Edit tour

Windows Analysis Report
1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Overview

General Information

Sample name:	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe
Analysis ID:	1575960
MD5:	5b74ba5d3f7a0aff3dea2d3ae9bb1a59
SHA1:	e872b3d30b3da56ac0cafb905087d595c129d73b
SHA256:	b84745937d020b9750842b35590589aadf47153c995f266a3f44dae8b1ff51d8
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious sample

Found API chain indicative of debugger detection

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe (PID: 7396 cmdline: "C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe" MD5: 5B74BA5D3F7A0AFF3DEA2D3AE9BB1A59)

WMIC.exe (PID: 7644 cmdline: wmic os get Name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7756 cmdline: wmic cpu get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 7880 cmdline: wmic path win32_VideoController get name MD5: E2DE6500DE1148C7F6027AD50AC8B891)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 31.13.224.69, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, Initiated: true, ProcessId: 7396, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49738

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T12:24:54.644862+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	52.17.181.189	443	TCP
2024-12-16T12:24:56.660990+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	34.117.59.81	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://xweb.ddns.net:8080

Avira URL Cloud: Label: malware

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.8% probability

Machine Learning detection for sample

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Joe Sandbox ML: detected

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown	HTTPS traffic detected: 52.17.181.189:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 4x nop then jmp 001515A0h		0_2_001716A0
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 4x nop then jmp 001515A0h		0_2_00171651

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 31.13.224.69:8080

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: checkip.amazonaws.com
Source: unknown	DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 52.17.181.189:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 34.117.59.81:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: checkip.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: ipinfo.io
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 452Host: xscapezo.capetown:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 452Host: xscapezo.capetown:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 452Host: xscapezo.capetown:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 452Host: xscapezo.capetown:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 452Host: xscapezo.capetown:8080

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: checkip.amazonaws.com
Source: global traffic	HTTP traffic detected: GET /country HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: ipinfo.io

Source: global traffic	DNS traffic detected: DNS query: checkip.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: xscapezo.capetown

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 452Host: xscapezo.capetown:8080

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.000000000165C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3347288009.000000000165C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3347288009.000000000160C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3047079705.000000000160C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.2747266956.000000000160C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/)x
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/-
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/4
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3047079705.000000000160C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/;
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/?
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080/l
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:80802.40
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xscapezo.capetown:8080on3Microsoft
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xweb.ddns.net:8080
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xweb.ddns.net:80806WinHttp.WinHttpRequest.5.16WinHttp.WinHttpRequest.5.16WinHttp.WinHttpReque
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xweb.ddns.net:80807http://xscapezo.capetown:8080
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F0000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkip.amazonaws.com/
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/country
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/countryt
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887871602.0000000001611000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/countryxSd
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/country443/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown	HTTPS traffic detected: 52.17.181.189:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00159029	0_2_00159029
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0016587C	0_2_0016587C
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00168129	0_2_00168129
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001583A5	0_2_001583A5
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00159CAD	0_2_00159CAD
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00164CD7	0_2_00164CD7
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015AF50	0_2_0015AF50
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015E078	0_2_0015E078
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001660C9	0_2_001660C9
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015AA69	0_2_0015AA69
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001714D0	0_2_001714D0
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015ED20	0_2_0015ED20
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0016B610	0_2_0016B610
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0016CE7D	0_2_0016CE7D
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015F6B7	0_2_0015F6B7

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: String function: 00153DB2 appears 44 times

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal64.evad.winEXE@10/0@3/3

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: 0_2_0015AF50 CoInitialize,GetActiveObject,CoCreateInstance,CoGetObject,SysFreeString,VariantClear,

0_2_0015AF50

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7768:120:WilError_03
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\J1NXL04D3R_V3

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe "C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe"
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Name	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32

Jump to behavior

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: 0_2_001515A0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001515A0

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0016587C push esi; mov dword ptr [esp], 0017C140h	0_2_0016573B
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00164CD7 push edx; mov dword ptr [esp], eax	0_2_00165486
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00164CD7 push ecx; mov dword ptr [esp], eax	0_2_00165493
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00154831 push edx; mov dword ptr [esp], 0017C140h	0_2_00154869
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00156029 push edx; mov dword ptr [esp], edi	0_2_0015604A
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00156029 push edi; mov dword ptr [esp], 0017C140h	0_2_00156078
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001660C9 push esi; mov dword ptr [esp], 0017C140h	0_2_0016573B
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00156150 push eax; mov dword ptr [esp], 0017C140h	0_2_0015617F
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00184273 push esp; ret	0_2_0018427A
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015AA69 push ecx; mov dword ptr [esp], 00000000h	0_2_0015AC11
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015AA69 push eax; mov dword ptr [esp], edi	0_2_0015AC5A
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0018031B push D1DD3004h; retf	0_2_00180320
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00183B03 pushad ; ret	0_2_00183B0A
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001663DF push esi; mov dword ptr [esp], 0017C140h	0_2_0016573B
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00183CB0 push ecx; ret	0_2_00183CDA
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001844F1 push es; ret	0_2_001844F4
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001574EF push eax; mov dword ptr [esp], 0017C140h	0_2_00157521
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015BD1C push ebx; mov dword ptr [esp], 0017C140h	0_2_0015BD5A
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015A508 push edx; mov dword ptr [esp], 0017C140h	0_2_0015A555
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00183D39 push edi; ret	0_2_00183D44
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0018252F push edx; ret	0_2_00182536
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015754B push eax; mov dword ptr [esp], 0017C140h	0_2_00157588
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001665BC push esi; mov dword ptr [esp], 0017C140h	0_2_0016573B
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0018469A push ecx; ret	0_2_0018469B
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015A6B5 push eax; mov dword ptr [esp], 0017C140h	0_2_0015A6EB
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00156F34 push eax; mov dword ptr [esp], 0017C140h	0_2_00156F85
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_0015BF56 push ebx; mov dword ptr [esp], 0017C140h	0_2_0015BF84
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00156FB3 push eax; mov dword ptr [esp], 0017C140h	0_2_00156FF5

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: AUTORUNSC.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: REGMON.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: HOOKEXPLORER.EXEP
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE0!I
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: AUTORUNS.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe TID: 7560	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe TID: 7564	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe TID: 7560	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe TID: 7400	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe TID: 8080	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Name FROM WIN32_PROCESSOR

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Thread delayed: delay time: 30000

Jump to behavior

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW```

Source: C:\Windows\SysWOW64\wbem\WMIC.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep

graph_0-18329

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: 0_2_0016587C Sleep,IsDebuggerPresent,

0_2_0016587C

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: 0_2_001515A0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001515A0

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_001728AE RemoveVectoredExceptionHandler,AddVectoredExceptionHandler,RtlAddVectoredExceptionHandler,TlsGetValue,CloseHandle,CloseHandle,TlsSetValue,CloseHandle,CloseHandle,TlsSetValue,CloseHandle,	0_2_001728AE
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00151148 GetStartupInfoA,_amsg_exit,_initterm,SetUnhandledExceptionFilter,__p__acmdln,__initenv,exit,_cexit,	0_2_00151148
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00151189 _amsg_exit,_initterm,SetUnhandledExceptionFilter,__p__acmdln,__initenv,exit,_cexit,	0_2_00151189
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Code function: 0_2_00151207 _initterm,_initterm,SetUnhandledExceptionFilter,__p__acmdln,__initenv,exit,_cexit,	0_2_00151207

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic os get Name	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic cpu get name	Jump to behavior
Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic path win32_VideoController get name	Jump to behavior

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: 0_2_00164227 CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CreateFileW,GetLastError,CreateFileW,GetLastError,

0_2_00164227

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Code function: 0_2_00175168 GetSystemTimeAsFileTime,

0_2_00175168

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: tcpview.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lordpe.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: autoruns.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe
Source: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: regmon.exe

Source: C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\securitycenter2 : SELECT displayName FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	121 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	241 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	121 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	4 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	11%	ReversingLabs
1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://xscapezo.capetown:8080/?	0%	Avira URL Cloud	safe
http://xweb.ddns.net:80807http://xscapezo.capetown:8080	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080on3Microsoft	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080/4	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080/;	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080/l	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080/)x	0%	Avira URL Cloud	safe
http://xscapezo.capetown:80802.40	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080/-	0%	Avira URL Cloud	safe
http://xweb.ddns.net:80806WinHttp.WinHttpRequest.5.16WinHttp.WinHttpRequest.5.16WinHttp.WinHttpReque	0%	Avira URL Cloud	safe
http://xscapezo.capetown:8080/	0%	Avira URL Cloud	safe
http://xweb.ddns.net:8080	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
checkip.eu-west-1.prod.check-ip.aws.a2z.com	52.17.181.189	true	false	high
ipinfo.io	34.117.59.81	true	false	high
xscapezo.capetown	31.13.224.69	true	false	high
checkip.amazonaws.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/country	false		high
https://checkip.amazonaws.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://xscapezo.capetown:8080on3Microsoft	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xweb.ddns.net:80807http://xscapezo.capetown:8080	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xscapezo.capetown:8080/?	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xscapezo.capetown:8080/;	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3047079705.000000000160C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xscapezo.capetown:8080	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xscapezo.capetown:8080/4	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/countryt	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ipinfo.io:443/country443/	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xscapezo.capetown:8080/-	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xscapezo.capetown:8080/l	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xscapezo.capetown:80802.40	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/countryxSd	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887742930.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1887871602.0000000001611000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.1869312955.0000000001612000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xscapezo.capetown:8080/)x	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xscapezo.capetown:8080/	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015D7000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.000000000165C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3347288009.000000000165C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015EE000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541594269.00000000015F8000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3347288009.000000000160C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.3047079705.000000000160C000.00000004.00000020.00020000.00000000.sdmp, 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000003.2747266956.000000000160C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xweb.ddns.net:80806WinHttp.WinHttpRequest.5.16WinHttp.WinHttpRequest.5.16WinHttp.WinHttpReque	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xweb.ddns.net:8080	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe, 00000000.00000002.3541491548.0000000001490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.13.224.69	xscapezo.capetown	Bulgaria	48584	SARNICA-ASBG	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
52.17.181.189	checkip.eu-west-1.prod.check-ip.aws.a2z.com	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575960
Start date and time:	2024-12-16 12:23:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@10/0@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 32 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
31.13.224.69	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	xscapezo.capetown:8080/
31.13.224.69	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	xscapezo.capetown:8080/
34.117.59.81	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	ipinfo.io/json
	Code%20Send%20meta%20Discord%20EXE.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, RedLine, Stealc, Vidar	Browse	34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	file.exe	Get hash	malicious	Invicta Stealer, XWorm	Browse	34.117.59.81
	http://enteolcl.top/	Get hash	malicious	Unknown	Browse	34.117.59.81
	Product Blueprint..html	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	dYUteuvmHn.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://drive.google.com/file/d/1yoYdaJg2olHzjqEKXjn6nnXKPPak7HoL/view?usp=sharing_eil&ts=675747b9	Get hash	malicious	Unknown	Browse	34.117.59.81
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse	34.117.59.81
xscapezo.capetown	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	31.13.224.69
	ugisGK1R1q.exe	Get hash	malicious	DarkVision Rat	Browse	31.13.224.69
	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	31.13.224.69
checkip.eu-west-1.prod.check-ip.aws.a2z.com	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	54.74.44.6
	Evjm8L1nEb.exe	Get hash	malicious	Unknown	Browse	52.49.226.227
	exe028.exe	Get hash	malicious	AgentTesla	Browse	34.247.132.162
	exe028.exe	Get hash	malicious	Unknown	Browse	63.32.212.245
	setup.exe	Get hash	malicious	Unknown	Browse	3.248.31.219
	1.cmd	Get hash	malicious	Unknown	Browse	54.77.225.185
	2.cmd	Get hash	malicious	Unknown	Browse	18.203.170.139
	fL271NVAru.exe	Get hash	malicious	Unknown	Browse	34.245.248.194
	fL271NVAru.exe	Get hash	malicious	Unknown	Browse	54.72.227.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	main_mips.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	sh4.elf	Get hash	malicious	Mirai	Browse	13.61.153.114
	main_arm5.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	arm4.elf	Get hash	malicious	Mirai	Browse	52.25.126.226
	main_sh4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	ppc.elf	Get hash	malicious	Mirai	Browse	54.253.166.233
	i686.elf	Get hash	malicious	Mirai	Browse	54.119.189.16
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	PAYMENT RECEIPT.html	Get hash	malicious	HTMLPhisher	Browse	13.227.8.110
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	mdPov8VTwi.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	arm6.elf	Get hash	malicious	Unknown	Browse	34.117.135.65
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
	armv5l.elf	Get hash	malicious	Unknown	Browse	34.119.157.208
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	34.117.188.166
SARNICA-ASBG	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	93.123.109.208

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	h.html	Get hash	malicious	Unknown	Browse	34.117.59.81 52.17.181.189
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.117.59.81 52.17.181.189
	UUH30xVTpr.exe	Get hash	malicious	LummaC, Stealc	Browse	34.117.59.81 52.17.181.189
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	34.117.59.81 52.17.181.189
	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	34.117.59.81 52.17.181.189
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	34.117.59.81 52.17.181.189
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	34.117.59.81 52.17.181.189
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	34.117.59.81 52.17.181.189
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	34.117.59.81 52.17.181.189

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.2915290015918925
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe
File size:	231'936 bytes
MD5:	5b74ba5d3f7a0aff3dea2d3ae9bb1a59
SHA1:	e872b3d30b3da56ac0cafb905087d595c129d73b
SHA256:	b84745937d020b9750842b35590589aadf47153c995f266a3f44dae8b1ff51d8
SHA512:	1f4fb6efb04f3b4c57b92271996bd7008462660cd51ed6ee5144c2e073c3d090e11864ce0963ab996030b174400581699bc35d3566d2cd54a6e7137fa82114b5
SSDEEP:	3072:PtjlDNJxzpxhot+5XDTzcsNsEYwszSHRGhYlW5SQUxk5ja:Pp+tErcslYZYw9QkU
TLSH:	EA340815E202C4B5C43356B6998ED5A7A610BF3681239D0FBECE0F58F336B01592E76B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....>g...............$..........................@.................................W.....@... ............................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4010ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x673EE9D5 [Thu Nov 21 08:05:41 2024 UTC]
TLS Callbacks:	0x41a51c, 0x41a5b3, 0x4228ae
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	12964e2649ce9036e2a1286774ae86cc

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [ebp-0Ch], 000000FFh
mov dword ptr [004382E0h], 00000001h
call 00007F82086C51B1h
mov dword ptr [ebp-0Ch], eax
mov eax, dword ptr [ebp-0Ch]
leave
ret
push ebp
mov ebp, esp
sub esp, 18h
mov dword ptr [ebp-0Ch], 000000FFh
mov dword ptr [004382E0h], 00000000h
call 00007F82086C518Dh
mov dword ptr [ebp-0Ch], eax
mov eax, dword ptr [ebp-0Ch]
leave
ret
lea ecx, dword ptr [esp+04h]
and esp, FFFFFFF0h
push dword ptr [ecx-04h]
push ebp
mov ebp, esp
push ecx
sub esp, 00000094h
mov dword ptr [ebp-0Ch], 00000000h
mov dword ptr [ebp-10h], 00000000h
mov dword ptr [esp+08h], 00000044h
mov dword ptr [esp+04h], 00000000h
lea eax, dword ptr [ebp-7Ch]
mov dword ptr [esp], eax
call 00007F82086E4976h
mov eax, dword ptr [004382E0h]
test eax, eax
je 00007F82086C5192h
lea eax, dword ptr [ebp-7Ch]
mov dword ptr [esp], eax
mov eax, dword ptr [00439278h]
call eax
sub esp, 04h
mov dword ptr [ebp-18h], 00000000h
mov dword ptr [ebp-20h], 00000018h
mov eax, dword ptr [ebp-20h]
mov eax, dword ptr fs:[eax]
mov dword ptr [ebp-24h], eax
mov eax, dword ptr [ebp-24h]
mov eax, dword ptr [eax+04h]
mov dword ptr [ebp-1Ch], eax
mov dword ptr [ebp-14h], 00000000h
jmp 00007F82086C51A4h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x39000	0xd2c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c000	0x224	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3d000	0x1974	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x306c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39230	0x1e0	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2a684	0x2a800	f192cbeafafbd036787705e45cd5893c	False	0.43780445772058824	data	6.144924956418916	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x2c000	0x26c	0x400	cd4faee918b6d039163459e9ae43b365	False	0.2353515625	Matlab v4 mat-file (little endian) \240\326B, numeric, rows 0, columns 0, imaginary	1.8158646800282847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x2d000	0x4d74	0x4e00	26a00dcabd068bb3c2a6c5d84f4dd568	False	0.4118088942307692	data	5.844738930570382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x32000	0x5a54	0x5c00	cecdba5a38cd979b609cc7ed770370a6	False	0.3012058423913043	data	4.87734250713647	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x38000	0xd60	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x39000	0xd2c	0xe00	b35ff9b62b16a100bd2cc076e9eec51e	False	0.38253348214285715	data	5.085846307423846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x3a000	0x38	0x200	be43b8407ee9c03eea15b7f75f778714	False	0.072265625	data	0.3195396310293397	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x3b000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c000	0x224	0x400	607703b05b5f04b5884d9f6aa2c5cda8	False	0.3056640625	data	3.4103687270366034	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x3d000	0x1974	0x1a00	bcf6e1b200c8178aaf8164efda0e1e90	False	0.8143028846153846	data	6.667293120350955	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x3c058	0x1ca	XML 1.0 document, ASCII text, with very long lines (456), with CRLF line terminators	English	United States	0.5764192139737991

Imports

DLL	Import
KERNEL32.dll	AddVectoredExceptionHandler, CloseHandle, CreateEventA, CreateSemaphoreA, DeleteCriticalSection, DuplicateHandle, EnterCriticalSection, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetHandleInformation, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetProcessAffinityMask, GetStartupInfoA, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, IsDebuggerPresent, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, OpenProcess, OutputDebugStringA, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReleaseSemaphore, RemoveVectoredExceptionHandler, ResetEvent, ResumeThread, SetEvent, SetLastError, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SetUnhandledExceptionFilter, Sleep, SuspendThread, TlsAlloc, TlsGetValue, TlsSetValue, TryEnterCriticalSection, VirtualAlloc, VirtualFree, VirtualProtect, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _endthreadex, _errno, _fileno, _initterm, _iob, _lock, _onexit, _setjmp3, _setmode, _strdup, _ultoa, _unlock, _vsnprintf, _vsnwprintf, _wfopen, _wgetenv, abort, atoi, calloc, exit, fclose, fflush, fgetwc, fprintf, fputc, free, fwrite, getc, localeconv, longjmp, malloc, memchr, memcmp, memcpy, memmove, memset, printf, realloc, setlocale, setvbuf, signal, strchr, strerror, strlen, strncmp, vfprintf, wcslen
USER32.dll	MessageBoxA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T12:24:54.644862+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	52.17.181.189	443	TCP
2024-12-16T12:24:56.660990+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	34.117.59.81	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 12:24:53.226515055 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:53.226577997 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:53.226910114 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:53.231164932 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:53.231182098 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:54.644562960 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:54.644861937 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:54.659754038 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:54.659811974 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:54.660238028 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:54.729815006 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:54.775325060 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:55.142071962 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:55.142142057 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:55.142339945 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:55.243721008 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:55.243721008 CET	49731	443	192.168.2.4	52.17.181.189
Dec 16, 2024 12:24:55.243791103 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:55.243824959 CET	443	49731	52.17.181.189	192.168.2.4
Dec 16, 2024 12:24:55.433432102 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:55.433461905 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:55.433983088 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:55.434262991 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:55.434276104 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:56.660903931 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:56.660990000 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:56.663379908 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:56.663393021 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:56.663667917 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:56.665359974 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:56.711327076 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:57.111772060 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:57.111948967 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:57.112046957 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:57.112282038 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:57.112302065 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:24:57.112313986 CET	49733	443	192.168.2.4	34.117.59.81
Dec 16, 2024 12:24:57.112322092 CET	443	49733	34.117.59.81	192.168.2.4
Dec 16, 2024 12:25:31.624236107 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:25:31.744564056 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:25:31.744735003 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:25:31.745007038 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:25:31.745042086 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:25:31.865653992 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:25:31.865811110 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:25:33.021675110 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:25:33.074651957 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:26:03.046371937 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:26:03.046372890 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:26:03.166333914 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:26:03.166344881 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:26:03.550230026 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:26:03.606090069 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:26:33.561984062 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:26:33.561985016 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:26:33.682096958 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:26:33.682133913 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:26:33.964381933 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:26:34.012490034 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:27:03.970740080 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:27:03.970740080 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:27:04.091169119 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:27:04.091218948 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:27:04.372456074 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:27:04.418741941 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:27:34.391093016 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:27:34.391093016 CET	49738	8080	192.168.2.4	31.13.224.69
Dec 16, 2024 12:27:34.511518002 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:27:34.511569023 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:27:34.786112070 CET	8080	49738	31.13.224.69	192.168.2.4
Dec 16, 2024 12:27:34.840749979 CET	49738	8080	192.168.2.4	31.13.224.69

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 12:24:53.079062939 CET	58527	53	192.168.2.4	1.1.1.1
Dec 16, 2024 12:24:53.218168020 CET	53	58527	1.1.1.1	192.168.2.4
Dec 16, 2024 12:24:55.292742014 CET	56195	53	192.168.2.4	1.1.1.1
Dec 16, 2024 12:24:55.431827068 CET	53	56195	1.1.1.1	192.168.2.4
Dec 16, 2024 12:25:31.380153894 CET	55002	53	192.168.2.4	1.1.1.1
Dec 16, 2024 12:25:31.623167038 CET	53	55002	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 12:24:53.079062939 CET	192.168.2.4	1.1.1.1	0x2f0c	Standard query (0)	checkip.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:24:55.292742014 CET	192.168.2.4	1.1.1.1	0x546c	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:25:31.380153894 CET	192.168.2.4	1.1.1.1	0x3e47	Standard query (0)	xscapezo.capetown	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 12:24:53.218168020 CET	1.1.1.1	192.168.2.4	0x2f0c	No error (0)	checkip.amazonaws.com	checkip.check-ip.aws.a2z.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 12:24:53.218168020 CET	1.1.1.1	192.168.2.4	0x2f0c	No error (0)	checkip.check-ip.aws.a2z.com	checkip.eu-west-1.prod.check-ip.aws.a2z.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 12:24:53.218168020 CET	1.1.1.1	192.168.2.4	0x2f0c	No error (0)	checkip.eu-west-1.prod.check-ip.aws.a2z.com		52.17.181.189	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:24:53.218168020 CET	1.1.1.1	192.168.2.4	0x2f0c	No error (0)	checkip.eu-west-1.prod.check-ip.aws.a2z.com		18.202.169.9	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:24:53.218168020 CET	1.1.1.1	192.168.2.4	0x2f0c	No error (0)	checkip.eu-west-1.prod.check-ip.aws.a2z.com		54.195.26.29	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:24:55.431827068 CET	1.1.1.1	192.168.2.4	0x546c	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Dec 16, 2024 12:25:31.623167038 CET	1.1.1.1	192.168.2.4	0x3e47	No error (0)	xscapezo.capetown		31.13.224.69	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

checkip.amazonaws.com

ipinfo.io

xscapezo.capetown:8080

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49738	31.13.224.69	8080	7396	C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 12:25:31.745007038 CET	225	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 452 Host: xscapezo.capetown:8080
Dec 16, 2024 12:25:33.021675110 CET	167	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 11:25:32 GMT Content-Length: 50 Content-Type: text/plain; charset=utf-8 Data Raw: 36 65 39 38 61 34 63 35 34 62 62 38 63 30 31 65 38 36 37 37 63 37 39 30 34 64 38 65 39 32 62 62 32 33 61 31 64 39 65 34 63 61 65 35 66 64 34 64 30 36 Data Ascii: 6e98a4c54bb8c01e8677c7904d8e92bb23a1d9e4cae5fd4d06
Dec 16, 2024 12:26:03.046371937 CET	225	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 452 Host: xscapezo.capetown:8080
Dec 16, 2024 12:26:03.550230026 CET	167	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 11:26:03 GMT Content-Length: 50 Content-Type: text/plain; charset=utf-8 Data Raw: 36 65 39 38 61 34 63 35 34 62 62 38 63 30 31 65 38 36 37 37 63 37 39 30 34 64 38 65 39 32 62 62 32 33 61 31 64 39 65 34 63 61 65 35 66 64 34 64 30 36 Data Ascii: 6e98a4c54bb8c01e8677c7904d8e92bb23a1d9e4cae5fd4d06
Dec 16, 2024 12:26:33.561984062 CET	225	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 452 Host: xscapezo.capetown:8080
Dec 16, 2024 12:26:33.964381933 CET	167	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 11:26:33 GMT Content-Length: 50 Content-Type: text/plain; charset=utf-8 Data Raw: 36 65 39 38 61 34 63 35 34 62 62 38 63 30 31 65 38 36 37 37 63 37 39 30 34 64 38 65 39 32 62 62 32 33 61 31 64 39 65 34 63 61 65 35 66 64 34 64 30 36 Data Ascii: 6e98a4c54bb8c01e8677c7904d8e92bb23a1d9e4cae5fd4d06
Dec 16, 2024 12:27:03.970740080 CET	225	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 452 Host: xscapezo.capetown:8080
Dec 16, 2024 12:27:04.372456074 CET	167	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 11:27:04 GMT Content-Length: 50 Content-Type: text/plain; charset=utf-8 Data Raw: 36 65 39 38 61 34 63 35 34 62 62 38 63 30 31 65 38 36 37 37 63 37 39 30 34 64 38 65 39 32 62 62 32 33 61 31 64 39 65 34 63 61 65 35 66 64 34 64 30 36 Data Ascii: 6e98a4c54bb8c01e8677c7904d8e92bb23a1d9e4cae5fd4d06
Dec 16, 2024 12:27:34.391093016 CET	225	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 452 Host: xscapezo.capetown:8080
Dec 16, 2024 12:27:34.786112070 CET	167	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 11:27:34 GMT Content-Length: 50 Content-Type: text/plain; charset=utf-8 Data Raw: 36 65 39 38 61 34 63 35 34 62 62 38 63 30 31 65 38 36 37 37 63 37 39 30 34 64 38 65 39 32 62 62 32 33 61 31 64 39 65 34 63 61 65 35 66 64 34 64 30 36 Data Ascii: 6e98a4c54bb8c01e8677c7904d8e92bb23a1d9e4cae5fd4d06

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	52.17.181.189	443	7396	C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 11:24:54 UTC	187	OUT	GET / HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: checkip.amazonaws.com
2024-12-16 11:24:55 UTC	237	IN	HTTP/1.1 200 Date: Mon, 16 Dec 2024 11:24:54 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 13 Connection: close Server: nginx Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers
2024-12-16 11:24:55 UTC	13	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 0a Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	34.117.59.81	443	7396	C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 11:24:56 UTC	182	OUT	GET /country HTTP/1.1 Connection: Keep-Alive Content-Type: application/json Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: ipinfo.io
2024-12-16 11:24:57 UTC	448	IN	HTTP/1.1 200 OK access-control-allow-origin: * Content-Length: 3 content-type: text/html; charset=utf-8 date: Mon, 16 Dec 2024 11:24:56 GMT referrer-policy: strict-origin-when-cross-origin x-content-type-options: nosniff x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-16 11:24:57 UTC	3	IN	Data Raw: 55 53 0a Data Ascii: US

Analysis Process: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exePID: 7396, Parent PID: 2580

General

Target ID:	0
Start time:	06:24:35
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe"
Imagebase:	0x150000
File size:	231'936 bytes
MD5 hash:	5B74BA5D3F7A0AFF3DEA2D3AE9BB1A59
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:24:55
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic os get Name
Imagebase:	0x820000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:24:55
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:24:57
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic cpu get name
Imagebase:	0x820000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:24:57
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:24:58
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic path win32_VideoController get name
Imagebase:	0x980000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:24:58
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exePID: 7396, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	43.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	99

Executed Functions

Function 00164CD7 Relevance: 21.7, APIs: 7, Strings: 5, Instructions: 674COMMON

Download Yara Rule

APIs

Part of subcall function 00155C7F: MultiByteToWideChar.KERNEL32 ref: 00155CD0
Part of subcall function 00155C7F: MultiByteToWideChar.KERNEL32 ref: 00155D17

CoInitialize.OLE32 ref: 00164FE0
SysFreeString.OLEAUT32 ref: 00165050
SysFreeString.OLEAUT32 ref: 0016509A
VariantClear.OLEAUT32 ref: 00165364
SysFreeString.OLEAUT32(00000000), ref: 0016547C
SysFreeString.OLEAUT32 ref: 00165489
SysFreeString.OLEAUT32 ref: 00165496

Strings

COMError, xrefs: 00165166, 00165648
invoke, xrefs: 00165173, 00165618, 00165655
COMException, xrefs: 001654C3, 0016560B
, xrefs: 00164F60
com.nim, xrefs: 0016516B, 00165610, 0016564D

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: FreeString$ByteCharMultiWide$ClearInitializeVariant
String ID: $COMError$COMException$com.nim$invoke
API String ID: 3707380375-1182642905
Opcode ID: d62c234410b63160738b8452864292ccc418296d098138251cf7d0e9287c6f9f
Instruction ID: 5928d5e232fd961b972f291a4b78e0b1df6a9f85fd048e9f7ddbb0a364faed83
Opcode Fuzzy Hash: d62c234410b63160738b8452864292ccc418296d098138251cf7d0e9287c6f9f
Instruction Fuzzy Hash: 78624570904769CFDB21DF68C88479DBBF2BF59304F148599E898AB341DB709989CF82

Function 001660C9 Relevance: 18.8, APIs: 2, Strings: 8, Instructions: 1255COMMON

Download Yara Rule

Strings

ValueError, xrefs: 001661FB, 0016625E
parseHook, xrefs: 00166B21, 00167535, 0016761D
JsonError, xrefs: 00166989, 00166B09, 00166CED, 00166DA6, 00166E25, 00166FA5, 00167479, 0016751D, 00167594, 00167605
-, xrefs: 0016760D
fromHex, xrefs: 00166276
parseObjectInner, xrefs: 00166DBE, 00166FBD
strutils.nim, xrefs: 0016626E
jsony.nim, xrefs: 00166B19, 00166DB6, 00166FB5, 0016752D, 00167615

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID: -$JsonError$ValueError$fromHex$jsony.nim$parseHook$parseObjectInner$strutils.nim
API String ID: 0-130352387
Opcode ID: 4df840365af2f8b4ef330f36d3e65d55abf2bc5b335be0882651356b4928ba36
Instruction ID: 0a13eb7041d68173eec9e5f9bc0841bde76e251a390627835419f38e5a2e0d27
Opcode Fuzzy Hash: 4df840365af2f8b4ef330f36d3e65d55abf2bc5b335be0882651356b4928ba36
Instruction Fuzzy Hash: 29D268B0A042698FDB61DF14CC90799B7B2BF55308F0480D9EA596B392CB309EC9CF59

Function 0015AF50 Relevance: 18.4, APIs: 6, Strings: 4, Instructions: 898comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 0015AFED
GetActiveObject.OLEAUT32 ref: 0015B0EA
CoCreateInstance.COMBASE ref: 0015B124
CoGetObject.OLE32 ref: 0015B23E

Part of subcall function 001574EF: VariantClear.OLEAUT32 ref: 0015751A

SysFreeString.OLEAUT32 ref: 0015B6AE
VariantClear.OLEAUT32 ref: 0015BA77

Strings

com.nim, xrefs: 0015B26E, 0015B878
COMError, xrefs: 0015B269, 0015B880
GetObject, xrefs: 0015B276
GetAV, xrefs: 0015B885

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ClearObjectVariant$ActiveCreateFreeInitializeInstanceString
String ID: COMError$GetAV$GetObject$com.nim
API String ID: 1187925771-4142695778
Opcode ID: ce7f6dca040e84e47eceba1ac363424a6f5346579b5ff5acc37d018486f11329
Instruction ID: 9a2911db6073454db96562f30a5c39c7138e342a1ed10dc4bd7674d7eb7c7457
Opcode Fuzzy Hash: ce7f6dca040e84e47eceba1ac363424a6f5346579b5ff5acc37d018486f11329
Instruction Fuzzy Hash: 69825B74D08358CFDB219F64C49176EBBF1AF56301F148099E8A8AF356DB748989CF82

Function 001716A0 Relevance: 12.1, APIs: 8, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6e96e84b44aaa24c9ac55feba659ecb40cdbead6819ee0b73a946acb7df2052
Instruction ID: d4d2f4e9292f5069e69a2e76704a0cfa1abb59c3c271847fcc6413c04b9228ee
Opcode Fuzzy Hash: f6e96e84b44aaa24c9ac55feba659ecb40cdbead6819ee0b73a946acb7df2052
Instruction Fuzzy Hash: AC515AB1A09701EFC710EF69C48455ABBF5EF84304F56C929E99C9B205EB30E945CB82

Function 00151148 Relevance: 7.6, APIs: 5, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_amsg_exit.MSVCRT ref: 001511DE
_initterm.MSVCRT ref: 00151231
__p__acmdln.MSVCRT ref: 001512BD
exit.MSVCRT ref: 001513AA
_cexit.MSVCRT ref: 001513B8

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: __p__acmdln_amsg_exit_cexit_inittermexit
String ID:
API String ID: 3774341475-0
Opcode ID: e302f8b04be14490dde19eba1e9c80a2ef4e136bd08a5b796d0452b26f88fdf6
Instruction ID: bffe5c0f724e5fa6a095c1d81f5ab828940f7cc68648c6f4ce214d071dfba9c4
Opcode Fuzzy Hash: e302f8b04be14490dde19eba1e9c80a2ef4e136bd08a5b796d0452b26f88fdf6
Instruction Fuzzy Hash: AF6168B4900208EFCB51EFA4D9847ADBBF0FF19315F50805AE864AB760D7749A88CF52

Function 00151189 Relevance: 7.6, APIs: 5, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_amsg_exit.MSVCRT ref: 001511DE
_initterm.MSVCRT ref: 00151231
__p__acmdln.MSVCRT ref: 001512BD
exit.MSVCRT ref: 001513AA
_cexit.MSVCRT ref: 001513B8

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: __p__acmdln_amsg_exit_cexit_inittermexit
String ID:
API String ID: 3774341475-0
Opcode ID: 64a7d1b8e7eafe67cf89682cf26bf4e08eb61b8fa454a5c2dd7866051ba18b7b
Instruction ID: 4025f1cb8971a9b72a4a79d39c635b6b50c41a720d6c37a6c4d734b24f8a54d0
Opcode Fuzzy Hash: 64a7d1b8e7eafe67cf89682cf26bf4e08eb61b8fa454a5c2dd7866051ba18b7b
Instruction Fuzzy Hash: 81418874904204EFCB91EFA4D98472DBBF0BF14315F908419F8A4AB661CB748A88DF52

Function 00151207 Relevance: 7.6, APIs: 5, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_initterm.MSVCRT ref: 00151207
_initterm.MSVCRT ref: 00151231
__p__acmdln.MSVCRT ref: 001512BD
exit.MSVCRT ref: 001513AA
_cexit.MSVCRT ref: 001513B8

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: _initterm$__p__acmdln_cexitexit
String ID:
API String ID: 1163873781-0
Opcode ID: c6564fbdb5a6c48f9bf86465e5e0517d8acb076a7f82be10b7b5e6086303a463
Instruction ID: 91b3393df87d31044bdb48cbef71032b1c79441f41af7e9c3a02c08dfe0e1f0d
Opcode Fuzzy Hash: c6564fbdb5a6c48f9bf86465e5e0517d8acb076a7f82be10b7b5e6086303a463
Instruction Fuzzy Hash: 85418870A04204EFCB91EFA4D98472DBBF0BF14315F908009F8A4AB661DB748A88DF52

Function 00159CAD Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00159FA1
GetExitCodeProcess.KERNELBASE ref: 00159FCA

Strings

D, xrefs: 00159DFE

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CodeExitObjectProcessSingleWait
String ID: D
API String ID: 1680577353-2746444292
Opcode ID: 007aafc847d74cac402fb0e1ee7934f51bc1ade9a6b2173b8df804722e91c3cf
Instruction ID: e6113205256e5169200ca4551ecc0bee2174ebc27b1be18bb1bd5baec8809fd1
Opcode Fuzzy Hash: 007aafc847d74cac402fb0e1ee7934f51bc1ade9a6b2173b8df804722e91c3cf
Instruction Fuzzy Hash: D53225B0E04219CFDB24DFA8C49479DBBF1BF58305F648229E864AF292D7749849CF42

Function 00168129 Relevance: 5.8, Strings: 3, Instructions: 2032COMMON

Download Yara Rule

Strings

@, xrefs: 0016926D
@, xrefs: 001689F4
kI,B, xrefs: 00169B7E

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: _wgetenv
String ID: @$@$kI,B
API String ID: 1821490009-2128285436
Opcode ID: 87ac561064cbc37473a0cbab888912b494ffe2693aa22d2fca083a08fc8b02c2
Instruction ID: 4c2667c72959c77ec3c3af1ba9ede845c49af8e0e73f30df2c835fbbdaeb0bbe
Opcode Fuzzy Hash: 87ac561064cbc37473a0cbab888912b494ffe2693aa22d2fca083a08fc8b02c2
Instruction Fuzzy Hash: 26231C75A00228CFDB64DF28CC81B99B7B6BF99300F4581E9D819AB365DB309E85CF51

Function 0016587C Relevance: 3.5, APIs: 2, Instructions: 540
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00157341: CoInitialize.OLE32(?), ref: 00157364
Part of subcall function 00157341: SysAllocString.OLEAUT32(?), ref: 001573BF

Part of subcall function 00156150: VariantClear.OLEAUT32 ref: 00156178

Sleep.KERNELBASE ref: 00165734
IsDebuggerPresent.KERNEL32(00000000), ref: 00165756

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AllocClearDebuggerInitializePresentSleepStringVariant
String ID:
API String ID: 3378142341-0
Opcode ID: 5db70401f51541382e0c22c597761fff07fc3e69c0a89d2928a86d21740a73b2
Instruction ID: 35ceb80404281ee570bec02f49b79aa4a22a8b4e9b0cd3b7bf60c29f9dbdfcdb
Opcode Fuzzy Hash: 5db70401f51541382e0c22c597761fff07fc3e69c0a89d2928a86d21740a73b2
Instruction Fuzzy Hash: 6A4249B0A05268CFEBA1DF24CC90799B7B6BF95304F0040D9D6486B292CB749EC8CF59

Function 00159029 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

;eD0, xrefs: 0015938C
3}>f, xrefs: 001594B8

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: Initialize
String ID: 3}>f$;eD0
API String ID: 2538663250-262806450
Opcode ID: 774746dd1c6269297d56edfa6b050539fcbff69c66a4701fdb77102ff4435d2d
Instruction ID: db657ba05490583d9ccaa867ae1f663941d97e12ff59c6ecaa14a97c49adaba8
Opcode Fuzzy Hash: 774746dd1c6269297d56edfa6b050539fcbff69c66a4701fdb77102ff4435d2d
Instruction Fuzzy Hash: F16206B0E04269CFEB20DF65C89579DBBB1BF55305F50809AD868AB382DB744D88CF52

Function 001728AE Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 00172917

Part of subcall function 00171DEF: free.MSVCRT ref: 00171E32

Part of subcall function 0017278D: abort.MSVCRT ref: 00172897

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ExceptionHandlerVectoredabortfree
String ID:
API String ID: 3783204689-0
Opcode ID: f926854633170c1097f1e56b8ff6ebdfd221058bf66fc8027e78a9d0b4179254
Instruction ID: e973fe78cfdd504b57c0ceba871dd71206a6109eb6f72bc81462bea76215d72d
Opcode Fuzzy Hash: f926854633170c1097f1e56b8ff6ebdfd221058bf66fc8027e78a9d0b4179254
Instruction Fuzzy Hash: F991A274A04205EFCB14EFA8D985A5DBBF0FF14304F0585A9E8A89B361D774EA85CF41

Function 001583A5 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 8e5fed23386302317144bb346c7bae4e8ad5fadb73db80cce7c2ce0cfed191cf
Instruction ID: 67b6e65cd570e77d6687995dddaf3edf73b87b763c036465f2f27e4431ae7d61
Opcode Fuzzy Hash: 8e5fed23386302317144bb346c7bae4e8ad5fadb73db80cce7c2ce0cfed191cf
Instruction Fuzzy Hash: BF62F5B0E04269CFEF24DF64C89579DBBB1BF55309F50809AD868AB282DB744D88CF51

Function 001663DF Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 490COMMON

Download Yara Rule

Strings

parseHook, xrefs: 001664D8, 0016761D
JsonError, xrefs: 00166407, 001664C0, 00166989, 00167594, 00167605
-, xrefs: 0016760D
-, xrefs: 001664C8
jsony.nim, xrefs: 001664D0, 00167615

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID: -$-$JsonError$jsony.nim$parseHook
API String ID: 0-2511633537
Opcode ID: 25a411ddd2958c35413fee8898acc90850721df48d6b4a493d9620bdbd9a990b
Instruction ID: 5a30d6ad293b8c94384a49bedc3be1c1880acc9dfae4130c50cd7232163dc604
Opcode Fuzzy Hash: 25a411ddd2958c35413fee8898acc90850721df48d6b4a493d9620bdbd9a990b
Instruction Fuzzy Hash: DE3249B0A04268CFDB61DF28CC90B99B7B5BF55304F0480D9EA596B252CB749EC8CF59

Function 001579AA Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 296
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

getValue, xrefs: 00157CC2
com.nim, xrefs: 00157CBA
COMError, xrefs: 00157CB5

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID: COMError$com.nim$getValue
API String ID: 0-564522733
Opcode ID: 8015b081e3c78bcd100491930ff5f627b1631b19dea37b8b2b64bc01045c776a
Instruction ID: 17b8593a871765f5c312edf4b04abdf3ce9a6a8f78c6620c67c78c32bbfa363b
Opcode Fuzzy Hash: 8015b081e3c78bcd100491930ff5f627b1631b19dea37b8b2b64bc01045c776a
Instruction Fuzzy Hash: 5AD16774C08258DFDF12EFA4E4817ADBBF0AF56301F148499E8A0AF395D7749849CB92

Function 00156D2D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32 ref: 00156D5C
CoGetClassObject.COMBASE ref: 00156E74

Strings

com.nim, xrefs: 00156EFF
COMError, xrefs: 00156EFA
CreateObject, xrefs: 00156F07

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ClassInitializeObject
String ID: COMError$CreateObject$com.nim
API String ID: 2072964892-2591894477
Opcode ID: 9e0c41b3aea67a4452ed0d3306db58734fe8e24e0bc0928e1b8b695c4c7ab1be
Instruction ID: b42b8a5907b1f688aeed8b9549b9d966ac6be47ce24b9f2d64516c33cca37d33
Opcode Fuzzy Hash: 9e0c41b3aea67a4452ed0d3306db58734fe8e24e0bc0928e1b8b695c4c7ab1be
Instruction Fuzzy Hash: 755187B4908248DFDB11EFA8D88179EBFF0EF55301F54842AE8A49F351D7749849CB82

Function 001647C7 Relevance: 7.6, APIs: 5, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001580E7: CreatePipe.KERNELBASE ref: 0015812B
Part of subcall function 001580E7: GetLastError.KERNEL32 ref: 00158138

SetHandleInformation.KERNEL32 ref: 00164809
GetLastError.KERNEL32 ref: 00164816
SetHandleInformation.KERNEL32 ref: 00164853
SetHandleInformation.KERNEL32 ref: 00164879
GetLastError.KERNEL32 ref: 001648B5

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ErrorHandleInformationLast$CreatePipe
String ID:
API String ID: 3790209225-0
Opcode ID: a525411b1d36930743772ecbaae0819c748d4e615eace294e71c4eb6e734149f
Instruction ID: 80b6497a44662ff6f029e2bf6b923c91c0a6ea8f0d36958bc919fe7060e192f9
Opcode Fuzzy Hash: a525411b1d36930743772ecbaae0819c748d4e615eace294e71c4eb6e734149f
Instruction Fuzzy Hash: D241CD70908396DFEB10EF64DD84B6ABBF4AF91304F108599E88887342D7749CE8DB12

Function 001649FE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00164AFC
GetLastError.KERNEL32 ref: 00164B07

Strings

W, xrefs: 00164B76

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID: W
API String ID: 2919029540-655174618
Opcode ID: 0dfa5be7acecefd3390cbada4e2972dfc9073a58632e18e6b814606172cc1752
Instruction ID: 59aa45d8a929ec8ac914c70fdc8f92b34066552c70e73353bd546a6f98e6005e
Opcode Fuzzy Hash: 0dfa5be7acecefd3390cbada4e2972dfc9073a58632e18e6b814606172cc1752
Instruction Fuzzy Hash: E4714670D0536ACFEB24DB64C940B99BBF1AF55300F14859AE858AB352D7709E98CF41

Function 00151BBA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00151B7F: strlen.MSVCRT ref: 00151B8E
Part of subcall function 00151B7F: fwrite.MSVCRT ref: 00151BA6
Part of subcall function 00151B7F: fflush.MSVCRT ref: 00151BAE

exit.MSVCRT ref: 00151BDE
VirtualAlloc.KERNELBASE ref: 00151C04

Strings

out of memory, xrefs: 00151BCD

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AllocVirtualexitfflushfwritestrlen
String ID: out of memory
API String ID: 3211969242-49810860
Opcode ID: eab2cd7aaeede16c0bec7e5939e761ead15e823ff6671b70dda28770d1dab6ba
Instruction ID: 18ef5a459b297d3643bc807de05b76c507419160165d1b84ac9b08e5bc99f7a7
Opcode Fuzzy Hash: eab2cd7aaeede16c0bec7e5939e761ead15e823ff6671b70dda28770d1dab6ba
Instruction Fuzzy Hash: 5BE0EDB0448304EBE3417FB8C90A31DBEF9AB50305F40855CE9D856292E7B894858B97

Function 00173841 Relevance: 4.6, APIs: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 617ec4160cd565c82c7059d6acfe9b594cb35dcdc5ba00336d38908b91ce5735
Instruction ID: 2944c8a591b2de68d607c69cdcce9919cd2ce3238472d8d8e257f2605e3d1bbc
Opcode Fuzzy Hash: 617ec4160cd565c82c7059d6acfe9b594cb35dcdc5ba00336d38908b91ce5735
Instruction Fuzzy Hash: D441C774904219DFDB40EFA9D984B9EBBF0FF88314F008559E458AB361D3749A85CF92

Function 00171729 Relevance: 3.8, APIs: 3, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 00171741
abort.MSVCRT ref: 0017B655

Part of subcall function 00173527: realloc.MSVCRT ref: 0017357C

malloc.MSVCRT ref: 00171791
memcpy.MSVCRT ref: 001717BD
malloc.MSVCRT ref: 00171843

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: malloc$abortcallocmemcpyrealloc
String ID:
API String ID: 3078593747-0
Opcode ID: 983174bff2dcccec45114810964da740e5fac3e46421e27ccf1bfa1edbdb0588
Instruction ID: 6b380783ba2db8356398aa7cca464bf98d491571c5b7f94d3b2e570ee0fc2845
Opcode Fuzzy Hash: 983174bff2dcccec45114810964da740e5fac3e46421e27ccf1bfa1edbdb0588
Instruction Fuzzy Hash: AA11F3B56047029FDB10DF28C58425ABBF5FF88314F46C929E99C9B301EB30E946CB82

Function 001730F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

once %p is %d, xrefs: 001731C5

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID: once %p is %d
API String ID: 0-95064319
Opcode ID: 3de6bdd520b894e3d5bbe9128292631a889757e0fb5f186673ed8c02e5899837
Instruction ID: 11fe0c49c9232be525e234d63ed95ba2b76e60649b9d2438c2f7ea493687c6c6
Opcode Fuzzy Hash: 3de6bdd520b894e3d5bbe9128292631a889757e0fb5f186673ed8c02e5899837
Instruction Fuzzy Hash: C531B3B0A04209DFDB00EFA8C88569DBBF0BF15354F408818E8A99B311D775DA809F91

Function 001665BC Relevance: 3.3, APIs: 2, Instructions: 316
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00165734
IsDebuggerPresent.KERNEL32(00000000), ref: 00165756

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: DebuggerPresentSleep
String ID:
API String ID: 598088951-0
Opcode ID: 4a3afd0311ae8835a158449fbf7c5d48833c99f7e013b1a048cc1aa0611f75d1
Instruction ID: 12fbe3d159125b9edb5fc98f34c8075e074b217708afd98567fef928d010889a
Opcode Fuzzy Hash: 4a3afd0311ae8835a158449fbf7c5d48833c99f7e013b1a048cc1aa0611f75d1
Instruction Fuzzy Hash: A9F14BB0A05268CFEBA1DB28CC90B98B7B5BF55305F4440D9E6586B352CB349EC8CF19

Function 00157341 Relevance: 3.1, APIs: 2, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(?), ref: 00157364
SysAllocString.OLEAUT32(?), ref: 001573BF

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AllocInitializeString
String ID:
API String ID: 3145325428-0
Opcode ID: 5af0a885fd61005f8bb9b084a1d5aaebdbaa7eb95380b7403a59ed495182a8e4
Instruction ID: 494a16c26eebc2a0ad3b437135814063eda84b3961174a297da6d375517cb275
Opcode Fuzzy Hash: 5af0a885fd61005f8bb9b084a1d5aaebdbaa7eb95380b7403a59ed495182a8e4
Instruction Fuzzy Hash: 1711C6B1908245DBDB507FB4D88171D7BA4BF21391F544068FDB44F382D7B54D4897A2

Function 00154BD9 Relevance: 3.0, APIs: 2, Instructions: 50fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 00154C13
GetLastError.KERNEL32 ref: 00154C33

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: f715a94f3a1c750a9e5e19449c05eb9235e606bf51a12a03fe491b130c7254ab
Instruction ID: 4cf0281b3414a59d393f2214417757da82a4b00954894ab9f220ea60ba08acec
Opcode Fuzzy Hash: f715a94f3a1c750a9e5e19449c05eb9235e606bf51a12a03fe491b130c7254ab
Instruction Fuzzy Hash: BF118C71D093049FDB10DFB9D48475ABBF4AB88319F00882AE8A48B241D774A888CB91

Function 00156C64 Relevance: 3.0, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CLSIDFromString.COMBASE ref: 00156CB4
CLSIDFromProgID.COMBASE(?,?), ref: 00156CC6

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: From$ProgString
String ID:
API String ID: 2510552579-0
Opcode ID: e15e2ad0b5dc267b51362fd49c082a4acff0bf55296ad20c0b3373815966ec39
Instruction ID: 15db817c2023b3399772780ebdb66db2de2291a495a98b61852cec7fd6e3622a
Opcode Fuzzy Hash: e15e2ad0b5dc267b51362fd49c082a4acff0bf55296ad20c0b3373815966ec39
Instruction Fuzzy Hash: E40184B1804744FFD720AF64C844A5ABFF8EF95351F45881DF8944B301D771A858C7A2

Function 001580E7 Relevance: 3.0, APIs: 2, Instructions: 39pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE ref: 0015812B
GetLastError.KERNEL32 ref: 00158138

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CreateErrorLastPipe
String ID:
API String ID: 269057482-0
Opcode ID: 9330de8e2b846887a3992daff884a6215b8643ef1b56cbbcf765f1bb1fbac4eb
Instruction ID: cecfa3c4a14c52068b249c18b78a5bd0036667724c924606b5aaf0fe65d75f63
Opcode Fuzzy Hash: 9330de8e2b846887a3992daff884a6215b8643ef1b56cbbcf765f1bb1fbac4eb
Instruction Fuzzy Hash: EA01D671E04304DFD700AF6AD88438EFBF4EF88314F408459E854AB302D7B599888F91

Function 001581EC Relevance: 2.5, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE ref: 001581F6
GetLastError.KERNEL32 ref: 00158201

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 9e418a85e0e719f66c9aa517e24a25044b90a3f0203b7ab0941955c734b27697
Instruction ID: 994bf8d9c23ec06a0edac0d76e11ad702b552d104fd3445d50d0675a797606bb
Opcode Fuzzy Hash: 9e418a85e0e719f66c9aa517e24a25044b90a3f0203b7ab0941955c734b27697
Instruction Fuzzy Hash: A6E09B70608649DBCF00EF75D88561A77F46B48348F404058D8455B202DB70D9C48B61

Function 001555BF Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_wgetenv.MSVCRT ref: 0015561E

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: _wgetenv
String ID:
API String ID: 1821490009-0
Opcode ID: 10f5f79c769c43d1a6328bad8ab96c5b7237010c2e33ca638343735c6c19623d
Instruction ID: e4cf143bb918f33d3ec69c2730d99907c819d73e08af6e28c12f364f4ed919e2
Opcode Fuzzy Hash: 10f5f79c769c43d1a6328bad8ab96c5b7237010c2e33ca638343735c6c19623d
Instruction Fuzzy Hash: 342124B4E0020ADFCB04EFA4C591BAEBBF1BF94301F508429E865AB341D7749A45CFA1

Function 00152052 Relevance: 1.4, APIs: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 001520C6

Part of subcall function 00151BE3: VirtualAlloc.KERNELBASE ref: 00151C04

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a1debc5bdb5a22884c2d08395a9dcd9b9b38954aeb957144d0a05cfdf16dc168
Instruction ID: 7c34bd72258a8fc7e96f94cc05a38e7b290b89000549bc2020a8806ae5a18e94
Opcode Fuzzy Hash: a1debc5bdb5a22884c2d08395a9dcd9b9b38954aeb957144d0a05cfdf16dc168
Instruction Fuzzy Hash: 13413AB2A05202CFC714CF28C884BEABBE5AF95305F588179DC68DF356DB759849CB90

Function 0015A58B Relevance: 1.3, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 0015A5BE

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: feddffb8f2bb3540cca1ad7974d790edade8d5ad41ecb65db5b20c5a1ab65247
Instruction ID: ec11d92023f69a76a310fe83a1856eb1f40eca6477e27841143b39a2107dc980
Opcode Fuzzy Hash: feddffb8f2bb3540cca1ad7974d790edade8d5ad41ecb65db5b20c5a1ab65247
Instruction Fuzzy Hash: ADF028729041489BDF00BFB4D80079E7BE5EF95311F404428E6846F241DBB55A8887E2

Function 00151BE3 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00151C04

Part of subcall function 00151BBA: exit.MSVCRT ref: 00151BDE

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AllocVirtualexit
String ID:
API String ID: 1690354023-0
Opcode ID: f997f2ff591878f99aa9f700178ad8ee143a5654876b1ca73cb544650f4672c6
Instruction ID: ea543b7832d98f5f1774d6be6a155d833efab27ff56a4e0950d921ad4480c2ad
Opcode Fuzzy Hash: f997f2ff591878f99aa9f700178ad8ee143a5654876b1ca73cb544650f4672c6
Instruction Fuzzy Hash: 3AD09EB0448301ABE711BF79C50931ABEE4AB40349F40855CD99596151E7B584488B97

Non-executed Functions

Function 0015F6B7 Relevance: 17.4, APIs: 4, Strings: 5, Instructions: 1684COMMON

Download Yara Rule

Strings

VariantConversionError, xrefs: 00160CD2, 00160D21
com.nim, xrefs: 00160D30
<V, xrefs: 0015FCF6
toVariant, xrefs: 00160D38
@, xrefs: 00160958

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID: @$VariantConversionError$com.nim$toVariant$<V
API String ID: 0-1035723416
Opcode ID: ea23410680e4d590aa3fb43b2a97fef77a0549082c8a544815c7c31238eae761
Instruction ID: 1e8858741dd2b47c93efd4b100d7cf4b1b4050f1c234e3ab3d2bdf1eea4ea05c
Opcode Fuzzy Hash: ea23410680e4d590aa3fb43b2a97fef77a0549082c8a544815c7c31238eae761
Instruction Fuzzy Hash: 6CF217B0E04259CFEB24DFA9C89479EBBF1BF58304F148129E854AB351DBB59889CF41

Function 00164227 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 405filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32 ref: 00164464
GetLastError.KERNEL32 ref: 00164486
CreateNamedPipeW.KERNEL32 ref: 001644E9
GetLastError.KERNEL32 ref: 001644FB
CreateFileW.KERNEL32 ref: 0016455B
GetLastError.KERNEL32 ref: 00164581
CreateFileW.KERNEL32 ref: 001645DF
GetLastError.KERNEL32 ref: 00164605

Part of subcall function 0015816B: GetCurrentProcess.KERNEL32 ref: 0015817E
Part of subcall function 0015816B: DuplicateHandle.KERNEL32 ref: 001581AA
Part of subcall function 0015816B: GetLastError.KERNEL32 ref: 001581B7

Strings

, xrefs: 0016424D

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ErrorLast$Create$FileNamedPipe$CurrentDuplicateHandleProcess
String ID:
API String ID: 2980152811-3916222277
Opcode ID: 504970cf1b1a5b0a322d65fc85cc0b04cadd550b3763390e367563219959cf50
Instruction ID: 5970a4dbc6369c1535e522f27ad0dd4bdc6c24ce649e572ccca81771de8e6203
Opcode Fuzzy Hash: 504970cf1b1a5b0a322d65fc85cc0b04cadd550b3763390e367563219959cf50
Instruction Fuzzy Hash: D5127CB4904259CFEB20DF24C980B9EBBF0BF55304F1085A9E899AB242D7709E98CF51

Function 0015ED20 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 600COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0015ED8A
exit.MSVCRT ref: 0015F1F0

Strings

CF3, xrefs: 0015EE96
{3V2, xrefs: 0015EF38
@, xrefs: 0015F1A9
IOError, xrefs: 0015F05E, 0015F0AA
writeFile, xrefs: 0015F0C2
syncio.nim, xrefs: 0015F0BA

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: FileModuleNameexit
String ID: @$CF3$IOError$syncio.nim$writeFile${3V2
API String ID: 3381550187-2796672887
Opcode ID: 9a84ab811026c86ee172193738d1c5793c898df9a9c42674628fe871861d06a0
Instruction ID: 4cadf1435b8e81e868f4152d68d8108e75b14ee446577998c40419bcd5e440ed
Opcode Fuzzy Hash: 9a84ab811026c86ee172193738d1c5793c898df9a9c42674628fe871861d06a0
Instruction Fuzzy Hash: CC520FB0D04258CBEB24DFA9C49479EBBF1BF54305F14812DE864AF295DBB4984ACF41

Function 001515A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 001515B0
LoadLibraryA.KERNEL32 ref: 001515C6
GetProcAddress.KERNEL32 ref: 001515E5
GetProcAddress.KERNEL32 ref: 001515F7

Strings

__register_frame_info, xrefs: 001515DA
libgcc_s_dw2-1.dll, xrefs: 001515A9, 001515BF
__deregister_frame_info, xrefs: 001515EC

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 493474f1e34161e3cb643055ddce8ad849a54af046437465214e910ea94a4995
Instruction ID: 8181ebb62d6b5516a80085dbce31905f800ab53ca26f98fda5e924442d15f12a
Opcode Fuzzy Hash: 493474f1e34161e3cb643055ddce8ad849a54af046437465214e910ea94a4995
Instruction Fuzzy Hash: 6F0121B1819204EBC7117F78AA4931EBFF4AF41351F45452DE9896B200E7B1944CCB93

Function 00171651 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 0017B650
abort.MSVCRT ref: 0017B655

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fff57b192b85e3bb2b336fcff331ea1afb50365680350acea0ec76e416cc36e6
Instruction ID: 0727ee3e9d209a018a7350701f12a2e339ef1f65918a251ae93994dbc13e2f21
Opcode Fuzzy Hash: fff57b192b85e3bb2b336fcff331ea1afb50365680350acea0ec76e416cc36e6
Instruction Fuzzy Hash: 9BE08C71809302EED7107F64860636AB7F0AFA6349F81AC4CE9AC37102E7B495095B96

Function 0016CE7D Relevance: 1.7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

Strings

gfff, xrefs: 0016D169

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 0073a8cf0da60cb04c71dd4f934285ee406274152f31b0e2a9521934299919e5
Instruction ID: d05d3f025d3d231fdd5f60aa165223dc518120e76749fd179958febb2c7b45ca
Opcode Fuzzy Hash: 0073a8cf0da60cb04c71dd4f934285ee406274152f31b0e2a9521934299919e5
Instruction Fuzzy Hash: B512B1B5E0030A8FDB04CFA9C985A9EBBF1AF58350F158169E848DB351E734ED91CB90

Function 0015E078 Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: f74e8335a84f846b557511a2837eca6c20babf6b8a198838de46c1face49d30e
Instruction ID: 916e22746aefe886d7a10eb02a026ae1fab57f1d3e536e0cac12b5a34b33e5a0
Opcode Fuzzy Hash: f74e8335a84f846b557511a2837eca6c20babf6b8a198838de46c1face49d30e
Instruction Fuzzy Hash: B7422974D04264CBEF25DF64C89176DBBF1BB55305F048099E8A8AF382DB744A89CF92

Function 0015AA69 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e5ca33f3c26341ff3e22965885f9e00869a1c127b81eff92c9a67ff44488ca
Instruction ID: 40d6d7f5da375a9c4ab4ea1fa3278598b48ec4d6d5ed049f0312958918bd4fb7
Opcode Fuzzy Hash: 76e5ca33f3c26341ff3e22965885f9e00869a1c127b81eff92c9a67ff44488ca
Instruction Fuzzy Hash: F36181B5E04218DFCB159FA8D880B9EFBF1BF58311F558629EC64AB341C7349849CB92

Function 0016B610 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34ab0970795ce4c984d1a3aec6b80fbb63f1c6f645651df4128e3d80a54c061
Instruction ID: 6f1e34e175b3f071b37b52e33d14bc389e7fe86064f14d1d8bc0af7bb1c934c9
Opcode Fuzzy Hash: f34ab0970795ce4c984d1a3aec6b80fbb63f1c6f645651df4128e3d80a54c061
Instruction Fuzzy Hash: 1C5108757083558FC714CE69D4D461AF7E2ABD8710F11892DE998C7340EBB1D869CB82

Function 001714D0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 095c74716efd8bddd4451833ac99d74df168eb62f009fcb5752a56a238bec1d2
Instruction ID: d03adf1e6235fb576eaecadc5c59ae2c9ca5ecda2a361dbc9a249284bfef390f
Opcode Fuzzy Hash: 095c74716efd8bddd4451833ac99d74df168eb62f009fcb5752a56a238bec1d2
Instruction Fuzzy Hash: F031C3317083196BC718ADADD4C062AF6E39BD9760F55C63DE94EC3380EB719C458781

Function 00175168 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61299e4c75c17738104e74f697f77f070edde94ecc06bd8dfeef939e78a551dd
Instruction ID: 0f06a7b43a7dcf9b71d1553580373452cd29fabad1e8621d3544b3bf4058f6e6
Opcode Fuzzy Hash: 61299e4c75c17738104e74f697f77f070edde94ecc06bd8dfeef939e78a551dd
Instruction Fuzzy Hash: E9F01CB4A08209ABDB00EF78D8C175FB7F5EB88344F108438D858D7345D738E9448B52

Function 001549D9 Relevance: 33.3, APIs: 1, Strings: 18, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 001549E6

Part of subcall function 001530B2: GetLastError.KERNEL32 ref: 00153108
Part of subcall function 001530B2: MessageBoxA.USER32 ref: 001531BA
Part of subcall function 001530B2: exit.MSVCRT ref: 001531E1
Part of subcall function 001530B2: GetProcAddress.KERNEL32 ref: 00153205

Strings

GetLastError, xrefs: 00154A49
CreateFileW, xrefs: 00154A88
Sleep, xrefs: 00154B5A
DuplicateHandle, xrefs: 00154AB2
CreateProcessW, xrefs: 00154AF1
GetStdHandle, xrefs: 00154ADC
LocalFree, xrefs: 00154A34
FormatMessageW, xrefs: 00154A1F
GetModuleFileNameW, xrefs: 00154B6F
SetHandleInformation, xrefs: 00154A5E
WriteFile, xrefs: 00154B1B
GetExitCodeProcess, xrefs: 00154B45
ReadFile, xrefs: 00154B06
CreateNamedPipeW, xrefs: 00154A73
GetCurrentProcess, xrefs: 00154A9D
CloseHandle, xrefs: 00154AC7
WaitForSingleObject, xrefs: 00154B30
CreatePipe, xrefs: 00154A0F

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadMessageProcexit
String ID: CloseHandle$CreateFileW$CreateNamedPipeW$CreatePipe$CreateProcessW$DuplicateHandle$FormatMessageW$GetCurrentProcess$GetExitCodeProcess$GetLastError$GetModuleFileNameW$GetStdHandle$LocalFree$ReadFile$SetHandleInformation$Sleep$WaitForSingleObject$WriteFile
API String ID: 2087689892-1854796719
Opcode ID: befdb44a30ff2a5b53ebae33f462b458d83fa81ae88ceb70c35c65702df019ae
Instruction ID: 8e800d46f0ce13274190fa29ad2e7d28bb393437d1c4d297965e5559ed6f382b
Opcode Fuzzy Hash: befdb44a30ff2a5b53ebae33f462b458d83fa81ae88ceb70c35c65702df019ae
Instruction Fuzzy Hash: 28411D74648A05CF8748EFB0BE854153BB2AB94341390C429AD256FB95FF329B8EDB14

Function 00153051 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 179libraryloaderwindowCOMMON

Download Yara Rule

APIs

exit.MSVCRT ref: 001530AD
GetLastError.KERNEL32 ref: 00153108
MessageBoxA.USER32 ref: 001531BA
exit.MSVCRT ref: 001531E1
GetProcAddress.KERNEL32 ref: 00153205
GetProcAddress.KERNEL32 ref: 001532B6
exit.MSVCRT ref: 00153314

Strings

SIGILL: Illegal operation., xrefs: 0015308A
unknown signal, xrefs: 00153085
(bad format; library may be wrong architecture), xrefs: 00153124, 0015318B, 001531EA
SIGFPE: Arithmetic error., xrefs: 00153078
could not import: , xrefs: 001532DC
@, xrefs: 0015324F
SIGABRT: Abnormal termination., xrefs: 0015306E
SIGINT: Interrupted by Ctrl-C., xrefs: 00153052
SIGSEGV: Illegal storage access. (Attempt to read from nil?), xrefs: 00153064
could not load: , xrefs: 001530D3, 00153139

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: exit$AddressProc$ErrorLastMessage
String ID: (bad format; library may be wrong architecture)$@$SIGABRT: Abnormal termination.$SIGFPE: Arithmetic error.$SIGILL: Illegal operation.$SIGINT: Interrupted by Ctrl-C.$SIGSEGV: Illegal storage access. (Attempt to read from nil?)$could not import: $could not load: $unknown signal
API String ID: 24751467-3370411279
Opcode ID: d8793402c0623a5d2a2b6d1986af706bdd5e43573006fe949b4fe6e4e5b3ca49
Instruction ID: 12106423dddaed43c4a4ae921b44e9ab0c69016f509abd70d5faa5ec383c9a25
Opcode Fuzzy Hash: d8793402c0623a5d2a2b6d1986af706bdd5e43573006fe949b4fe6e4e5b3ca49
Instruction Fuzzy Hash: 6761E770904218DBDB10AF64D8853ADBBF6EF54341F44847DEDACAB342D7788E898B91

Function 0017278D Relevance: 19.3, APIs: 1, Strings: 10, Instructions: 83COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 00172897

Strings

r cl, xrefs: 001727BA
for , xrefs: 001727E4
thre, xrefs: 001727EB
in_k, xrefs: 001727D6
eani, xrefs: 001727C1
Erro, xrefs: 001727B3
ng u, xrefs: 001727C8
ad , xrefs: 001727F2
p sp, xrefs: 001727CF
eys , xrefs: 001727DD

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: abort
String ID: Erro$ad $eani$eys $for $in_k$ng u$p sp$r cl$thre
API String ID: 4206212132-3726152543
Opcode ID: 4fb041ffc129f2bd8360cae0eb144a8438e12de5e45c6e79d0163cca69e3278f
Instruction ID: e2254e235b57a0cfc01948e54c827834f3ce61417433e33a09f75b1f66961d6f
Opcode Fuzzy Hash: 4fb041ffc129f2bd8360cae0eb144a8438e12de5e45c6e79d0163cca69e3278f
Instruction Fuzzy Hash: B9314570A00248DFDB10CFA9D981B9CBBF1FF85310F148269E8589B366D7759A45CF42

Function 001530B2 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 151libraryloaderwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00151B7F: strlen.MSVCRT ref: 00151B8E
Part of subcall function 00151B7F: fwrite.MSVCRT ref: 00151BA6
Part of subcall function 00151B7F: fflush.MSVCRT ref: 00151BAE

GetLastError.KERNEL32 ref: 00153108
MessageBoxA.USER32 ref: 001531BA
exit.MSVCRT ref: 001531E1
GetProcAddress.KERNEL32 ref: 00153205

Strings

(bad format; library may be wrong architecture), xrefs: 00153124, 0015318B, 001531EA
could not import: , xrefs: 001532DC
@, xrefs: 0015324F
could not load: , xrefs: 001530D3, 00153139

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AddressErrorLastMessageProcexitfflushfwritestrlen
String ID: (bad format; library may be wrong architecture)$@$could not import: $could not load:
API String ID: 2650761064-3540049366
Opcode ID: 412e50522e59433a8f58c00127ee9dd2051affdb795b2512d43e3e509a3c6eb6
Instruction ID: e7ee6d74cd0ecc1f77285188c7c44671093ceea39535fad615f75a648d309f59
Opcode Fuzzy Hash: 412e50522e59433a8f58c00127ee9dd2051affdb795b2512d43e3e509a3c6eb6
Instruction Fuzzy Hash: CB51A4B0904218DBDB10AF64D88579DBBF6EF54341F0440BDDDAC9B342D7788E898B91

Function 00157DA4 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

SafeArrayGetDim.OLEAUT32 ref: 00157E99
SafeArrayGetVartype.OLEAUT32 ref: 00157EE1
SafeArrayGetLBound.OLEAUT32 ref: 00157F23
SafeArrayGetUBound.OLEAUT32 ref: 00157F55
SafeArrayAccessData.OLEAUT32 ref: 00157F83
SafeArrayUnaccessData.OLEAUT32 ref: 00157FDE

Part of subcall function 00156669: CoInitialize.OLE32 ref: 00156699
Part of subcall function 00156669: VariantCopy.OLEAUT32 ref: 001566E7

Strings

fromVariant, xrefs: 0015808D
com.nim, xrefs: 00158085
VariantConversionError, xrefs: 00158016, 00158076

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCopyInitializeUnaccessVariantVartype
String ID: VariantConversionError$com.nim$fromVariant
API String ID: 2568714141-2391934419
Opcode ID: 95fb5b1c0c23cbb0e40c8eb316b3b6703fbe3e0cf7b5a58e28ae2fe0354d9eec
Instruction ID: f275b11523315678f4cd2dca9e92d6e995dc50a44b5d56fe6f784ed946efa177
Opcode Fuzzy Hash: 95fb5b1c0c23cbb0e40c8eb316b3b6703fbe3e0cf7b5a58e28ae2fe0354d9eec
Instruction Fuzzy Hash: 38A123B4D04248DFDB14DFA8D4847ADBBF1AF45301F148059ECA4AB392DB799C8ACB91

Function 00157022 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 188memoryCOMMON

Download Yara Rule

APIs

SafeArrayGetDim.OLEAUT32 ref: 0015710F
SysAllocString.OLEAUT32 ref: 001571B0

Part of subcall function 00156669: CoInitialize.OLE32 ref: 00156699
Part of subcall function 00156669: VariantCopy.OLEAUT32 ref: 001566E7

Part of subcall function 001561AB: SysStringLen.OLEAUT32 ref: 001561C8

VariantClear.OLEAUT32 ref: 00157297

Strings

fromVariant, xrefs: 0015724F
com.nim, xrefs: 00157247
VariantConversionError, xrefs: 001571E2, 00157238

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: StringVariant$AllocArrayClearCopyInitializeSafe
String ID: VariantConversionError$com.nim$fromVariant
API String ID: 3897195957-2391934419
Opcode ID: 9a3623ff36ca5defc05330a09d459794d966520bfc5b84e99f8e6b6a36e2c1fb
Instruction ID: 07838d64a80e781b53f38221082d983e3094b06714ccecb31d4220d03b5fb0e1
Opcode Fuzzy Hash: 9a3623ff36ca5defc05330a09d459794d966520bfc5b84e99f8e6b6a36e2c1fb
Instruction Fuzzy Hash: 67716BB0C08658DFDF11AFA4E5857ADBBF0AF5A311F148459ECA46F381D7744888CBA2

Function 0015771D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

SafeArrayGetDim.OLEAUT32 ref: 001577F4
VariantClear.OLEAUT32 ref: 0015798C

Part of subcall function 00156669: CoInitialize.OLE32 ref: 00156699
Part of subcall function 00156669: VariantCopy.OLEAUT32 ref: 001566E7

VariantChangeType.OLEAUT32 ref: 0015784E
CoInitialize.OLE32 ref: 00157942

Strings

fromVariant, xrefs: 001578EA
com.nim, xrefs: 001578E2
VariantConversionError, xrefs: 00157879, 001578D3

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: Variant$Initialize$ArrayChangeClearCopySafeType
String ID: VariantConversionError$com.nim$fromVariant
API String ID: 2375843262-2391934419
Opcode ID: 08551fea83b532d02f4141aad6b875acbbbfec28c0b04907ef6a4026a32a7f23
Instruction ID: 1b3fc76f3daba9d087abfc8a33b45aa342c4b36360d6bc53b6c308a842b976fa
Opcode Fuzzy Hash: 08551fea83b532d02f4141aad6b875acbbbfec28c0b04907ef6a4026a32a7f23
Instruction Fuzzy Hash: E771BFB0D08254DFEF22AFA4E4453ADBBF1AF56315F048459ECA46F382D7744848CBA2

Function 0016A6B8 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 0016A6EC
vfprintf.MSVCRT ref: 0016A70E
abort.MSVCRT ref: 0016A713

Strings

Mingw-w64 runtime failure:, xrefs: 0016A6E5
VirtualQuery failed for %d bytes at address %p, xrefs: 0016A876
VirtualProtect failed with code 0x%x, xrefs: 0016A94C
Address %p has no image-section, xrefs: 0016A7AD

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: abortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 3176311984-1534286854
Opcode ID: fde8bc24eef7b2dec88ed9803e5631bb899217d3bfc4da68efe2c0680ccb684e
Instruction ID: 44bc242133c85fb7afa1b86e9f057a0aa644aa9c4f88a29c9fff40c0200636ef
Opcode Fuzzy Hash: fde8bc24eef7b2dec88ed9803e5631bb899217d3bfc4da68efe2c0680ccb684e
Instruction Fuzzy Hash: 3B6146B4A046069FC704DF58C88165EB7F2FB98340F95C529E998E7391D334EA91CF82

Function 00162579 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 129COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 001625A2
SafeArrayCreate.OLEAUT32 ref: 00162613
SafeArrayPutElement.OLEAUT32 ref: 00162702

Strings

VariantConversionError, xrefs: 00162652, 001626A7
toVariant, xrefs: 001626BC
com.nim, xrefs: 001626B4

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 419aa073161d33c57daae02b1ca02485dbe131983840a8b8512af3b1d7294bff
Instruction ID: 2e4849ea629e9e164e371f01ab859e1817a67a9025fe15996a22eecec880c397
Opcode Fuzzy Hash: 419aa073161d33c57daae02b1ca02485dbe131983840a8b8512af3b1d7294bff
Instruction Fuzzy Hash: 8E518AB09047149FDB21AF78C88476EBBF0BFA5300F54C46DE8989B352D7758895CB92

Function 0016274E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00162777
SafeArrayCreate.OLEAUT32 ref: 001627E8
SafeArrayPutElement.OLEAUT32 ref: 001628E4

Strings

VariantConversionError, xrefs: 00162827, 0016287C
toVariant, xrefs: 00162891
com.nim, xrefs: 00162889

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: ArraySafe$CreateElementInitialize
String ID: VariantConversionError$com.nim$toVariant
API String ID: 2234878901-3035603046
Opcode ID: 10ee95c116314c043b13a426d8b58d2904a18bf513769760ff0e2b3ebbd0c165
Instruction ID: f7388451eb6fbb4cf8d1730b03f6003db94246c6000f7590caffb9a256d9ab41
Opcode Fuzzy Hash: 10ee95c116314c043b13a426d8b58d2904a18bf513769760ff0e2b3ebbd0c165
Instruction Fuzzy Hash: D4418DB0D047189FEB21AF78C84475EBBF0BF99304F11846DE8989B341D7798845CB92

Function 001531E6 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00153205
GetProcAddress.KERNEL32 ref: 001532B6
exit.MSVCRT ref: 00153314

Strings

(bad format; library may be wrong architecture), xrefs: 00153124, 0015318B, 001531EA
could not import: , xrefs: 001532DC
@, xrefs: 0015324F

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: AddressProc$exit
String ID: (bad format; library may be wrong architecture)$@$could not import:
API String ID: 3486290055-3121247141
Opcode ID: ba10b8dc9c0093941cc00118961ece025193be3385e92c53c79ede6d6a61ba63
Instruction ID: 4ad5b0e24fbe77298219326fb12b8fc6ce5db572a05edd6792f6ea1ede05e96d
Opcode Fuzzy Hash: ba10b8dc9c0093941cc00118961ece025193be3385e92c53c79ede6d6a61ba63
Instruction Fuzzy Hash: A931D370904618DADB14AB69D8827EEF7F6AB55341F0440BDDDAC87242D3398E498BA1

Function 00175504 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 36COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00175561
exit.MSVCRT ref: 0017556D

Strings

Assertion failed: (%s), file %s, line %d, xrefs: 00175556
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 0017554E
(, xrefs: 0017553E
src/rwlock.c, xrefs: 00175546

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: exitfprintf
String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$Assertion failed: (%s), file %s, line %d$src/rwlock.c
API String ID: 4243785698-3585572628
Opcode ID: 657c3b47538dc2649627c3487a81d95cc0617c8372194f668b4ac25dc8f5ea7f
Instruction ID: 10c1b2d8a8efdae9075ac491472ae1fc78bc44ff3b54347d649acdff00bd3033
Opcode Fuzzy Hash: 657c3b47538dc2649627c3487a81d95cc0617c8372194f668b4ac25dc8f5ea7f
Instruction Fuzzy Hash: 2301AE746057089FC341EFA8C589909BBF5BF49344F41C948E48CAB326D7B4E9899F92

Function 0016ADA8 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 0016AE3D
signal.MSVCRT ref: 0016AE5A
signal.MSVCRT ref: 0016AE9C
signal.MSVCRT ref: 0016AEB9
signal.MSVCRT ref: 0016AEFF
signal.MSVCRT ref: 0016AF1C

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: 6949ca8f799aa8d033758fd3bf8f5d029f544a4ce3359bc75fd43cdbee347d9e
Instruction ID: fb75fd1f0520a6f2651d7460f711ca59bb3de992ea152bb73146b84d015e1b50
Opcode Fuzzy Hash: 6949ca8f799aa8d033758fd3bf8f5d029f544a4ce3359bc75fd43cdbee347d9e
Instruction Fuzzy Hash: F0411CB0804205CEEB24DFA4D94836EB7F0AF15328F518A49D0E8B72D1C7798A94CF53

Function 001575E1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00157611
VariantCopy.OLEAUT32 ref: 0015765F

Strings

com.nim, xrefs: 001576E8
toVariant, xrefs: 001576F0
VariantConversionError, xrefs: 0015768D, 001576D9

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$toVariant
API String ID: 633353902-3035603046
Opcode ID: 5664c80d141535666b9c5b701ad560f6c19fddb65252a025bc8ccdae58a011b6
Instruction ID: 42ff6943f5ac50c275648925837355ad27af43e361b4223e1e3181e66745b6d7
Opcode Fuzzy Hash: 5664c80d141535666b9c5b701ad560f6c19fddb65252a025bc8ccdae58a011b6
Instruction Fuzzy Hash: F131C1B1908305DFDB10AF78E44539ABFF1AF98301F00C82DE8A95B782D7749948CB92

Function 00156669 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00156699
VariantCopy.OLEAUT32 ref: 001566E7

Strings

com.nim, xrefs: 00156770
newVariant, xrefs: 00156778
VariantConversionError, xrefs: 00156715, 00156761

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CopyInitializeVariant
String ID: VariantConversionError$com.nim$newVariant
API String ID: 633353902-805458017
Opcode ID: 682434338e4c7cfc71424293bba6976883b2960580b05f3bc597978f9b57c3d6
Instruction ID: 43e604fd07d80ee9b992db948681d93bd0ae37d7491100e1ac0495f0b3166e3f
Opcode Fuzzy Hash: 682434338e4c7cfc71424293bba6976883b2960580b05f3bc597978f9b57c3d6
Instruction Fuzzy Hash: 4E31AFB1904305DFDB10AF74D44075EBBF0AF99305F90C82DE8A9AB742D7B59948CB92

Function 001758E1 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 0017590F

Strings

, xrefs: 00175900

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: calloc
String ID:
API String ID: 2635317215-3916222277
Opcode ID: f65756ecc1919784dff9414ac3e3b7b77ab1357038e3adb49f7eaf2e7ec3b0d8
Instruction ID: b5b8445f272458cd468fd9369ee5d9edfa0ba7f8d4a15600d3200e8daa254ca1
Opcode Fuzzy Hash: f65756ecc1919784dff9414ac3e3b7b77ab1357038e3adb49f7eaf2e7ec3b0d8
Instruction Fuzzy Hash: C0418074904618DFDB04EFA8C48979DF7F1FF04308F4189A9E8A9AB342D7749944CB41

Function 00153F9A Relevance: 7.6, APIs: 5, Instructions: 83fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,?,0016A22B), ref: 00153FAE
fputc.MSVCRT ref: 0015403A
fwrite.MSVCRT ref: 0015408D
fflush.MSVCRT ref: 001540A1
LeaveCriticalSection.KERNEL32 ref: 001540AD

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: CriticalSection$EnterLeavefflushfputcfwrite
String ID:
API String ID: 623422050-0
Opcode ID: 9786cf9bc2b716c157628e7889602b29449d63e85a799b72493d24b315673e12
Instruction ID: 5b8ef42d578cce2c18875a33ff6ee2b0c47db3fb2f61b7071d5e6d091432c1cb
Opcode Fuzzy Hash: 9786cf9bc2b716c157628e7889602b29449d63e85a799b72493d24b315673e12
Instruction Fuzzy Hash: CB313CB0804305DFDB00EFA8D9807ADBBF4EF88345F15C52DE998AB251D7799984CB52

Function 0017AECB Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0017B095

Strings

z, xrefs: 0017B106

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: memset
String ID: z
API String ID: 2221118986-1657960367
Opcode ID: 0ef5c05490bef00ab64c421e8dc0c76466720ee0f7439091521b3c6582c53863
Instruction ID: 9cc26bf8f4a4a4f064e017372fb5fec3f7bf7b8b1eb96618dae5bdbc20ffb524
Opcode Fuzzy Hash: 0ef5c05490bef00ab64c421e8dc0c76466720ee0f7439091521b3c6582c53863
Instruction Fuzzy Hash: 3F817F70A0420ADFDB10CF59C485BAEBBF0BF48354F10C519E968AB250D379EA95CF95

Function 0017B3FB Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0017B56A

Strings

&, xrefs: 0017B5E4

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: memset
String ID: &
API String ID: 2221118986-1010288
Opcode ID: 97417f53290297cc1caa45a986f46549f3145e6d93713e9dbf45f40050e36feb
Instruction ID: 071f8b18bac9724693181d1d73f2eb387e9f58b24cc71dbff940dc1a2f83f160
Opcode Fuzzy Hash: 97417f53290297cc1caa45a986f46549f3145e6d93713e9dbf45f40050e36feb
Instruction Fuzzy Hash: B7718F7090820ADFDF11CF59C4847AEB7B0BF08354F14C519E86AAB291D378DA95CF95

Function 0017B1FD Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0017B35E

Strings

&, xrefs: 0017B3CF

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: memset
String ID: &
API String ID: 2221118986-1010288
Opcode ID: 9e4d073aa8be4ade6cae661355d0d0f7307d55aeb76e789427c838b067a72e7a
Instruction ID: 3efb1ba4175510258bef4390d3b20d68c96d7b5552518c71c2e97b166e34894c
Opcode Fuzzy Hash: 9e4d073aa8be4ade6cae661355d0d0f7307d55aeb76e789427c838b067a72e7a
Instruction Fuzzy Hash: 2A71D27090924ADFDF11CF99C4887AEBBF0BF04355F14C559E868AB281D378AA84CF95

Function 00176663 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 001766B6
fprintf.MSVCRT ref: 00176701

Strings

C%p %d V=%0X w=%ld %s, xrefs: 001766F6
C%p %d %s, xrefs: 001766AB

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 383729395-884133013
Opcode ID: 3b850712f0461dcd692b9999e189e62e8f52db8e80b39e11fc5f48cf0b6ed218
Instruction ID: 80ce9f23b774e3359e93c079273f7714961a133a64463225429c7d2a9ed957bf
Opcode Fuzzy Hash: 3b850712f0461dcd692b9999e189e62e8f52db8e80b39e11fc5f48cf0b6ed218
Instruction Fuzzy Hash: 4C219D78A047059FCB44DFA9D88495ABBF4AB88350F10C52AF999DB320D730AA85CF91

Function 001757D9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 00175822
printf.MSVCRT ref: 0017587C

Strings

RWL%p %d %s, xrefs: 0017581B
RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 00175875

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: printf
String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 3524737521-1971217749
Opcode ID: cac0e2199012965f845d098552002213f591796589e4998578db7f78405708ad
Instruction ID: 9660f7e5f3f2e3ae3ffeb63242a3d660a71b103626e415883f3bd19ab07d5012
Opcode Fuzzy Hash: cac0e2199012965f845d098552002213f591796589e4998578db7f78405708ad
Instruction Fuzzy Hash: C721B374A08708AFCB44DF59D48065ABBF1EB88350F10C46AF89DCB360D774EA448F82

Function 00172B99 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 00172BD9
printf.MSVCRT ref: 00172C2F

Strings

T%p %d V=%0X H=%p %s, xrefs: 00172C28
T%p %d %s, xrefs: 00172BD2

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: printf
String ID: T%p %d %s$T%p %d V=%0X H=%p %s
API String ID: 3524737521-2059990036
Opcode ID: e95a11bbecf43738865ecdccdeb76ad0a196bd043dc8da38363628c8f9cf4be5
Instruction ID: 7c247a459a69251d45a2c3d2224afe214f762a2df759d09d4879824b9ddc7da3
Opcode Fuzzy Hash: e95a11bbecf43738865ecdccdeb76ad0a196bd043dc8da38363628c8f9cf4be5
Instruction Fuzzy Hash: 891192746083089FCB54EF69D481A1ABBF4AB99390F11C929F988C7311E730DA85CB52

Function 0017112D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00171142
strchr.MSVCRT ref: 00171152
atoi.MSVCRT ref: 00171169

Strings

., xrefs: 00171147

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 913335cb0b85864febce951fc101198b94ac045b3d78c8280c564eefbe26e24a
Instruction ID: d2fe5243c0f5887aa4b3cad3ba0dae3bd3ec34932bc1b9b2fac996affdbb5f0c
Opcode Fuzzy Hash: 913335cb0b85864febce951fc101198b94ac045b3d78c8280c564eefbe26e24a
Instruction Fuzzy Hash: 66E09274808304ABD700BFB9D44A35DBBF4AB00348F51C85CA0889B282DBB89884DB86

Function 0017AC8A Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0017AE37

Strings

z, xrefs: 0017AE9F

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: memset
String ID: z
API String ID: 2221118986-1657960367
Opcode ID: 4e004038e5ce447c5d926e871573253a326e2d7f0417e89028d3d285f5756ebf
Instruction ID: 377a487fcb129feee2f9d10f3566d147e00e714626da35cfd0d753932ef3d0cd
Opcode Fuzzy Hash: 4e004038e5ce447c5d926e871573253a326e2d7f0417e89028d3d285f5756ebf
Instruction Fuzzy Hash: 59819E7090420ADFDF11CF59C4847AEBBF0AF88354F54C529E858AB250D778EA95CF92

Function 00173527 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

realloc.MSVCRT ref: 0017357C
realloc.MSVCRT ref: 001735B2

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: 750778984303436d8204164a2b96f6afb10b844e5b164c96d1f4f46635b00e3a
Instruction ID: 6c86622d5682c7110dc3b954d3d88bfaeb34aba448da8c81679d6b069128ae0a
Opcode Fuzzy Hash: 750778984303436d8204164a2b96f6afb10b844e5b164c96d1f4f46635b00e3a
Instruction Fuzzy Hash: 675174B4A0461ADFCB00DFA8C985AAEB7F1BF48304F518959E858EB315D734E941CF51

Function 00151006 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00151026
__set_app_type.MSVCRT ref: 00151034
__p__fmode.MSVCRT ref: 00151039
__p__commode.MSVCRT ref: 00151046

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: __set_app_type$__p__commode__p__fmode
String ID:
API String ID: 2522132747-0
Opcode ID: 40c2bb5b54a1eef4d17ebd0d7dc712566a0fba737124ef72c622144d80bcf12f
Instruction ID: 549e278478de60bc8e4958229e42467b195c331a9de651377ccb9a2076b26bbb
Opcode Fuzzy Hash: 40c2bb5b54a1eef4d17ebd0d7dc712566a0fba737124ef72c622144d80bcf12f
Instruction Fuzzy Hash: 9CF05874100340CBD352BFA8D84232E77E9AF54304F818519E8989B693DB749DC5CBA2

Function 001542C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 0015434B
LocalFree.KERNEL32 ref: 00154380

Strings

OSError, xrefs: 001542EF

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: FormatFreeLocalMessage
String ID: OSError
API String ID: 1427518018-4278961375
Opcode ID: a34d6b3c9c30f7023c7b0e6fd6a869297ce6d5edb0344b19e76e40edba233883
Instruction ID: ff199c0371ab211ed3b5ba14bb124876f1c211368873881b055a90568c5e85d9
Opcode Fuzzy Hash: a34d6b3c9c30f7023c7b0e6fd6a869297ce6d5edb0344b19e76e40edba233883
Instruction Fuzzy Hash: 554147B0A04208DFDB01EF68C884BAEFBF5AF98345F048519E864AF351D7749989CB91

Function 00172D01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00172D9D
fprintf.MSVCRT ref: 00172DC4

Strings

%p not found?!?!, xrefs: 00172DB9

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintffree
String ID: %p not found?!?!
API String ID: 92069018-11085004
Opcode ID: bdb494002378bf90f6d9f9516df6bb8b9f55899f1a6e424f5406bd03e741c821
Instruction ID: f4230e614f766e0b2d86e0aa856f00e19a02610d3a3d36f4894dc42f182a8e93
Opcode Fuzzy Hash: bdb494002378bf90f6d9f9516df6bb8b9f55899f1a6e424f5406bd03e741c821
Instruction Fuzzy Hash: 5721B374904609DFCB10EF99C488A9DBBF0AF58354F01C85AE8999B361D774EA81CF81

Function 00151EA9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 00151F13
exit.MSVCRT ref: 00151F33

Strings

virtualFree failing!, xrefs: 00151F20

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: FreeVirtualexit
String ID: virtualFree failing!
API String ID: 1212090140-3108117800
Opcode ID: d8ca97fc4d1d0d12d8ac46440a1bac20f6e3f3cc91d5ce2e1620fb740602ece6
Instruction ID: 52dddcc781906f6420d15f8b7d796e4ea0a1769439645f014c682aeaa7caa159
Opcode Fuzzy Hash: d8ca97fc4d1d0d12d8ac46440a1bac20f6e3f3cc91d5ce2e1620fb740602ece6
Instruction Fuzzy Hash: 0001B176A04200DFDB00AF6DD9843E9BBF4FF84315F18817AEC488B256D7714449CBA2

Function 0016A5F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695
Unknown error, xrefs: 0016A640

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: cf736b279868d1555feadf2da46ddab734d23a7c4d21adc693688e8dd4001856
Instruction ID: dd82589db29b64da1f9f36071f8d2aed6b46f55eea3873b794f3de08630026ca
Opcode Fuzzy Hash: cf736b279868d1555feadf2da46ddab734d23a7c4d21adc693688e8dd4001856
Instruction Fuzzy Hash: D211B374504608EBDB00EF55E48899DBFF0FF8C340F528488E8C8A7255C735E9A4CB56

Function 0016A613 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695
Argument singularity (SIGN), xrefs: 0016A613

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 1016ac08033ce5f6b26118086dc80efd188b7b24b7522144bd3d1dd458f0321f
Instruction ID: 01a99eb37486af2e8111d206e0c2888fa80e55cabb56bdfb2e5218c1bab44a1a
Opcode Fuzzy Hash: 1016ac08033ce5f6b26118086dc80efd188b7b24b7522144bd3d1dd458f0321f
Instruction Fuzzy Hash: 11017E74904A08DBDB00EF45E08899DBFB0FF88344F928488E8C866255CB3599B4CB52

Function 0016A61C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

Overflow range error (OVERFLOW), xrefs: 0016A61C
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 9a1aa47a611df712420709d29b28ccb918504b3a22833ec4da6de919726b613f
Instruction ID: bc3e41e4e3483eefa5e828f128d8c47473fcf1faff0796f491e10f67b20cee81
Opcode Fuzzy Hash: 9a1aa47a611df712420709d29b28ccb918504b3a22833ec4da6de919726b613f
Instruction Fuzzy Hash: 59017E74904A08DBDB40EF45E08899DBFF0FF88344F928488E4C866255CB3599A4CB52

Function 0016A60A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

Argument domain error (DOMAIN), xrefs: 0016A60A
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 031e1b9a5ff37e5a72789adf4e3bd7aa0230cc5c5612615ad1179f432558dac0
Instruction ID: 05c94dd1cadf6cbb1e2e1b714825cf266d8e0685fd75ea901a5416ad8d504ea4
Opcode Fuzzy Hash: 031e1b9a5ff37e5a72789adf4e3bd7aa0230cc5c5612615ad1179f432558dac0
Instruction Fuzzy Hash: 7A017E74904A09DBDB00EF45E08899DBFB0FF88344F928488E8C866255CB3599B4CB52

Function 0016A637 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695
The result is too small to be represented (UNDERFLOW), xrefs: 0016A637

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: d7e22ff8f4beb3957ff70404f0efbb95984030cf7fcf282ddabb5220d9022fba
Instruction ID: 1e3bbaa8d4613d06cb9fe2225bdb7ccb07cca3baef0c4dd5a0e2f7306660305d
Opcode Fuzzy Hash: d7e22ff8f4beb3957ff70404f0efbb95984030cf7fcf282ddabb5220d9022fba
Instruction Fuzzy Hash: D0017E74904A08DBDB00EF45E08899DBFB0FF88344F928488E4C866255CB3599A4CB56

Function 0016A625 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695
Partial loss of significance (PLOSS), xrefs: 0016A625

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: a22a26f69835961887243bc2d493e31148c01a641a010a62e8a42ea70b645ea0
Instruction ID: 6f33d8ea0e753724e94728db8dbac206e1380f44cb3b50a152e18b11c2d28252
Opcode Fuzzy Hash: a22a26f69835961887243bc2d493e31148c01a641a010a62e8a42ea70b645ea0
Instruction Fuzzy Hash: 4B017E74904A08DBDB40EF45E08899DBFF0FF88344F928488E4C866255CB3599A4CB52

Function 0016A62E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0016A6A0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0016A695
Total loss of significance (TLOSS), xrefs: 0016A62E

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 7e8e3086a3ba8e999b7c744ee3db7b83418bb67d6312aff60c34af3295bb10da
Instruction ID: f29bcd4842c3f78341a88f72f94c4c3b61080e599e96d5d6de5e1de3246fd3d9
Opcode Fuzzy Hash: 7e8e3086a3ba8e999b7c744ee3db7b83418bb67d6312aff60c34af3295bb10da
Instruction Fuzzy Hash: A5017E74904A08DBDB00EF45E48899DBFB0FF88344F928488E4D866255CB3599A4CB52

Function 001725A4 Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00172602
free.MSVCRT ref: 0017261A
free.MSVCRT ref: 00172632
memset.MSVCRT ref: 0017264D

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: free$memset
String ID:
API String ID: 2717317152-0
Opcode ID: 35233fbc04faa67bab41ae61c1baf2535e6e3ea8bb32b4c16d9a3d76500372ff
Instruction ID: fed4d395ab90a2711f778233283c5491aa9184d7f852991cc664f7ce346b3bb4
Opcode Fuzzy Hash: 35233fbc04faa67bab41ae61c1baf2535e6e3ea8bb32b4c16d9a3d76500372ff
Instruction Fuzzy Hash: AD319B746043099FDB50EF69C584AA97BF4BB18394F528569FC8CCB752DB30EA81CB81

Function 001514B1 Relevance: 5.1, APIs: 4, Instructions: 63stringCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 001514C4
strlen.MSVCRT ref: 001514F1
malloc.MSVCRT ref: 00151512
memcpy.MSVCRT ref: 00151549

Memory Dump Source

Source File: 00000000.00000002.3541190615.0000000000151000.00000020.00000001.01000000.00000003.sdmp, Offset: 00150000, based on PE: true

Associated: 00000000.00000002.3541141015.0000000000150000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541240299.000000000017C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541261107.000000000017D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541282605.0000000000188000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541302716.000000000018C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3541322571.000000000018D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150000_1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 0df883d8f804be8603d09f79e5027836c1e691306ccb3d88e202735976b77b69
Instruction ID: 6ab39dca939fb4d051960e9a5551aac10d93c2ce0525e6e44a461e3dbc22f1bd
Opcode Fuzzy Hash: 0df883d8f804be8603d09f79e5027836c1e691306ccb3d88e202735976b77b69
Instruction Fuzzy Hash: 49216AB4A0460ADFDB04DF98D881A9EB7F0FF49308F148458E559EB311E334AA44CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Windows Analysis Report
1734347766284d20dc9a2ac535c59f41881efe888891552ad79abf01710e07a6dadfae2b13366.dat-decoded.exe

Function 001716A0 Relevance: 12.1, APIs: 8, Instructions: 139
COMMON

Function 00151148 Relevance: 7.6, APIs: 5, Instructions: 146
COMMON

Function 00151189 Relevance: 7.6, APIs: 5, Instructions: 111
COMMON

Function 00151207 Relevance: 7.6, APIs: 5, Instructions: 105
COMMON

Function 00159CAD Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553
synchronizationCOMMON

Function 0016587C Relevance: 3.5, APIs: 2, Instructions: 540
sleepCOMMON

Function 001579AA Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 296
COMMON

Function 00156D2D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143
COMMON

Function 001647C7 Relevance: 7.6, APIs: 5, Instructions: 92
COMMON

Function 001649FE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166
processCOMMON

Function 00151BBA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23
memoryCOMMON

Function 00173841 Relevance: 4.6, APIs: 3, Instructions: 111
COMMON

Function 00171729 Relevance: 3.8, APIs: 3, Instructions: 47
COMMON

Function 001730F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76
COMMON

Function 001665BC Relevance: 3.3, APIs: 2, Instructions: 316
sleepCOMMON