa99e9f433c4ba5255bcd6ffb276481e1995020cfd49
Instruction ID: ba8e4fcf579ff2bc4aa7e706846fd4a914fd783979889697e1cf18d53f4f29f2
Opcode Fuzzy Hash: 19fa263714da4713f905aa99e9f433c4ba5255bcd6ffb276481e1995020cfd49
Instruction Fuzzy Hash: 0A414F76901218BFDF10DFA4CC95ADEBBB8FB0A300F004199FA45B7291DA716E45CBA1

Function 008D7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,008DF910,00000000,?,?,?,?), ref: 008D79DF
GetWindowLongW.USER32 ref: 008D79FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 008D7A0C

Strings

SysTreeView32, xrefs: 008D79B1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: aa655f705e857b9479dc8d380b7e4f54d733b3c699161f83ea45e5b9f8929c92
Instruction ID: a295d88bc35008ca87504710f39b4866fafb31744f6ac0797971dc7ca6505b78
Opcode Fuzzy Hash: aa655f705e857b9479dc8d380b7e4f54d733b3c699161f83ea45e5b9f8929c92
Instruction Fuzzy Hash: 0431DE32204606AFDB118F38DC41BEA7BA9FB49334F244726F975E22E1E734E9519B50

Function 008D7A71 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 008D7B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 008D7B76

Strings

', xrefs: 008D7ACA
V, xrefs: 008D7B19

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend
String ID: '$V
API String ID: 3850602802-299079222
Opcode ID: 183d007c19e72c2b4076e11aefe6c5f1e3053e47c262723f16aea7746ded9120
Instruction ID: 67cf718b9ae166eaa0c97db52efd9aee2c51b53199d58de35601539b9af73644
Opcode Fuzzy Hash: 183d007c19e72c2b4076e11aefe6c5f1e3053e47c262723f16aea7746ded9120
Instruction Fuzzy Hash: 04410774A0521A9FDB14CF68C881BEEBBB5FB08314F11426AE905EB391E770A951CF90

Function 008D73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 008D7461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 008D7475
SendMessageW.USER32(?,00001002,00000000,?), ref: 008D7499

Strings

SysMonthCal32, xrefs: 008D742C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 5595ac5692887bd473d07661d7692fef6894f27a0a84a780b5f2e562cb5cefb8
Instruction ID: daee14dd93d1f44fc6901fe42ce331b267191813af63d6500b5035f86efbf9a0
Opcode Fuzzy Hash: 5595ac5692887bd473d07661d7692fef6894f27a0a84a780b5f2e562cb5cefb8
Instruction Fuzzy Hash: 1B219132500218AFDF128F54CC46FEA3B7AFB48724F110215FE15AB2D0EA75AC51DBA0

Function 008D6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 008D6D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 008D6D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 008D6D70

Strings

Listbox, xrefs: 008D6D08

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: aa0646ac99696bda622add6838dfca31d21317e9175e32bff11efd81eb72205f
Instruction ID: db116e841587efbe0bed633d9f146943e9fb769048d40f49f11a130c63778fcb
Opcode Fuzzy Hash: aa0646ac99696bda622add6838dfca31d21317e9175e32bff11efd81eb72205f
Instruction Fuzzy Hash: B021D03261111CBFDF118F54DC45EAB3BBAFF89760F018225FA41DB2A0DA719C619BA0

Function 008D770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 008D7772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 008D7787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 008D7794

Strings

msctls_trackbar32, xrefs: 008D7749

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 6da21b1dc161080eac3c02eb3f048dd6f079db402e08d585339713cb605f2ea5
Instruction ID: a454275bd1796f50e1f05eab50f36eb97ffb944c88b0e73e8d1c9fe9ea232708
Opcode Fuzzy Hash: 6da21b1dc161080eac3c02eb3f048dd6f079db402e08d585339713cb605f2ea5
Instruction Fuzzy Hash: BC11E372244208BEEF205F65CC05FEB77A9FF88B64F124629FA45E61D0D672E811DB20

Function 008DACCF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,009157B0,008DD809,000000FC,?,00000000,00000000,?,?,?,0088B969,?,?,?,?,?), ref: 008DACD1
GetFocus.USER32 ref: 008DACD9

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

Part of subcall function 008525DB: GetWindowLongW.USER32(?,000000EB), ref: 008525EC

SendMessageW.USER32(00EAE560,000000B0,000001BC,000001C0), ref: 008DAD4B

Strings

V, xrefs: 008DAD12, 008DAD23

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: V
API String ID: 3601265619-4045069856
Opcode ID: c94d3bb56497f88ec9438755e7608ce89753affd8e842e3a760d65f0165781c6
Instruction ID: fa0a052c164f389dece86915713145a9978e65d42a3ad16db97e8f553462901e
Opcode Fuzzy Hash: c94d3bb56497f88ec9438755e7608ce89753affd8e842e3a760d65f0165781c6
Instruction Fuzzy Hash: B80144312025009FC7159B28D898AA577E6FB8A321B29436AE516C77F1DB31AC46CB51

Function 00854C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00854BD0,?,00854DEF,?,009152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00854C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00854C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 00854C1D
kernel32.dll, xrefs: 00854C0C

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: b887d4a433579d1f0256fdfa42aa4f0a26e0bca9c2d1775fbcb674464ba0a8a7
Instruction ID: 0b970d2f9312974fcb46ee2a1b532b87ef4d6614e924a1c5cfe6a0cd670ee76a
Opcode Fuzzy Hash: b887d4a433579d1f0256fdfa42aa4f0a26e0bca9c2d1775fbcb674464ba0a8a7
Instruction Fuzzy Hash: 29D08230502713CFCB20AB71C808206BBE5FF09356B01883AA892C22A1E6B0C880CA10

Function 00854C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00854B83,?), ref: 00854C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00854C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 00854C50
kernel32.dll, xrefs: 00854C3F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8ea5416b07ba16756464acbd3b936e8dd0afca57321b591a29d3a46825fb04fb
Instruction ID: 5478bdb476d85c71f5ba3ee0f7f4cde86d9955bd122fa6ee042d51523e011094
Opcode Fuzzy Hash: 8ea5416b07ba16756464acbd3b936e8dd0afca57321b591a29d3a46825fb04fb
Instruction Fuzzy Hash: 53D0C730501713CFCB208F32C80824A73E4FF0035AB11883BAAA2C62A9E770C8C0CA10

Function 008D0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,008D1039), ref: 008D0DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 008D0E07

Strings

RegDeleteKeyExW, xrefs: 008D0E01
advapi32.dll, xrefs: 008D0DF0

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: f83abc4de3488b0da38ac78ab97c9d01d42570463dda1472bf3c5133bb50446e
Instruction ID: ac3cf1f1ffef8cbbb503d4ff4c34fe718f0f3ae39712cd08475fc60f1fbf91cf
Opcode Fuzzy Hash: f83abc4de3488b0da38ac78ab97c9d01d42570463dda1472bf3c5133bb50446e
Instruction Fuzzy Hash: 8DD0E270510722CFDB219B76C80868A77E9BF44356F158D2EA996D2292E6B0D8908A51

Function 008C90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,008C8CF4,?,008DF910), ref: 008C90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 008C9100

Strings

GetModuleHandleExW, xrefs: 008C90FA
kernel32.dll, xrefs: 008C90E9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 561eb218f59403d90999bfa98e8e45edd753efc92adc8ed6f1d58f41f4b9379b
Instruction ID: 2e88cc9bd597c4c2994e0e62a0cd0bc2d2bebc8bb1ed4a4f9f99e667124f801c
Opcode Fuzzy Hash: 561eb218f59403d90999bfa98e8e45edd753efc92adc8ed6f1d58f41f4b9379b
Instruction Fuzzy Hash: BFD0E234610713CFDB209B31E81DA0677E5BF05391B1A89BFE6D6D6690EA78C8809A90

Function 00891714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00891718
__swprintf.LIBCMT ref: 00891749

Strings

WIN_XPe, xrefs: 00891788
%.3d, xrefs: 00891723

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 9a52668d9c24145549b5723f2067a8cf539cce937693d939e96eaa77fa0446d6
Instruction ID: 87212d8722a070626737208c9cefcdc7f3f36e01213f09d63f1c0795cf027009
Opcode Fuzzy Hash: 9a52668d9c24145549b5723f2067a8cf539cce937693d939e96eaa77fa0446d6
Instruction Fuzzy Hash: 65D0127180D10FFECF40A7D0988C8B9737CF718709F580552B506D2085E2218754EA21

Function 008A717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89117ea2bfd3d2fc0a6cb66ffb7cc69991828f794ab20a2d0571b4e32a81d8fc
Instruction ID: 0e48d2626f63d2072b53bf7f2c469ac851887e73718e904cc8ad768ee6154148
Opcode Fuzzy Hash: 89117ea2bfd3d2fc0a6cb66ffb7cc69991828f794ab20a2d0571b4e32a81d8fc
Instruction Fuzzy Hash: 45C16E74A0421AEFDB14CFA4C884EAEBBB5FF49304B158598E806EB751D730DD81EB90

Function 008CE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 008CE0BE
CharLowerBuffW.USER32(?,?), ref: 008CE101

Part of subcall function 008CD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 008CD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 008CE301
_memmove.LIBCMT ref: 008CE314

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 145d130fb813b6e246736611ab55f921730612d07b4eb7af2ada37b3e672d8cd
Instruction ID: e0ff5119ed6f301511ffc7a777afc39634f557156203817d4fd0cad9361c914f
Opcode Fuzzy Hash: 145d130fb813b6e246736611ab55f921730612d07b4eb7af2ada37b3e672d8cd
Instruction Fuzzy Hash: 52C1F371A083019FC714DF28C481A6ABBE4FF89718F14896EF999DB351D731E946CB82

Function 008C8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008C80C3
CoUninitialize.OLE32 ref: 008C80CE

Part of subcall function 008AD56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 008AD5D4

VariantInit.OLEAUT32(?), ref: 008C80D9
VariantClear.OLEAUT32(?), ref: 008C83AA

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 20edd43c05354e77e6b21d061b490599d37eee58de070799014a8494995ba8af
Instruction ID: 3e1dff296976647285a0399d894db2a5dc7b520aa7e230d5f84997a56a790db0
Opcode Fuzzy Hash: 20edd43c05354e77e6b21d061b490599d37eee58de070799014a8494995ba8af
Instruction Fuzzy Hash: 18A1F135604701DFDB10DF68C885B2AB7E4FB89724F184459E99ADB3A1CB30E905CB82

Function 008A7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,008E2C7C,?), ref: 008A76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,008E2C7C,?), ref: 008A7702
CLSIDFromProgID.OLE32(?,?,00000000,008DFB80,000000FF,?,00000000,00000800,00000000,?,008E2C7C,?), ref: 008A7727
_memcmp.LIBCMT ref: 008A7748

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 651756e2ec6bd3a3a39bab3af2fbd5d8eb9baa9f3773d08dc6bb5ca746b37330
Instruction ID: 5a5300ced450d757a62a1db96aa437fae74a23012c1fcd1a6de74268e894691d
Opcode Fuzzy Hash: 651756e2ec6bd3a3a39bab3af2fbd5d8eb9baa9f3773d08dc6bb5ca746b37330
Instruction Fuzzy Hash: B4811D75A00109EFDB04DFA8C984EEEB7B9FF89315F204558E506EB250DB71AE06DB60

Function 008A687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008A688E
SysAllocString.OLEAUT32(00000000), ref: 008A6937
VariantCopy.OLEAUT32 ref: 008A6966
VariantClear.OLEAUT32(?), ref: 008A698D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 1ac52f62e58daad7ca537d3dee1d09073e8db6bd2493d4d3b1b2a6f1baa9db8c
Instruction ID: 7cc25f2078da8887abd56633ae04512667e914586064092473080fac0ea208c1
Opcode Fuzzy Hash: 1ac52f62e58daad7ca537d3dee1d09073e8db6bd2493d4d3b1b2a6f1baa9db8c
Instruction Fuzzy Hash: 0E51F874700305DAEB209F69C491A2AB7E5FF56314F28D81FE586D7A95FB34E850C702

Function 008A9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 008A9AD2
__itow.LIBCMT ref: 008A9B03

Part of subcall function 008A9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 008A9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 008A9B6C
__itow.LIBCMT ref: 008A9BC3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 0376426c8686b9a9c02cc51d877df3021a933a8baf13ea7b9de94bfe6cf2e0b8
Instruction ID: b0e0d93699568124f1de93103c2bf6eead1b59e343dbb3cf3a842fcdf524815f
Opcode Fuzzy Hash: 0376426c8686b9a9c02cc51d877df3021a933a8baf13ea7b9de94bfe6cf2e0b8
Instruction Fuzzy Hash: 2D41BF70A04218ABEF11EF58D845BEE7BB9FF45721F004029F945E3291DB709E49CBA2

Function 008C69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 008C69D1
WSAGetLastError.WSOCK32(00000000), ref: 008C69E1

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 008C6A45
WSAGetLastError.WSOCK32(00000000), ref: 008C6A51

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: aad16fb686806e0a61da3e07c8f500083ab9bccb486ea73f3bd990c6e4435911
Instruction ID: 61bb46e14c9284e5853610f058bde5e62c161cf42d63b1c683f0a9611f967970
Opcode Fuzzy Hash: aad16fb686806e0a61da3e07c8f500083ab9bccb486ea73f3bd990c6e4435911
Instruction Fuzzy Hash: 0C418175640210AFEB50AF28CC86F2A77E4FF04B14F048529FE59EF2D2DAB09D048B52

Function 008C641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,008DF910), ref: 008C64A7
_strlen.LIBCMT ref: 008C64D9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 71bdddd87124171a967cf07215c3adc035a2daa5f600d3b4a5e0e602b41c4328
Instruction ID: 52d8c9556687705e2411220f186a6bdebc94b011e09eeda05d98372e6298fece
Opcode Fuzzy Hash: 71bdddd87124171a967cf07215c3adc035a2daa5f600d3b4a5e0e602b41c4328
Instruction Fuzzy Hash: 1E418271900114ABCB14EBA8DC95FAEB7B9FF04310F248169F91AD7296EB30ED14CB52

Function 008BB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 008BB89E
GetLastError.KERNEL32(?,00000000), ref: 008BB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 008BB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 008BB915

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 19edec5b182ccc80c5d7820adc71e3f8a59aa0e5b307d67502d72e4b26383832
Instruction ID: 90ad31b77cba40fbaeb796f20df365494ad5b4cba8664f20d42defd89afe572d
Opcode Fuzzy Hash: 19edec5b182ccc80c5d7820adc71e3f8a59aa0e5b307d67502d72e4b26383832
Instruction Fuzzy Hash: EB41F935600910DFCB11EF19C485A59BBE1FF49310F198099ED8A9B362CB70FD05DB92

Function 008B0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 008B0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 008B0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 008B0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 008B0BFB

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f3c46a8f21885bb5e88aceb8b8d99b3b079e69a5d62b9ebe48eee6825dcf07e0
Instruction ID: d5faefa71ca806e51e4f4c962cf8e80acc5075921500e5a159f08e78fa2d2e8b
Opcode Fuzzy Hash: f3c46a8f21885bb5e88aceb8b8d99b3b079e69a5d62b9ebe48eee6825dcf07e0
Instruction Fuzzy Hash: D5313530D40618AEFB308B698C05BFBBBA9FB45338F08435AE591D22E2C77489449B52

Function 008B0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7608C0D0,?,00008000), ref: 008B0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 008B0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 008B0CE1
SendInput.USER32(00000001,?,0000001C,7608C0D0,?,00008000), ref: 008B0D33

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8b82d90599451ee13acbae1008e5d6ead3a7c3cfc1e9262c48a2f09dc99872db
Instruction ID: f705d0a1a741a57cd21807dce92152c13115c0173bc9a1821610a58ffa830cb6
Opcode Fuzzy Hash: 8b82d90599451ee13acbae1008e5d6ead3a7c3cfc1e9262c48a2f09dc99872db
Instruction Fuzzy Hash: F531463094021C6EFF308B698824BFFBF66FB45320F18431BE591D22D2C73599459B52

Function 008861C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008861FB
__isleadbyte_l.LIBCMT ref: 00886229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00886257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0088628D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: a76c9d4e9d1098800298bd3003a0495e2f5b76cef0540ca34a3bfdcdfdfca6c3
Instruction ID: aa12b2fbeba4a045cc699ff06a6ad462761610ffc6d7f8ae04ed39e4e52a2855
Opcode Fuzzy Hash: a76c9d4e9d1098800298bd3003a0495e2f5b76cef0540ca34a3bfdcdfdfca6c3
Instruction Fuzzy Hash: CC31D231600246EFDF22AF68CC48BAA7BA9FF41320F154169E824D7191E730E960D750

Function 008D4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 008D4F02

Part of subcall function 008B3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 008B365B
Part of subcall function 008B3641: GetCurrentThreadId.KERNEL32 ref: 008B3662
Part of subcall function 008B3641: AttachThreadInput.USER32(00000000,?,008B5005), ref: 008B3669

GetCaretPos.USER32(?), ref: 008D4F13
ClientToScreen.USER32(00000000,?), ref: 008D4F4E
GetForegroundWindow.USER32 ref: 008D4F54

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: a718a1d92c3a3a101b113ab622c209eddc4a05034ad3f3c7e4449f31bfa7658c
Instruction ID: a4533c880849f9da77547580dc55b1c361c2ad283cf4d87af273a50b724516a2
Opcode Fuzzy Hash: a718a1d92c3a3a101b113ab622c209eddc4a05034ad3f3c7e4449f31bfa7658c
Instruction Fuzzy Hash: DF312D71D00108AFDB00EFA9C8859EFB7F9FF99300F10416AE855E7241DB719E058BA1

Function 008A8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008A810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 008A8121
Part of subcall function 008A810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 008A812B
Part of subcall function 008A810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008A813A
Part of subcall function 008A810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 008A8141
Part of subcall function 008A810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008A8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 008A86A3
_memcmp.LIBCMT ref: 008A86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 008A86FC
HeapFree.KERNEL32(00000000), ref: 008A8703

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 2657961c42743efd20950869dbf70b97401f20b46dcc9066d038cc3d713f68eb
Instruction ID: 13a1a4827fd041ffad9c84de8e9c25fdf48e9e556c3d585ca9ae06fcf3160d6f
Opcode Fuzzy Hash: 2657961c42743efd20950869dbf70b97401f20b46dcc9066d038cc3d713f68eb
Instruction Fuzzy Hash: B3215771E41108EFEB10DFA8CA49BAEB7B8FF56305F158059E445EB241DB70AE05DBA0

Function 0087098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 008709AE

Part of subcall function 00855A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008B7896,?,?,00000000), ref: 00855A2C
Part of subcall function 00855A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008B7896,?,?,00000000,?,?), ref: 00855A50

_fprintf.LIBCMT ref: 008709E5
OutputDebugStringW.KERNEL32(?), ref: 008A5DBB

Part of subcall function 00874AAA: _flsall.LIBCMT ref: 00874AC3

__setmode.LIBCMT ref: 00870A1A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 9964691f762e83307b105874c0cd21b614edc53060652e0192b46405faf893b4
Instruction ID: 930133274974ea369ebf7f8aae4b514e5489febf07c053d1e120369f8fef6f76
Opcode Fuzzy Hash: 9964691f762e83307b105874c0cd21b614edc53060652e0192b46405faf893b4
Instruction Fuzzy Hash: 2D113D31504518AFDB04B3BC9C469FEB768FF46321F148165F509D7192EF3098459797

Function 008C1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 008C17A3

Part of subcall function 008C182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 008C184C
Part of subcall function 008C182D: InternetCloseHandle.WININET(00000000), ref: 008C18E9

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: e906f3630ad119017635f2a429679cbbb8be8bfd292088534cd75120f46ad9d0
Instruction ID: 0258df2fa0afe64124f54dfc61c137263f1442c1dc012481de15147232b9ca8c
Opcode Fuzzy Hash: e906f3630ad119017635f2a429679cbbb8be8bfd292088534cd75120f46ad9d0
Instruction Fuzzy Hash: 8621FF31204605BFEF128F608C84FBABBB9FF4A711F10412EFA05D6652DB31D810A7A0

Function 008B3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,008DFAC0), ref: 008B3A64
GetLastError.KERNEL32 ref: 008B3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 008B3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,008DFAC0), ref: 008B3ADF

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: f358c76b87bcfd9c45739853eb07ff3d85142d4448a4221943fd3b41eac37cbd
Instruction ID: b544186201968551238d4097043dfc3378c002f66bf2f693a3aee3ad947ffa2e
Opcode Fuzzy Hash: f358c76b87bcfd9c45739853eb07ff3d85142d4448a4221943fd3b41eac37cbd
Instruction Fuzzy Hash: 662194745086159F8700EF28D8818AA7BE4FF55368F245A1AF4AAC73A2D7319E49CB42

Function 008ADCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008AF0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,008ADCD3,?,?,?,008AEAC6,00000000,000000EF,00000119,?,?), ref: 008AF0CB
Part of subcall function 008AF0BC: lstrcpyW.KERNEL32(00000000,?,?,008ADCD3,?,?,?,008AEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008AF0F1
Part of subcall function 008AF0BC: lstrcmpiW.KERNEL32(00000000,?,008ADCD3,?,?,?,008AEAC6,00000000,000000EF,00000119,?,?), ref: 008AF122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,008AEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008ADCEC
lstrcpyW.KERNEL32(00000000,?,?,008AEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008ADD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,008AEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008ADD46

Strings

cdecl, xrefs: 008ADD3D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 8417cff34f9bbff529433f3ee01295d0b21fd03d2c6b7ef1458eecfa68865005
Instruction ID: 3c92a8a15c7cf314637aa94ecb689f1f9350b40ce7716117f9af6c907fc3ea4e
Opcode Fuzzy Hash: 8417cff34f9bbff529433f3ee01295d0b21fd03d2c6b7ef1458eecfa68865005
Instruction Fuzzy Hash: C211D03A200305EFEB259F74C845D7A77A8FF46310B40812AF906CB6A1EB71D841DB91

Function 008850E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00885101

Part of subcall function 0087571C: __FF_MSGBANNER.LIBCMT ref: 00875733
Part of subcall function 0087571C: __NMSG_WRITE.LIBCMT ref: 0087573A
Part of subcall function 0087571C: RtlAllocateHeap.NTDLL(00E90000,00000000,00000001,00000000,?,?,?,00870DD3,?), ref: 0087575F

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: ffe6892d8bd7dd35563be01b2ecbcdffb6d20b93ea6192c14f2eef99572282b2
Instruction ID: c8714fce08e191beadc0919d71b42e075eaed7594cf92cbc60bd838c5134db69
Opcode Fuzzy Hash: ffe6892d8bd7dd35563be01b2ecbcdffb6d20b93ea6192c14f2eef99572282b2
Instruction Fuzzy Hash: 60119E76A05A15AACB313F78AC4DB5E3B98FF043A1B10852AF909DA255DF30C940A792

Function 008C6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00855A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008B7896,?,?,00000000), ref: 00855A2C
Part of subcall function 00855A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008B7896,?,?,00000000,?,?), ref: 00855A50

gethostbyname.WSOCK32(?,?,?), ref: 008C6399
WSAGetLastError.WSOCK32(00000000), ref: 008C63A4
_memmove.LIBCMT ref: 008C63D1
inet_ntoa.WSOCK32(?), ref: 008C63DC

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 29e4c1cccf7de467289f45a4117dbec2962df420c3d10159916f35b21f9429a1
Instruction ID: 7f87e67610d04ea303cd75e0c0478a29e8a678f18537151b9769f5f6cdf91fe7
Opcode Fuzzy Hash: 29e4c1cccf7de467289f45a4117dbec2962df420c3d10159916f35b21f9429a1
Instruction Fuzzy Hash: C2111F71500109AFCB05EBA8DD96DAE7BB9FF04311B144179F906E7262DB30DE18DB62

Function 008A8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 008A8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 008A8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 008A8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 008A8BA4

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3a4555547afccd992a9e44b2f2f9cf725adb90629d2f65c29e955ae4f730ddcb
Instruction ID: fe3ae0acaf51a92e5e5ecb0a61adb76c7323535d25560025a8b73a2a75a8a1a7
Opcode Fuzzy Hash: 3a4555547afccd992a9e44b2f2f9cf725adb90629d2f65c29e955ae4f730ddcb
Instruction Fuzzy Hash: 55111C79901218FFEB11DF95CC85F9DBB74FB49710F204195EA00B7290DA716E11DBA4

Function 00851290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

DefDlgProcW.USER32(?,00000020,?), ref: 008512D8
GetClientRect.USER32(?,?), ref: 0088B5FB
GetCursorPos.USER32(?), ref: 0088B605
ScreenToClient.USER32(?,?), ref: 0088B610

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 3e1cc7599c06c285299052bca16cf84440f8c95471d47a72a8008e6a1da07e06
Instruction ID: 37822fefd4d9224e39aaae78d1358e267eee440871bec28a02b82529afcca9d4
Opcode Fuzzy Hash: 3e1cc7599c06c285299052bca16cf84440f8c95471d47a72a8008e6a1da07e06
Instruction Fuzzy Hash: F1111635601019FFCF10EF98D889AEE7BB8FB05306F504556EA02E7241C730AA55DBA6

Function 008B1142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008AFCED,?,008B0D40,?,00008000), ref: 008B115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,008AFCED,?,008B0D40,?,00008000), ref: 008B1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008AFCED,?,008B0D40,?,00008000), ref: 008B118E
Sleep.KERNEL32(?,?,?,?,?,?,?,008AFCED,?,008B0D40,?,00008000), ref: 008B11C1

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 4d572aa0431b5953ca54c861bd8cf5586224e8db663625c6e81fe4f16622c945
Instruction ID: 8a0a11e9d7ad18123412eff5f69c87cfa2f981ccb70f41cb183571156a61ec56
Opcode Fuzzy Hash: 4d572aa0431b5953ca54c861bd8cf5586224e8db663625c6e81fe4f16622c945
Instruction Fuzzy Hash: F5117C31C0151DEBCF009FA8D858AEEBB78FF09711F404156EA45FA241CB309554DBA5

Function 008AD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 008AD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 008AD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 008AD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 008AD897

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: be47d27817da569953b26ef618871c151f3d905a0c0981996ce1d8b51e1d6acc
Instruction ID: ee21761ae08feffde1d781dab72c696870c56fe689130d8c6c3bab602555547d
Opcode Fuzzy Hash: be47d27817da569953b26ef618871c151f3d905a0c0981996ce1d8b51e1d6acc
Instruction Fuzzy Hash: E8118E71602309DBF3208F50DC08F97BBBCFB01B00F10897AAA17C6851D7B8E509ABA1

Function 00886FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00886FDB

Part of subcall function 008876C2: __fltout2.LIBCMT ref: 008876EB

__cftog_l.LIBCMT ref: 00887001
__cftoe_l.LIBCMT ref: 00887033

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: bd706b9b218ec539ccc5ca0e706d6a53f509a6ff9ce1fedd6eb895edc81a99c1
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: F0014B7244854EBBCF266E88CC41CEE3F72FB28355B688415FA1898031D236C9B1AB81

Function 008DB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008DB2E4
ScreenToClient.USER32(?,?), ref: 008DB2FC
ScreenToClient.USER32(?,?), ref: 008DB320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 008DB33B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d0cf3aadddc54672f252c95aa8a87d35e0e601b51ea29bc149f74b0aa84d6b7d
Instruction ID: e5f5bc16bcb0b849871f9e2bd519f79a90e0d9930ef0f379e12c6808e02e44da
Opcode Fuzzy Hash: d0cf3aadddc54672f252c95aa8a87d35e0e601b51ea29bc149f74b0aa84d6b7d
Instruction Fuzzy Hash: 3E1143B9D00209EFDB41CFA9D8849EEBBF9FB18310F108166E915E3720D735AA559F50

Function 008DB635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008DB644
_memset.LIBCMT ref: 008DB653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00916F20,00916F64), ref: 008DB682
CloseHandle.KERNEL32 ref: 008DB694

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 6f724e06134d3317a7303cdfecab5b03dd0a5cfc6ceea2d19c09e572155818e3
Instruction ID: 20160f0000ad293d25a37ca5274fb2fff10c75a04b735c09f59cdd8de644b8bd
Opcode Fuzzy Hash: 6f724e06134d3317a7303cdfecab5b03dd0a5cfc6ceea2d19c09e572155818e3
Instruction Fuzzy Hash: B7F05EB2A55304BAE2202765BC06FFB3F9DFB08395F408021BA09E53A2D7718C01D7A9

Function 008B6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 008B6BE6

Part of subcall function 008B76C4: _memset.LIBCMT ref: 008B76F9

_memmove.LIBCMT ref: 008B6C09
_memset.LIBCMT ref: 008B6C16
LeaveCriticalSection.KERNEL32(?), ref: 008B6C26

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: e684028a61dbe2f6dd8ffb5b600c19956d1b2d7a2a9bb0551af26fff6fd73590
Instruction ID: 404021f7d51869b510654ab52bb4a9ceea58c5787cb74ae52959e94c65c59e6d
Opcode Fuzzy Hash: e684028a61dbe2f6dd8ffb5b600c19956d1b2d7a2a9bb0551af26fff6fd73590
Instruction Fuzzy Hash: 21F05E3A200200ABCF016F59DC85A8ABF29FF45321F04C061FE099E22BCB31E911DBB5

Function 00852218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00852231
SetTextColor.GDI32(?,000000FF), ref: 0085223B
SetBkMode.GDI32(?,00000001), ref: 00852250
GetStockObject.GDI32(00000005), ref: 00852258
GetWindowDC.USER32(?,00000000), ref: 0088BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0088BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0088BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0088BEC2
GetPixel.GDI32(00000000,?,?), ref: 0088BEE2
ReleaseDC.USER32(?,00000000), ref: 0088BEED

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 17a70b822d8f522d801d05a2766ec6fa1fd7142500ddf23bd4c8a57bae556b45
Instruction ID: 505c8985398371830779ce4a6a76352b7404cf79c0df56f7d499f44831730e0c
Opcode Fuzzy Hash: 17a70b822d8f522d801d05a2766ec6fa1fd7142500ddf23bd4c8a57bae556b45
Instruction Fuzzy Hash: 14E03932144244AADF225FA4FC0D7D83B20FB45332F048367FB6A880E287714980EB12

Function 008A8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 008A871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,008A82E6), ref: 008A8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,008A82E6), ref: 008A872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,008A82E6), ref: 008A8736

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: ae22ce3e3dc81a2e3407c9d0a94be78e05ab1e13148532d5476f8f129e688ca2
Instruction ID: 1cad5c310ae1152a773718d1cfef18be136adccd3e3674b8f7384a5fb2cb913d
Opcode Fuzzy Hash: ae22ce3e3dc81a2e3407c9d0a94be78e05ab1e13148532d5476f8f129e688ca2
Instruction Fuzzy Hash: 8DE08636612211DBE7205FF15D0CB5A3BACFF51792F158829B346CA041DB348841D760

Function 008AB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 008AB4BE

Strings

Container, xrefs: 008AB43B
AutoIt3GUI, xrefs: 008AB436

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: db6ea5fed574b24a5940a0e07f91f809d609b319f71e7cdedc23d898cf1f463f
Instruction ID: c7e30f920cdb0ff9958fe3856689db45a0a6ed7caaec4004c34548faa79c343b
Opcode Fuzzy Hash: db6ea5fed574b24a5940a0e07f91f809d609b319f71e7cdedc23d898cf1f463f
Instruction Fuzzy Hash: 49913A70600701EFEB24DF68C884A6ABBE5FF49714F24856DE94ACB792DB71E841CB50

Function 008BAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0086FC86: _wcscpy.LIBCMT ref: 0086FCA9

Part of subcall function 00859837: __itow.LIBCMT ref: 00859862
Part of subcall function 00859837: __swprintf.LIBCMT ref: 008598AC

__wcsnicmp.LIBCMT ref: 008BB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 008BB0F6

Strings

LPT, xrefs: 008BB027

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: fce3cdb2cdaee06aed6d5d0031cb91239b06294b4c4df4aa7b101325f597d828
Instruction ID: 333b981b907b45d3159440a1fc699d1671b27bf26472b1dd747a553dff862270
Opcode Fuzzy Hash: fce3cdb2cdaee06aed6d5d0031cb91239b06294b4c4df4aa7b101325f597d828
Instruction Fuzzy Hash: F3614B75A00619AFCB14EF98C891EEEB7B4FB08310F144069F956EB391D770AE85CB51

Function 00862957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00862968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00862981

Strings

@, xrefs: 00862975

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 786581014ac68a904b32e4101bee689ad675264d683bca9955027a8b972183ff
Instruction ID: 20b98a87368ae3bc628486b7e8eda1c7cf777e0ae3f7a13ecbcf9d0481cc035f
Opcode Fuzzy Hash: 786581014ac68a904b32e4101bee689ad675264d683bca9955027a8b972183ff
Instruction Fuzzy Hash: 465144725087449BD320AF24D886BABBBE8FB85341F41885EF6D9811A1DB70852CCB67

Function 008B9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00854F0B: __fread_nolock.LIBCMT ref: 00854F29

_wcscmp.LIBCMT ref: 008B9824
_wcscmp.LIBCMT ref: 008B9837

Strings

FILE, xrefs: 008B9770

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 3cb2d1b539b05470d460cb90e104cb5b24319dbed3ba5765fdb6c6e14916bb75
Instruction ID: 4a49c39d11fe11d3eaf5a8dac122463c3ff7fe5352e2060b62e1420bba4e0777
Opcode Fuzzy Hash: 3cb2d1b539b05470d460cb90e104cb5b24319dbed3ba5765fdb6c6e14916bb75
Instruction Fuzzy Hash: 1541C971A00209BADF209EA8CC45FEFBBBDFF85714F004479FA45E7281DA7199458B61

Function 008C258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008C259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 008C25D4

Strings

|, xrefs: 008C25A5

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: b6bc13fb4a345665add9aba31487ee9c4593fb738364669a21f4e832dfb2073c
Instruction ID: e5c20f348c4923b3a6f5f94fd985da862e4b350d8bd5a648e18ba230013e726d
Opcode Fuzzy Hash: b6bc13fb4a345665add9aba31487ee9c4593fb738364669a21f4e832dfb2073c
Instruction Fuzzy Hash: BF310771800119EBCF11EFA8DC85EEEBFB9FF18310F104069FD15A6162EA319A56DB61

Function 008D6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 008D6B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 008D6B53

Strings

static, xrefs: 008D6AB3

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 9f8cfd22192038dfd49dac55e0ee137224e6142084e8fb28133ea6fdb2fd53f6
Instruction ID: fe4da53e62c23d3b5a74f3764a03c6ec6c58f6cc17b964b275de88a8cd2a6e4f
Opcode Fuzzy Hash: 9f8cfd22192038dfd49dac55e0ee137224e6142084e8fb28133ea6fdb2fd53f6
Instruction Fuzzy Hash: 33317071200608AEDB109F68CC41BFB77B9FF48760F10861AF9A5D7290DB35AC51D760

Function 008B28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008B2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008B294C

Strings

0, xrefs: 008B290A

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 6afb2ef1689dbd72cd7a4d066448bc244c23834ce4725eaa276c120273c9e845
Instruction ID: f7b0d5768893b93babacd7112f9494439b063f43f063b1873077ea1420b19b49
Opcode Fuzzy Hash: 6afb2ef1689dbd72cd7a4d066448bc244c23834ce4725eaa276c120273c9e845
Instruction Fuzzy Hash: BF31C131A003099BEB25CF58D885FEEBFB8FF45354F144069E989E62A1D7709941CB52

Function 008C39E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 008C3A66

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Strings

AUTOITCALLVARIABLE%d, xrefs: 008C3A58
, $, xrefs: 008C3AA6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 953c5d038141e916c9b06144e55af7de42202d626ed2629be815432373a8ac9a
Instruction ID: 892c90e27c68b2192e76e50dc34e2e8c9622fde536bbe2a2c3b11ac51e7b225a
Opcode Fuzzy Hash: 953c5d038141e916c9b06144e55af7de42202d626ed2629be815432373a8ac9a
Instruction Fuzzy Hash: AC218E31700629AECF10EF68DC82EAE77B5FF44300F008459E985EB181DA30EA56CB66

Function 008516DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

Part of subcall function 008525DB: GetWindowLongW.USER32(?,000000EB), ref: 008525EC

GetParent.USER32(?), ref: 0088B7BA
DefDlgProcW.USER32(?,00000133,?,?,?,?,?,?,?,?,008519B3,?,?,?,00000006,?), ref: 0088B834

Strings

V, xrefs: 0085172A, 0088B7D9, 0088B800

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LongWindow$ParentProc
String ID: V
API String ID: 2181805148-4045069856
Opcode ID: 6fc749ee2fcbb94efe375cd7371d230f9e05c12c81ccc260cdd41eb6c3773c23
Instruction ID: 549c5955e7b4f885d462f2d08722a4c36b57d6b60ddbebef0e2c66544259bf01
Opcode Fuzzy Hash: 6fc749ee2fcbb94efe375cd7371d230f9e05c12c81ccc260cdd41eb6c3773c23
Instruction Fuzzy Hash: 9C219534201508AFCF209B2CC889EA93BE6FF8E321F554250F9259B2F6C7315E55DB50

Function 008D66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 008D6761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008D676C

Strings

Combobox, xrefs: 008D672E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: cffedd779694798541315922fec4436bd4bf8fcf815509963b2261a33377d038
Instruction ID: 7f75b95c9c6bac352cf844c0e5c74783090267d033d60d70989a2866c5e3742f
Opcode Fuzzy Hash: cffedd779694798541315922fec4436bd4bf8fcf815509963b2261a33377d038
Instruction Fuzzy Hash: E7115E7530020CAFEF119E54DC81EAB376AFB983A8F11432AF914D7291E6759C6197A0

Function 008D96F3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

V, xrefs: 008D971B

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-4045069856
Opcode ID: 6b321841c151f5657fa8f141b0c9ab36c32f3eb8a8cbe45bf491a78d29ba1ca1
Instruction ID: 11ec029d88bfcee6062d2c8fa9926042b42c12475f7b813e3fb8511b7c9d4e75
Opcode Fuzzy Hash: 6b321841c151f5657fa8f141b0c9ab36c32f3eb8a8cbe45bf491a78d29ba1ca1
Instruction Fuzzy Hash: 9E217F35224208BFEB108F59CC45FFA37A4FB09324F404266FA96DB2E1D671E950EB60

Function 008D6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00851D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00851D73
Part of subcall function 00851D35: GetStockObject.GDI32(00000011), ref: 00851D87
Part of subcall function 00851D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00851D91

GetWindowRect.USER32(00000000,?), ref: 008D6C71
GetSysColor.USER32(00000012), ref: 008D6C8B

Strings

static, xrefs: 008D6C4E

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 14d0fa61a4874e0d2b842ad91d7e745c10dd64062721f602f2250d39c7f17f93
Instruction ID: a3ad28dfd2b453ac32083ee361a127716c783c25b407a85ce40b96673800db1e
Opcode Fuzzy Hash: 14d0fa61a4874e0d2b842ad91d7e745c10dd64062721f602f2250d39c7f17f93
Instruction Fuzzy Hash: 21212972620209AFDF04DFA8DC45EEA7BB8FB08315F01462AFD95D2251E735E860DB60

Function 008D678B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 008D67AA
CreatePopupMenu.USER32 ref: 008D6828

Strings

V, xrefs: 008D6802, 008D683D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CreateMenuPopup
String ID: V
API String ID: 3826294624-4045069856
Opcode ID: 4b4c0c01c20df59395d8f10d2965635211ebfdf6f6269b85c547c29906a0af10
Instruction ID: 3fdb501234f4c58c273e1dd788b32fa50a7ced8bd922cdfc759eaae7d4b877a2
Opcode Fuzzy Hash: 4b4c0c01c20df59395d8f10d2965635211ebfdf6f6269b85c547c29906a0af10
Instruction Fuzzy Hash: B8213B7860060DDFCB20DF28C444BD677E1FB89324F49866AE85A8B391E731AC66DF51

Function 008D6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 008D69A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 008D69B1

Strings

edit, xrefs: 008D6986

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f8ece0d3a9fb1aaf4bb04b3393c8ecd49a4e7836366fe68e69cebaae7b24f99e
Instruction ID: c862ef6c9efc5e7fa547a0db13ac725ad1731bebffd7397bf6858ace1e30d52a
Opcode Fuzzy Hash: f8ece0d3a9fb1aaf4bb04b3393c8ecd49a4e7836366fe68e69cebaae7b24f99e
Instruction Fuzzy Hash: 19119D71100108BBEB108E749C50AEB3B69FB05378F514726F9A1D62E0D731DC60A760

Function 008B29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008B2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 008B2A41

Strings

0, xrefs: 008B2A18

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: be01220f1fa28a2b90b2cf843926ce7dab0e27f982f6d02ea8b1192d1271dcb4
Instruction ID: bdfb60a17da0ab5a85b978f64dafa4d910cef4591d489f8f8772db3451b7d19c
Opcode Fuzzy Hash: be01220f1fa28a2b90b2cf843926ce7dab0e27f982f6d02ea8b1192d1271dcb4
Instruction Fuzzy Hash: D511D332A05128EBCB31EA5CDC44BDA77B9FB85314F055121E955E73A0D730AD0AC792

Function 008C21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 008C222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 008C2255

Strings

<local>, xrefs: 008C221D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: cbeeab8b53e3ee2f39c4acb84aa2f0b3e2a498b76917a2bc9ef8a0a157a8fdb9
Instruction ID: 0b728dace8a36985084d57613f45ddff9b0bbe8b111a7a2e81fd299c73e3e1ce
Opcode Fuzzy Hash: cbeeab8b53e3ee2f39c4acb84aa2f0b3e2a498b76917a2bc9ef8a0a157a8fdb9
Instruction Fuzzy Hash: 2C11A070641225BADB258F558C84FFBFBB8FF16765F10822EFA5586080D270A990D6F0

Function 008D84E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 008D8530

Strings

V, xrefs: 008D8509

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: MessageSend
String ID: V
API String ID: 3850602802-4045069856
Opcode ID: e84eb4212505584cb05181fbfef8390b874709fabb4b327e9035f097bb662281
Instruction ID: 8d88f05439351df3bebd668f3aa62516f4e65cfd3fcefa504dbe704b7b8ad9ff
Opcode Fuzzy Hash: e84eb4212505584cb05181fbfef8390b874709fabb4b327e9035f097bb662281
Instruction Fuzzy Hash: 7221C475600209EFCB15CF98E841CEA7BB5FB4C350B014295FD06E7360DA31AD61DB90

Function 00852327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

V, xrefs: 0088BF21, 0088BF47

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-4045069856
Opcode ID: 078ba1faba5bf765e479c51def6cf61515c7a49195b8d6edc92ac8576e87ff4c
Instruction ID: b98349ad60719459c7b0829ac1168da8bf2aa176cea2b1da53f98d39b4261511
Opcode Fuzzy Hash: 078ba1faba5bf765e479c51def6cf61515c7a49195b8d6edc92ac8576e87ff4c
Instruction Fuzzy Hash: 4F111934604604EFCB209F28D841A957BE6FB99320F158269EA699B3A0C771ED45DF90

Function 008A8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008AAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 008A8E73

Strings

ComboBox, xrefs: 008A8E12
ListBox, xrefs: 008A8E3D

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 873c6740d0787c6dab8361d734da68334db2828db8b6dbca1e4458246e0de9b3
Instruction ID: 47539cb14911d44bf50cebccd2bedbf69a9b51e617bfe7f6022c7146985ab87a
Opcode Fuzzy Hash: 873c6740d0787c6dab8361d734da68334db2828db8b6dbca1e4458246e0de9b3
Instruction Fuzzy Hash: 0001F5B1A01228EBDB14EBA8CC518FE7768FF02320B004A19FC21E76E1DE35681CC661

Function 008A8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008AAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 008A8D6B

Strings

ComboBox, xrefs: 008A8D0A
ListBox, xrefs: 008A8D35

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: c3d65f50d0d8169434595a913cc40a08b4fe953f45434fc2bfb168481e5429b0
Instruction ID: db28d47d850e8ca896977dc78c9014731973b98f4596b6227ee4b564ea1e5032
Opcode Fuzzy Hash: c3d65f50d0d8169434595a913cc40a08b4fe953f45434fc2bfb168481e5429b0
Instruction Fuzzy Hash: 3401D4B1A41108ABEB14EBE4C956AFE77A8EF16310F104019BC02A7AE1DE155E0CD272

Function 008A8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00857DE1: _memmove.LIBCMT ref: 00857E22

Part of subcall function 008AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008AAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 008A8DEE

Strings

ComboBox, xrefs: 008A8D8F
ListBox, xrefs: 008A8DBA

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: b8c041688c3e5f2a9fec0f8ff7c27350afaf6a69fd3c2cb26041454d9a16b384
Instruction ID: 1877ba746dc73ca704f3069676d51bc5a4a8a1b2f2b51598ed346404837cbbff
Opcode Fuzzy Hash: b8c041688c3e5f2a9fec0f8ff7c27350afaf6a69fd3c2cb26041454d9a16b384
Instruction Fuzzy Hash: CB01A7B1A41109ABEB15E6A8D956AFE77A8EF12310F108015BC05F7AD2DE155E0CD272

Function 008DC57D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00852612: GetWindowLongW.USER32(?,000000EB), ref: 00852623

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,0088B93A,?,?,?), ref: 008DC5F1

Part of subcall function 008525DB: GetWindowLongW.USER32(?,000000EB), ref: 008525EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 008DC5D7

Strings

V, xrefs: 008DC5B6

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: V
API String ID: 982171247-4045069856
Opcode ID: c83156ec239b9e6393fc9345ac6503ed2c62acf321b4c4d990b460fb8acff069
Instruction ID: 91b04711e299197e2aedbada950b69452aeca640fcd2b39c04a0c5003db30610
Opcode Fuzzy Hash: c83156ec239b9e6393fc9345ac6503ed2c62acf321b4c4d990b460fb8acff069
Instruction Fuzzy Hash: 2D01D831201205EBCB255F18EC44E6A3BB6FF85364F154766FA529B3E1CF31A841EB51

Function 008B4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 008B4F46
_wcscmp.LIBCMT ref: 008B4F58

Strings

#32770, xrefs: 008B4F52

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 8bc1518a1e0bfd652694d4a5470c9d06ed817e2e6d2613a74c9ef71f4fff4f4c
Instruction ID: a9132e9df063882f5b38acb69d82f4841d63879f55d0b1fbde529cf6f92d00de
Opcode Fuzzy Hash: 8bc1518a1e0bfd652694d4a5470c9d06ed817e2e6d2613a74c9ef71f4fff4f4c
Instruction Fuzzy Hash: EDE09232A042282AD7209A99AC4AAE7FBACFB85B60F000167FD44D3151D9709A45C7E1

Function 0088B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0088B314: _memset.LIBCMT ref: 0088B321

Part of subcall function 00870940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0088B2F0,?,?,?,0085100A), ref: 00870945

IsDebuggerPresent.KERNEL32(?,?,?,0085100A), ref: 0088B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0085100A), ref: 0088B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0088B2FE

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 93cca50f7e23bcc1737b1365a19df60ae55272114816115e1606bfa1cd54cd6c
Instruction ID: 655d7dfc61198441d8b85ff1df90b46e147f6ff37c2f60d2bff854a65ba39908
Opcode Fuzzy Hash: 93cca50f7e23bcc1737b1365a19df60ae55272114816115e1606bfa1cd54cd6c
Instruction Fuzzy Hash: 35E06D70200701CBD760EF68D8043467BE4FF40304F118A2DEA56C7352E7B4D408CBA1

Function 00891935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00891775

Part of subcall function 008CBFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0089195E,?), ref: 008CBFFE
Part of subcall function 008CBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 008CC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0089196D

Strings

WIN_XPe, xrefs: 00891788

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 6abd4401ca41fce89c08ec6a1c0868f929c8aeb04ca4ef78c0efe00d2ef20f2e
Instruction ID: 19aee2d081846bd9632f465c56befb1cba3c6635849beccfcea18daa91075fc8
Opcode Fuzzy Hash: 6abd4401ca41fce89c08ec6a1c0868f929c8aeb04ca4ef78c0efe00d2ef20f2e
Instruction Fuzzy Hash: 62F0AC7081510AEFDF15EB95C988AEC77F8FB18305F580099E102E2595D7714F44DF61

Function 008D5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008D59AE
PostMessageW.USER32(00000000), ref: 008D59B5

Part of subcall function 008B5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008B52BC

Strings

Shell_TrayWnd, xrefs: 008D59A7

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 5602e9069cea72308efc52860a04d30312e3e05bbde1ae5c18c94290dcc166f5
Instruction ID: 724c765ebb84bdeed8e4ff92f2adee06d628b297c4e23946796af520d9ae48a5
Opcode Fuzzy Hash: 5602e9069cea72308efc52860a04d30312e3e05bbde1ae5c18c94290dcc166f5
Instruction Fuzzy Hash: BCD0C9313823117AEAA4BB70AC0BFD76724BB54B50F040926B346EA1D1C9E0A800CA58

Function 008D5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008D596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 008D5981

Part of subcall function 008B5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008B52BC

Strings

Shell_TrayWnd, xrefs: 008D5967

Memory Dump Source

Source File: 00000000.00000002.1499514941.0000000000851000.00000020.00000001.01000000.00000003.sdmp, Offset: 00850000, based on PE: true

Associated: 00000000.00000002.1499494684.0000000000850000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.00000000008DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499570304.0000000000904000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499634116.000000000090E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1499689476.0000000000917000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_850000_R55-RFQ.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: a7cedb48ef5c3cdb9354bd9a28f56dc1d88ca7c467650d314a18a5da9fb2ee35
Instruction ID: 0ce270d97d3f6aee6871b2c5bb6f80fabc8efd044654717f9c64c4afbebe3ecf
Opcode Fuzzy Hash: a7cedb48ef5c3cdb9354bd9a28f56dc1d88ca7c467650d314a18a5da9fb2ee35
Instruction Fuzzy Hash: 80D0C935385311BAEAA4BB70AC1BFD76B24BB50B50F040926B34AAA1D1C9E09800CA54

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report R55-RFQ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut46B.tmp

C:\Users\user\AppData\Local\Temp\phagocytosed

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

Windows Analysis Report
R55-RFQ.exe

Function 00853B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 008549A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00854E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 008B9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 0085301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 00853041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 0085708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00853A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00853633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00853766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 01055A08 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 008539D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 010557C8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147
fileCOMMON

Function 0085407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 0087541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre